91e860b7733b2a9de408ebc3a1b675ee42bbb9f616bbfe7d4e89a201cbec0b16

Sharing

Copy URL Twitter E-mail

General

Target

91e860b7733b2a9de408ebc3a1b675ee42bbb9f616bbfe7d4e89a201cbec0b16
Size

601KB
MD5

72d3f4ca0df6d6b28831626ef176f740
SHA1

6b9e38b92ec8ab83aabd308e6d5dca89dfa73e60
SHA256

91e860b7733b2a9de408ebc3a1b675ee42bbb9f616bbfe7d4e89a201cbec0b16
SHA512

0075823ed5b12b20970bca9a9c5c30049c11bc1d2e10bec2e0de61c03d0aded25e1b90d469320d3328a2733dd0cd41c20157df2314618d98970ecf2f2c3b2968
SSDEEP

12288:ttpyxhomlpOKPjlavqoBWOmNsaBoPvnTE:pyxhoUKv5Wtsa0vA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
91e860b7733b2a9de408ebc3a1b675ee42bbb9f616bbfe7d4e89a201cbec0b16

Files

91e860b7733b2a9de408ebc3a1b675ee42bbb9f616bbfe7d4e89a201cbec0b16
.exe windows:5 windows x86 arch:x86

f506a72f90a2dda1f7566cc7dfe652d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\625640\out\Release\Uninstaller.pdb

Imports

kernel32

RemoveDirectoryW
CreateEventW
SetEvent
WaitForMultipleObjects
GetTempFileNameW
OpenProcess
TerminateProcess
GlobalAlloc
GlobalFree
GetCurrentThread
GetThreadContext
VirtualQuery
SetThreadPriority
VirtualAlloc
OpenThread
GetSystemInfo
GetThreadPriority
VirtualProtect
SuspendThread
ResumeThread
WideCharToMultiByte
SetFilePointer
GetTickCount
ReadFile
GetFileSizeEx
lstrcmpiW
GetLastError
CreateMutexW
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
InterlockedExchange
FindClose
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
WriteFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
SetHandleCount
GetModuleFileNameA
HeapCreate
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
GetStartupInfoW
GetCurrentProcessId
GetFileType
WriteConsoleW
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReleaseMutex
HeapWalk
HeapLock
HeapUnlock
OutputDebugStringW
TlsGetValue
SetFilePointerEx
LocalFileTimeToFileTime
CreateFileA
FindNextFileW
FindFirstFileW
lstrcpyW
CreateThread
GetSystemDirectoryW
InterlockedCompareExchange
Sleep
GetSystemWindowsDirectoryW
FreeResource
MulDiv
CopyFileW
GetLongPathNameW
GetEnvironmentVariableW
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
GetVersion
DeleteCriticalSection
InitializeCriticalSection
RaiseException
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
DeviceIoControl
lstrlenW
FreeLibrary
LoadLibraryW
CreateFileW
LocalAlloc
DeleteFileW
MoveFileExW
SetFileAttributesW
GetTempPathW
GetVersionExW
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CloseHandle
TlsFree
TlsAlloc
TlsSetValue
GetSystemTimeAsFileTime
GetModuleHandleA
ExitProcess
SystemTimeToFileTime
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetStdHandle
LoadLibraryExW
CreateProcessW
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
FreeEnvironmentStringsW

user32

ShowWindow
SetForegroundWindow
BringWindowToTop
CharNextW
SetWindowPos
FindWindowW
CreateDialogParamW
PostMessageW
IsWindow
SetWindowLongW
IsIconic
GetSystemMenu
EnableMenuItem
LoadImageW
ReleaseCapture
GetDlgCtrlID
SystemParametersInfoW
SetCapture
AdjustWindowRectEx
GetMenu
GetParent
SetWindowTextW
PostQuitMessage
GetDlgItem
IsDialogMessageW
SetCursor
SetTimer
PtInRect
ClientToScreen
GetCapture
UpdateWindow
DrawFocusRect
GetSystemMetrics
InflateRect
DrawEdge
GetSysColor
IsWindowEnabled
KillTimer
OffsetRect
FillRect
InvalidateRect
EndPaint
DrawTextW
GetWindowTextW
GetClientRect
BeginPaint
CallWindowProcW
GetWindowLongW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
SendMessageW
DestroyWindow
DefWindowProcW
MessageBoxW
ReleaseDC
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetDC
GetWindowRect
UnregisterClassA

gdi32

GetCurrentObject
GetStockObject
CreateSolidBrush
CreateDIBSection
BitBlt
StretchBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
DeleteDC
SetTextColor
SelectObject
SetBkMode
GetDeviceCaps
CreateFontW

advapi32

RegQueryInfoKeyW
RegDeleteValueW
RegQueryValueExA
RegDeleteKeyW
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW

shell32

SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemAlloc
CreateStreamOnHGlobal

oleaut32

VariantClear
VarUI4FromStr
VariantInit
SysFreeString
SysAllocString

shlwapi

SHDeleteKeyW
SHSetValueW
StrStrIW
SHGetValueW
PathFileExistsW
PathCombineW
PathAppendW
PathRemoveFileSpecW
StrStrIA

comctl32

ImageList_SetImageCount
ImageList_Create
InitCommonControlsEx
ImageList_GetIconSize
ImageList_Draw
ImageList_Destroy
_TrackMouseEvent
ImageList_Add

gdiplus

GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdipAlloc
GdipFree
GdipCreateBitmapFromStream
GdipDisposeImage
GdiplusStartup

psapi

GetModuleFileNameExW
EnumProcesses
EnumProcessModules

Sections

.text
Size: 237KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 165KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f506a72f90a2dda1f7566cc7dfe652d2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

psapi

Sections

.text Size: 237KB - Virtual size: 236KB

.rdata Size: 53KB - Virtual size: 53KB

.data Size: 165KB - Virtual size: 184KB

.rsrc Size: 125KB - Virtual size: 124KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 237KB - Virtual size: 236KB

.rdata
Size: 53KB - Virtual size: 53KB

.data
Size: 165KB - Virtual size: 184KB

.rsrc
Size: 125KB - Virtual size: 124KB

.reloc
Size: 20KB - Virtual size: 19KB