42853671b2f32b3e080fcaf656df74114cac418564f39f8e9a73b9056a53ba4e

Sharing

Copy URL Twitter E-mail

General

Target
42853671b2f32b3e080fcaf656df74114cac418564f39f8e9a73b9056a53ba4e
Size 3.5MB
Sample240608-qrm6gach63
SHA256 42853671b2f32b3e080fcaf656df74114cac418564f39f8e9a73b9056a53ba4e
MD5 863ce6d190e060eaca78c950a45dd093
SHA1 dec54e4a386ee29fd8a29ea9ed8af8b1dd8972c6
SHA512 8e4fd8e88be167f0fe57fa6cdfc422520264d8c892b3ff38024b2df5bfeb4292b06eaa4fd44393fabe9c83d03b9884c6b43427944e1ab8f524a868c1a8862cc2
SSDEEP 49152:u5Xob/BJCgLzDdwd9bk/RiF6xQf2V4dJgqjEBa/rsVQ9:4A/BSY/RiAxpV0dqa/6C
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42853671b2f32b3e080fcaf656df74114cac418564f39f8e9a73b9056a53ba4e

File Explorer

42853671b2f32b3e080fcaf656df74114cac418564f39f8e9a73b9056a53ba4e

.dll 3.5MB

42853671b2f32b3e080fcaf656df74114cac418564f39f8e9a73b9056a53ba4e

IMPHASH 15ea91365ad63ea1d9b6bd525baaedd0
SHA256 42853671b2f32b3e080fcaf656df74114cac418564f39f8e9a73b9056a53ba4e
MD5 863ce6d190e060eaca78c950a45dd093
SHA1 dec54e4a386ee29fd8a29ea9ed8af8b1dd8972c6
SHA512 8e4fd8e88be167f0fe57fa6cdfc422520264d8c892b3ff38024b2df5bfeb4292b06eaa4fd44393fabe9c83d03b9884c6b43427944e1ab8f524a868c1a8862cc2
SSDEEP 49152:u5Xob/BJCgLzDdwd9bk/RiF6xQf2V4dJgqjEBa/rsVQ9:4A/BSY/RiAxpV0dqa/6C
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1229208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\vmagent_new\bin\joblist\535148\out\Release\deepscan.pdb

kernel32

GetCurrentProcess GetCurrentProcessId GetExitCodeProcess ReadFile GetModuleHandleW CreateProcessW GetVersionExW InterlockedIncrement InterlockedDecrement OpenProcess ReadProcessMemory FindClose ExpandEnvironmentStringsW GetWindowsDirectoryW FindFirstFileW FindNextFileW SearchPathW GetVolumeInformationW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateThread ReleaseSemaphore GetFileSize GetPrivateProfileIntW WritePrivateProfileStringW VirtualQueryEx lstrlenW Module32FirstW Module32NextW GetPrivateProfileStringW GetTempPathW GetTempFileNameW QueryDosDeviceW SetFileAttributesW CopyFileW GetSystemDefaultUILanguage CreateDirectoryW InterlockedExchange LocalFree GetShortPathNameW GetLongPathNameW GetCurrentThreadId GetFileSizeEx GetStartupInfoW GetFileAttributesExW CreatePipe PeekNamedPipe CreateProcessA ExpandEnvironmentStringsA MoveFileExW ResumeThread FlushInstructionCache VirtualQuery MapViewOfFile UnmapViewOfFile CreateFileMappingW GetEnvironmentVariableW GetACP lstrcmpiW GetExitCodeThread FormatMessageW GetEnvironmentStringsW OutputDebugStringW IsDBCSLeadByte GetStdHandle SetFileTime MoveFileW SetEndOfFile SetFilePointerEx GlobalMemoryStatusEx GetDiskFreeSpaceExW SetEnvironmentVariableW WritePrivateProfileSectionW GetDriveTypeW GetLogicalDrives FreeLibraryAndExitThread ReleaseMutex OpenMutexW OpenThread Thread32First Thread32Next WriteConsoleW FlushFileBuffers SetStdHandle GetCommandLineW GetSystemWindowsDirectoryW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetConsoleCP ReadConsoleW GetConsoleMode GetFileType GetModuleFileNameA ExitProcess GetModuleHandleExW InterlockedFlushSList RtlUnwind QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent LocalAlloc DeleteFileW RemoveDirectoryW FindResourceExW FindResourceW SetFilePointer WriteFile SizeofResource LoadResource DeleteCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapDestroy LockResource InterlockedCompareExchange WideCharToMultiByte MultiByteToWideChar LoadLibraryW GetProcAddress GetModuleFileNameW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo TerminateProcess CreateSemaphoreW Sleep CreateFileW CreateEventW CreateMutexW WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode GetCPInfo GetStringTypeW LCMapStringW HeapUnlock TlsFree TlsGetValue TlsAlloc HeapWalk HeapLock TlsSetValue SystemTimeToFileTime CreateFileA LocalFileTimeToFileTime FreeResource GetCommandLineA GetPrivateProfileSectionW SetLastError GetLastError RaiseException CloseHandle AreFileApisANSI GetFullPathNameW GetFileAttributesW FreeEnvironmentStringsW

