C:\vmagent_new\bin\joblist\719743\out\Release\360Base.pdb
Static task
static1
Behavioral task
behavioral1
Sample
25e5a54741a0aeefccc669802c30315ba42cc47a99665b87ab0373655939f052.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
25e5a54741a0aeefccc669802c30315ba42cc47a99665b87ab0373655939f052.dll
Resource
win10v2004-20240709-en
General
-
Target
25e5a54741a0aeefccc669802c30315ba42cc47a99665b87ab0373655939f052.com
-
Size
1.5MB
-
MD5
3706ca89cb8c8cbf69594ecc1c9afdf2
-
SHA1
efc17c6ace80917ee293f1244772bacf627acfb0
-
SHA256
25e5a54741a0aeefccc669802c30315ba42cc47a99665b87ab0373655939f052
-
SHA512
d0abb97bfd705895eb6a2a3e2cdb44807e5d18a9ff092a0ed68ee36915e10fef29d19a0f8d1eda3aaa97c9a53a02df06998842c7b755556c708ef39df45fd8bc
-
SSDEEP
24576:Kgmj42MEVQPGEorkSY/X/7DkbSrh/qtoT/cgsxSPlKzNYXmdzweeq5//W68Sn:+jnMEVQuFkSkvkurNqtoTkgBczNYXmdT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25e5a54741a0aeefccc669802c30315ba42cc47a99665b87ab0373655939f052.com
Files
-
25e5a54741a0aeefccc669802c30315ba42cc47a99665b87ab0373655939f052.com.dll windows:5 windows x86 arch:x86
42dd31ca86c177758d73ef96895182f6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
DeleteCriticalSection
GetModuleHandleW
lstrcmpiW
SizeofResource
LoadResource
FindResourceW
InterlockedDecrement
InterlockedIncrement
GetCurrentProcessId
ReadFile
InterlockedCompareExchange
SetFilePointer
FreeLibraryAndExitThread
HeapSize
GetPrivateProfileStringW
LockResource
FindResourceExW
HeapDestroy
GetProcessHeap
GetCurrentProcess
GetSystemWindowsDirectoryW
GetVersionExW
FreeResource
SetFilePointerEx
GetFileSizeEx
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
lstrcmpA
LocalFree
GetFileSize
WriteFile
GetLocalTime
GetCurrentThreadId
FlushFileBuffers
SystemTimeToFileTime
FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileAttributesExW
MoveFileExW
QueryPerformanceCounter
LockFileEx
UnlockFileEx
MapViewOfFile
GetModuleHandleExW
CreateThread
GetFileType
ReleaseMutex
GetACP
lstrlenA
LocalFileTimeToFileTime
InterlockedExchange
MultiByteToWideChar
GetUserDefaultLCID
LoadLibraryW
GetProcAddress
GetModuleFileNameW
FreeLibrary
VirtualProtect
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetSystemInfo
TerminateProcess
Sleep
CreateMutexW
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
CreateFileW
FindNextFileA
FindFirstFileExA
SetStdHandle
GetConsoleCP
GetConsoleMode
EnumSystemLocalesW
IsValidLocale
GetModuleFileNameA
ExitProcess
InterlockedFlushSList
RtlUnwind
OpenThread
HeapWalk
HeapUnlock
HeapLock
CreateFileA
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrcatA
GlobalMemoryStatus
LoadLibraryA
GetSystemDirectoryA
GetModuleHandleA
GetStdHandle
GetCPInfo
GetStringTypeW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
OutputDebugStringW
IsDebuggerPresent
InitializeCriticalSection
GetTickCount
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
HeapFree
HeapReAlloc
HeapAlloc
SetErrorMode
SetLastError
GetLastError
RaiseException
CloseHandle
GetFileAttributesW
lstrcmpiA
user32
MessageBoxA
CharNextW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ReportEventA
DeregisterEventSource
RegCloseKey
RegCreateKeyExA
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
GetTokenInformation
OpenProcessToken
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegisterEventSourceA
ole32
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoCreateGuid
CreateStreamOnHGlobal
oleaut32
SysAllocString
VarUI4FromStr
shlwapi
SHGetValueA
PathFindFileNameW
StrRChrW
PathCombineW
PathAppendW
StrTrimA
PathFileExistsW
SHGetValueW
PathRemoveFileSpecW
StrCmpIW
StrCmpNIW
StrStrIW
StrStrIA
PathAddBackslashW
SHSetValueA
SHSetValueW
version
VerQueryValueW
GetFileVersionInfoSizeW
crypt32
CryptMsgControl
CertFindCertificateInStore
CryptQueryObject
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetNameStringW
CryptDecodeObjectEx
CryptDecodeObject
CertGetCertificateChain
CertAddStoreToCollection
CertOpenStore
CertCloseStore
CertOpenSystemStoreW
CryptMsgGetParam
CryptMsgClose
CryptMsgUpdate
CertFreeCertificateChain
CryptMsgOpenToDecode
iphlpapi
GetAdaptersInfo
Exports
Exports
BaseCheckProductType
BaseGetProductPath
BaseGetProductRegRoot
BaseIsOnlySha1Sign
Turnerity
InitLibs
Sections
.text Size: 755KB - Virtual size: 754KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 219KB - Virtual size: 218KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 474KB - Virtual size: 474KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