8de2fd12c142b386f6465f4fe39ab08bed03823e0a01fd0ea2794b2c21710e62

Sharing

Copy URL Twitter E-mail

General

Target
8de2fd12c142b386f6465f4fe39ab08bed03823e0a01fd0ea2794b2c21710e62
Size 2.9MB
Sample240606-as87bsdf47
SHA256 8de2fd12c142b386f6465f4fe39ab08bed03823e0a01fd0ea2794b2c21710e62
MD5 4f146e4dcb5e5e4d7047a09cc9285cf9
SHA1 b8d21a5dfb186c78247ba8e9e4ef9577153692cb
SHA512 49f8c4a30fb0d178a25a9f11afcaa476468d719e27f44831d3dd83bb851f141b00eabd443e9ecd5e50d41b4ab3b0e142b0e89ed89e72d175c9ca599398ec2539
SSDEEP 49152:bYkK4XOUUaoLXiLw53y+etAYDIR4xTbRsPRanBFYCa6pgXlJM8Cw07gRxBmlIt43:wi/omLw53y+O8obRsPdCa6pAON3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8de2fd12c142b386f6465f4fe39ab08bed03823e0a01fd0ea2794b2c21710e62

File Explorer

8de2fd12c142b386f6465f4fe39ab08bed03823e0a01fd0ea2794b2c21710e62

.dll 2.9MB

8de2fd12c142b386f6465f4fe39ab08bed03823e0a01fd0ea2794b2c21710e62

IMPHASH cbd6ebea7bb242c82f6b341b80b7dfb7
SHA256 8de2fd12c142b386f6465f4fe39ab08bed03823e0a01fd0ea2794b2c21710e62
MD5 4f146e4dcb5e5e4d7047a09cc9285cf9
SHA1 b8d21a5dfb186c78247ba8e9e4ef9577153692cb
SHA512 49f8c4a30fb0d178a25a9f11afcaa476468d719e27f44831d3dd83bb851f141b00eabd443e9ecd5e50d41b4ab3b0e142b0e89ed89e72d175c9ca599398ec2539
SSDEEP 49152:bYkK4XOUUaoLXiLw53y+etAYDIR4xTbRsPRanBFYCa6pgXlJM8Cw07gRxBmlIt43:wi/omLw53y+O8obRsPdCa6pAON3
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1977616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\vmagent_new\bin\joblist\533452\out\Release\AntiAdwa.pdb

kernel32

ExpandEnvironmentStringsW SearchPathW GetCurrentProcess TlsGetValue TlsSetValue GetModuleHandleW GetDriveTypeW LocalAlloc LocalFree CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW SetFilePointer WriteFile InitializeCriticalSection GetSystemTime GetLocalTime GetFileSize GetLogicalDriveStringsW GetLongPathNameW QueryDosDeviceW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetFileAttributesExW ReadFile GetTempPathW ConnectNamedPipe CreateNamedPipeW GetCurrentThreadId CreateProcessW GetWindowsDirectoryW GetVersionExW FreeResource GlobalAlloc GlobalFree lstrcmpiW MoveFileExW GlobalMemoryStatusEx RemoveDirectoryW GetPrivateProfileStringW FileTimeToLocalFileTime lstrcmpW FileTimeToSystemTime lstrcpynW GetPrivateProfileIntW WaitForMultipleObjects GetCurrentDirectoryW GetFileTime SetFileAttributesW GetCurrentProcessId ProcessIdToSessionId OpenProcess MoveFileW GetExitCodeProcess WritePrivateProfileStringW FlushFileBuffers GetACP CompareFileTime CopyFileW lstrlenW GetFileSizeEx LoadLibraryA ExpandEnvironmentStringsA GetSystemDirectoryA ResumeThread OpenFileMappingW HeapCreate GetEnvironmentVariableW SystemTimeToTzSpecificLocalTime GetVersion TlsAlloc TlsFree GetStartupInfoW ReadProcessMemory SystemTimeToFileTime GetSystemWindowsDirectoryW RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject GetProcessAffinityMask DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SwitchToThread DeleteCriticalSection GetShortPathNameW FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetProcessHeap HeapSize HeapDestroy WideCharToMultiByte MultiByteToWideChar CompareStringW SetThreadAffinityMask LoadLibraryW GetProcAddress GetModuleFileNameW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetThreadTimes TerminateProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetLastError GetLastError RaiseException CloseHandle SignalObjectAndWait CreateTimerQueue InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter OpenThread ReleaseMutex HeapWalk HeapUnlock HeapLock SetFilePointerEx LocalFileTimeToFileTime CreateFileA GetModuleHandleA TryEnterCriticalSection QueryPerformanceCounter GetStringTypeW LCMapStringW FormatMessageW OutputDebugStringW IsDebuggerPresent GetFullPathNameW GetFileAttributesW GetTempFileNameW CreateFileW

