36bf58da2f7f62002abb4f5c2c5a072d.bin
- SHA256 8801fd5f2c95475696a3fdb0ffeeea8922079de3ad0f70ab77e0ce5ee897bd3b
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
300789c9e0f6e6ae074879cd502c59d1982096b003d5f6281ee0b25a8bd2013b.exe
Resource
win7-20240215-en
windows7-x64
36 signatures
150 seconds
Behavioral task
behavioral2
Sample
300789c9e0f6e6ae074879cd502c59d1982096b003d5f6281ee0b25a8bd2013b.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 36bf58da2f7f62002abb4f5c2c5a072d.bin
- Size 757KB
- Sample240519-bg71kaad67
- SHA256 8801fd5f2c95475696a3fdb0ffeeea8922079de3ad0f70ab77e0ce5ee897bd3b
- MD5 d298a87d4859ba4ee35d2b10921c2afb
- SHA1 0922e56b790f5462c67f121b324eb583b5ad6188
- SHA512 300f2a88b29d548613bab9bf5846084b7a09472a57b32b6ab1397d0e03c75bbe5be50dd5475e229a6a7f306f2cd121bc5afe76aa59f5e6cefae2d6c5506148f8
- SSDEEP 12288:ktZWmfEfroVo3bPuOhhgzPuQ6Ys8czW3K/gBQx/tKD1Xhoh5/yO0cjs2GtQBl:QLMUW3bPuOhhxQ6YNKLuQtKD125I1jA
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
36bf58da2f7f62002abb4f5c2c5a072d.bin.zip 757KB
-
300789c9e0f6e6ae074879cd502c59d1982096b003d5f6281ee0b25a8bd2013b.exe.exe 1.4MB
300789c9e0f6e6ae074879cd502c59d1982096b003d5f6281ee0b25a8bd2013b.exe
- IMPHASH 14c198737dea646ad253084b784990ed
- SHA256 300789c9e0f6e6ae074879cd502c59d1982096b003d5f6281ee0b25a8bd2013b
- MD5 36bf58da2f7f62002abb4f5c2c5a072d
- SHA1 ad7a36450153dfe5bb264bc902963c1941ee4600
- SHA512 9619be591d4e898951119936b017cbbf9760aa0d7d77323164f33933e6e6f3e0ddb5f664f608b12af1ba0266729d30077ee9e592fee3a97c7391c29eea4d9fe4
- SSDEEP 24576:MwGvIBKN5VI/EtUhUN51zj1SqdAGFQZIxvC45UJoenX:ZKNU/EtUuN3zjYq+ZIlL5UJoeX
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
f5:ab:4d:69:d5:c9:38:ac:ba:a5:01:ee:c0:60:07:cd:bd:9c:fc:ec:10:c1:2d:74:8d:d0:81:90:66:d1:34:53
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 30, 2023
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 5, 2022 - Jan 6, 2024
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
0
Major OS version
5
Entry point
316003
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\vmagent_new\bin\joblist\750240\out\Release\360Installer.pdb
kernel32
GetVersionExW
GetVersion
GetProcAddress
GetModuleHandleW
FreeLibrary
lstrlenW
lstrcmpiW
LeaveCriticalSection
RaiseException
EnterCriticalSection
GetLastError
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
DebugBreak
OutputDebugStringW
lstrlenA
LockResource
FreeResource
GetCurrentThreadId
GetCommandLineW
LocalFree
GetSystemDirectoryW
CloseHandle
ReadFile
SetFilePointer
CreateFileW
GetCurrentProcessId
DeviceIoControl
GetUserDefaultUILanguage
GetTempPathW
SetEnvironmentVariableW
Sleep
GetCurrentProcess
FlushInstructionCache
SetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetFileSizeEx
GetLogicalDriveStringsW
GetDriveTypeW
GetTempFileNameW
DeleteFileW
GetDiskFreeSpaceExW
QueryDosDeviceW
OpenProcess
MulDiv
GetPrivateProfileStringW
GetTickCount
CreateProcessW
LoadLibraryW
GetModuleFileNameA
CreateToolhelp32Snapshot
MoveFileExW
FindClose
GetFullPathNameW
FindFirstFileW
lstrcpyW
FindNextFileW
RemoveDirectoryW
FreeConsole
Process32FirstW
Process32NextW
WideCharToMultiByte
SetEvent
CreateMutexW
CreateEventW
WaitForSingleObject
GetLogicalDrives
WriteFile
LocalAlloc
InterlockedCompareExchange
CreateFileA
GetFileSize
InterlockedExchange
LoadLibraryA
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetEndOfFile
SetFilePointerEx
TlsGetValue
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
ReleaseMutex
TlsAlloc
TlsFree
lstrcmpA
lstrcmpiA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
ExitProcess
GetStartupInfoW
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
HeapReAlloc
HeapSize
HeapCreate
HeapDestroy
GetStdHandle
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetModuleHandleA
SetStdHandle
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FindResourceExW
Name
.text
Size
413KB
Virtual Size
413KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
918KB
Virtual Size
917KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=150, version=20413,
count=26, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=168, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=77, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=132, productName=VS2008 build 21022, version=21022,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=430, id=1, productName=Unmarked objects,
count=105, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,