a88d50765a773424d2948b8d3ae76cbd55e04185e61858ab9bdae33d02ecab46

Sharing

Copy URL

Twitter E-mail

General

Target

a88d50765a773424d2948b8d3ae76cbd55e04185e61858ab9bdae33d02ecab46
Size

681KB
MD5

48b01d6b8aa53f9e16aa6e2af278dd93
SHA1

a192c2383449a86d4541554886b44c258c914abc
SHA256

a88d50765a773424d2948b8d3ae76cbd55e04185e61858ab9bdae33d02ecab46
SHA512

f439d15762cfc99fba8023dacbaeab21b9d31084845717b371ef6c97004d8f14da8514f27b2d72c88e47f9338947ec89553f529d08506f73f80b5d260577aaa1
SSDEEP

12288:0tpyxhomlpOKPjzavqoBWOmNsaBoPvnTEX0F:yyxhoUIv5Wtsa0vAkF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a88d50765a773424d2948b8d3ae76cbd55e04185e61858ab9bdae33d02ecab46

Files

a88d50765a773424d2948b8d3ae76cbd55e04185e61858ab9bdae33d02ecab46
.exe windows:5 windows x86 arch:x86

f506a72f90a2dda1f7566cc7dfe652d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\625640\out\Release\Uninstaller.pdb

Imports

kernel32

RemoveDirectoryW
CreateEventW
SetEvent
WaitForMultipleObjects
GetTempFileNameW
OpenProcess
TerminateProcess
GlobalAlloc
GlobalFree
GetCurrentThread
GetThreadContext
VirtualQuery
SetThreadPriority
VirtualAlloc
OpenThread
GetSystemInfo
GetThreadPriority
VirtualProtect
SuspendThread
ResumeThread
WideCharToMultiByte
SetFilePointer
GetTickCount
ReadFile
GetFileSizeEx
lstrcmpiW
GetLastError
CreateMutexW
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
InterlockedExchange
FindClose
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
WriteFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
SetHandleCount
GetModuleFileNameA
HeapCreate
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
GetStartupInfoW
GetCurrentProcessId
GetFileType
WriteConsoleW
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReleaseMutex
HeapWalk
HeapLock
HeapUnlock
OutputDebugStringW
TlsGetValue
SetFilePointerEx
LocalFileTimeToFileTime
CreateFileA
FindNextFileW
FindFirstFileW
lstrcpyW
CreateThread
GetSystemDirectoryW
InterlockedCompareExchange
Sleep
GetSystemWindowsDirectoryW
FreeResource
MulDiv
CopyFileW
GetLongPathNameW
GetEnvironmentVariableW
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
GetVersion
DeleteCriticalSection
InitializeCriticalSection
RaiseException
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
DeviceIoControl
lstrlenW
FreeLibrary
LoadLibraryW
CreateFileW
LocalAlloc
DeleteFileW
MoveFileExW
SetFileAttributesW
GetTempPathW
GetVersionExW
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CloseHandle
TlsFree
TlsAlloc
TlsSetValue
GetSystemTimeAsFileTime
GetModuleHandleA
ExitProcess
SystemTimeToFileTime
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetStdHandle
LoadLibraryExW
CreateProcessW
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
FreeEnvironmentStringsW

user32

ShowWindow
SetForegroundWindow
BringWindowToTop
CharNextW
SetWindowPos
FindWindowW
CreateDialogParamW
PostMessageW
IsWindow
SetWindowLongW
IsIconic
GetSystemMenu
EnableMenuItem
LoadImageW
ReleaseCapture
GetDlgCtrlID
SystemParametersInfoW
SetCapture
AdjustWindowRectEx
GetMenu
GetParent
SetWindowTextW
PostQuitMessage
GetDlgItem
IsDialogMessageW
SetCursor
SetTimer
PtInRect
ClientToScreen
GetCapture
UpdateWindow
DrawFocusRect
GetSystemMetrics
InflateRect
DrawEdge
GetSysColor
IsWindowEnabled
KillTimer
OffsetRect
FillRect
InvalidateRect
EndPaint
DrawTextW
GetWindowTextW
GetClientRect
BeginPaint
CallWindowProcW
GetWindowLongW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
SendMessageW
DestroyWindow
DefWindowProcW
MessageBoxW
ReleaseDC
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetDC
GetWindowRect
UnregisterClassA

gdi32

GetCurrentObject
GetStockObject
CreateSolidBrush
CreateDIBSection
BitBlt
StretchBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
DeleteDC
SetTextColor
SelectObject
SetBkMode
GetDeviceCaps
CreateFontW

advapi32

RegQueryInfoKeyW
RegDeleteValueW
RegQueryValueExA
RegDeleteKeyW
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW

shell32

SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemAlloc
CreateStreamOnHGlobal

oleaut32

VariantClear
VarUI4FromStr
VariantInit
SysFreeString
SysAllocString

shlwapi

SHDeleteKeyW
SHSetValueW
StrStrIW
SHGetValueW
PathFileExistsW
PathCombineW
PathAppendW
PathRemoveFileSpecW
StrStrIA

comctl32

ImageList_SetImageCount
ImageList_Create
InitCommonControlsEx
ImageList_GetIconSize
ImageList_Draw
ImageList_Destroy
_TrackMouseEvent
ImageList_Add

gdiplus

GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdipAlloc
GdipFree
GdipCreateBitmapFromStream
GdipDisposeImage
GdiplusStartup

psapi

GetModuleFileNameExW
EnumProcesses
EnumProcessModules

Sections

.text
Size: 237KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 165KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f506a72f90a2dda1f7566cc7dfe652d2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

psapi

Sections

.text Size: 237KB - Virtual size: 236KB

.rdata Size: 53KB - Virtual size: 53KB

.data Size: 165KB - Virtual size: 184KB

.rsrc Size: 125KB - Virtual size: 124KB

.reloc Size: 84KB - Virtual size: 84KB

.text
Size: 237KB - Virtual size: 236KB

.rdata
Size: 53KB - Virtual size: 53KB

.data
Size: 165KB - Virtual size: 184KB

.rsrc
Size: 125KB - Virtual size: 124KB

.reloc
Size: 84KB - Virtual size: 84KB