user32

GetActiveWindow SendMessageTimeoutW WaitForInputIdle CopyRect EqualRect FindWindowExW GetWindowThreadProcessId SystemParametersInfoW MessageBoxW FindWindowW LoadStringW DestroyIcon RegisterWindowMessageW PrivateExtractIconsW GetSystemMetrics PeekMessageW DispatchMessageW TranslateMessage CharNextW GetIconInfo

gdi32

BitBlt GetObjectW CreateDIBSection SelectObject DeleteObject DeleteDC CreateCompatibleDC

advapi32

GetUserNameW RevertToSelf RegCloseKey RegCreateKeyW EnumServicesStatusW StartServiceW ChangeServiceConfigW ImpersonateLoggedOnUser GetTokenInformation DuplicateTokenEx CreateProcessAsUserW FreeSid CheckTokenMembership AllocateAndInitializeSid RegOpenCurrentUser RegQueryInfoKeyW QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService ControlService CloseServiceHandle RegOpenKeyW RegEnumValueW RegEnumKeyW BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW GetExplicitEntriesFromAclW SetEntriesInAclW LookupPrivilegeValueW LookupAccountNameW LookupAccountSidW GetAclInformation GetAce EqualSid DeleteAce AdjustTokenPrivileges OpenProcessToken RegEnumKeyExW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW

shell32

CommandLineToArgvW SHChangeNotify ord68 ExtractIconExW SHGetPathFromIDListW SHGetSettings SHGetSpecialFolderLocation ShellExecuteW SHGetFileInfoW SHGetFolderPathW ord232 SHGetSpecialFolderPathW SHGetMalloc ShellExecuteExW ord165 ExtractIconW

ole32

CoCreateInstance CoTaskMemFree CoTaskMemAlloc IIDFromString StringFromGUID2 CoUninitialize CoInitialize CoTaskMemRealloc

oleaut32

SysAllocString VarBstrCmp VariantInit SysFreeString VarUI4FromStr SysStringLen VariantCopy VariantClear

shlwapi

SHDeleteKeyW PathCombineW PathFileExistsW PathRemoveExtensionW PathIsRootW StrRChrW PathRelativePathToW StrStrW UrlGetPartW StrCmpNIW StrCmpW StrToIntW StrCpyNW StrDupW PathIsDirectoryEmptyW PathFindFileNameW PathFindExtensionW StrCmpIW StrStrIW StrChrW PathAddBackslashW PathAppendW SHSetValueW SHGetValueW SHDeleteValueW PathRemoveFileSpecW PathIsDirectoryW

ws2_32

WSCEnumProtocols WSCDeinstallProvider WSCGetProviderPath inet_ntoa inet_addr WSACleanup WSAStartup

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

psapi

GetMappedFileNameW

ntdll

RtlNtStatusToDosError LdrVerifyImageMatchesChecksum RtlDllShutdownInProgress

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateProcessesW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

netapi32

NetShareDel NetShareEnum NetApiBufferFree

generic

count=12, id=259, version=26504,

count=2, id=260, version=26504,

count=1, id=261, version=26504,

count=13, id=242, version=40116,

count=4, id=257, version=27032,

count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=27, id=199, version=41118,

count=11, id=260, productName=VS2019 v16.2.3 build 27905, version=27905,

count=3, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=10, id=260, productName=VS2017 v15.7.5 build 26433, version=26433,

count=142, id=261, productName=VS2019 v16.2.3 build 27905, version=27905,

count=3, id=260, version=27412,

count=1, id=262, version=27412,

count=41, id=257, version=27412,

count=666, id=1, productName=Unmarked objects,

count=8, id=261, version=29118,

count=1, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=12, id=260, productName=VS2019 v16.8.5 build 29337, version=29337,

count=150, id=261, productName=VS2019 v16.8.5 build 29337, version=29337,

count=1, id=256, productName=VS2019 v16.8.5 build 29337, version=29337,

count=1, id=255, productName=VS2019 v16.8.5 build 29337, version=29337,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.8.5 build 29337, version=29337,