user32

MessageBoxA SendMessageTimeoutW FindWindowW LoadStringW GetActiveWindow CharUpperW CharNextW wsprintfW GetWindowTextW GetWindowThreadProcessId FindWindowExW SetWindowLongW GetMessageW TranslateMessage DispatchMessageW DefWindowProcW PostQuitMessage CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW GetWindowLongW LoadCursorW DestroyWindow IsWindow

winspool.drv

GetPrinterDriverDirectoryW GetPrintProcessorDirectoryW

advapi32

RegQueryValueA RevertToSelf RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteKeyA RegDeleteKeyW RegDeleteValueA RegDeleteValueW RegOpenKeyExA RegOpenKeyExW LookupAccountSidW SetSecurityInfo SetNamedSecurityInfoW GetSecurityInfo GetNamedSecurityInfoW SetEntriesInAclW SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid EnumServicesStatusW ImpersonateLoggedOnUser RegQueryInfoKeyW RegSetValueA RegQueryValueW RegFlushKey RegQueryInfoKeyA RegSetValueW ConvertSidToStringSidW GetTokenInformation CryptReleaseContext CryptAcquireContextW QueryServiceStatusEx CreateServiceW GetUserNameW RegOpenKeyA RegEnumValueA RegEnumKeyExA RegEnumKeyW RegEnumKeyA RegCreateKeyW RegCreateKeyA DeleteService RegEnumValueW RegEnumKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegOpenKeyW StartServiceW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW EnumServicesStatusExW ControlService CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA

shell32

SHGetMalloc SHFileOperationW SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetFolderPathW ord155 SHGetSpecialFolderLocation CommandLineToArgvW SHGetPathFromIDListW

ole32

CoInitializeEx StgCreateStorageEx StgCreateDocfileOnILockBytes CLSIDFromString CoCreateInstance CoUninitialize CoInitialize CoSetProxyBlanket CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoInitializeSecurity StringFromGUID2

oleaut32

VariantCopy SysAllocStringLen VariantClear SysStringByteLen VarBstrCat VarCmp VarUI4FromStr VariantInit SysStringLen SysFreeString SysAllocString VariantChangeType SysAllocStringByteLen

shlwapi

StrCmpIW SHCreateStreamOnFileW StrStrW StrToIntW SHGetValueW UrlUnescapeW PathIsRelativeW StrStrIW StrDupW StrCmpNW PathMatchSpecW PathFileExistsW StrCmpW PathFindFileNameW PathFindExtensionW StrRChrW StrCmpNIW StrChrW PathAppendW PathRemoveFileSpecW PathRenameExtensionW PathCombineW PathIsDirectoryW StrTrimA

ws2_32

inet_ntoa gethostname WSAStartup WSACleanup inet_addr

version

VerQueryValueW

psapi

GetProcessImageFileNameW GetModuleFileNameExW EnumProcessModules EnumDeviceDrivers GetDeviceDriverBaseNameW GetDeviceDriverFileNameW GetProcessMemoryInfo GetModuleInformation

setupapi

SetupFindNextMatchLineW SetupGetIntField SetupFindNextLine SetupGetFieldCount SetupOpenFileQueue SetupCloseFileQueue SetupGetStringFieldW SetupFindFirstLineW SetupCloseInfFile SetupOpenInfFileW SetupIterateCabinetW

crypt32

CertGetCertificateContextProperty CertFreeCertificateContext CertFindCertificateInStore CertGetNameStringW CertOpenStore CryptMsgGetParam CryptMsgUpdate CryptMsgClose CertCloseStore CryptMsgOpenToDecode

mpr

WNetGetConnectionW

iphlpapi

GetIpAddrTable

wldap32

ord73 ord13 ord127 ord167 ord142 ord77 ord41 ord79 ord208 ord26 ord145 ord36 ord27 ord147 ord301

netapi32

DsRoleGetPrimaryDomainInformation NetUserGetInfo NetApiBufferFree DsGetDcNameW NetShareGetInfo DsRoleFreeMemory

ntdll

RtlInitUnicodeString ZwClose ZwReadFile ZwWriteFile ZwOpenFile

generic

count=17, id=241, version=40116,

count=176, id=243, version=40116,

count=29, id=242, version=40116,

count=2, id=185, version=30716,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=66, id=261, version=26706,

count=35, id=260, version=26706,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=497, id=1, productName=Unmarked objects,

count=1, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=14, id=265, version=27045,

count=5, id=260, version=27045,

count=225, id=261, version=27045,

count=1, id=256, version=27045,

count=1, id=255, version=27045,

count=3, id=151,

count=1, id=258, version=27045,