LisectAVT_2403002A_280[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
LisectAVT_2403002A_280.exe
Size 1.3MB
Sample240725-ak2saaygra
SHA256 2a3b2ff71f16b23e21aa9855139553509476d9f80f99d509fe0ba2c66fb9acda
MD5 6a4b5a1fc48d7a85fe0a1ee8290e42b7
SHA1 45faa50e3f66880615ddc8dba97e0cffea61a55e
SHA512 e429100ccca6bd84685c6b4990c75f01f8bc1b37666706bc345c865ad66b03f01cfa0ce6c73d9262f955dc02a3230ac5b1ca6da27983cc7530fdafe4a0f6e39c
SSDEEP 12288:2jwHlbKaWY6oL1T0uwJ34dW/QtQF5KXGOTBwfRzPZ15HVCjkNMOuEFcd+wtZqA8s:2yHC/QtQF5kGXZPY+1BFc2AZoyLtkwx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LisectAVT_2403002A_280.exe

File Explorer

LisectAVT_2403002A_280.exe

.exe 1.3MB

LisectAVT_2403002A_280.exe

IMPHASH a8311b6d98c1262cc1ec0eab47dbfe32
SHA256 2a3b2ff71f16b23e21aa9855139553509476d9f80f99d509fe0ba2c66fb9acda
MD5 6a4b5a1fc48d7a85fe0a1ee8290e42b7
SHA1 45faa50e3f66880615ddc8dba97e0cffea61a55e
SHA512 e429100ccca6bd84685c6b4990c75f01f8bc1b37666706bc345c865ad66b03f01cfa0ce6c73d9262f955dc02a3230ac5b1ca6da27983cc7530fdafe4a0f6e39c
SSDEEP 12288:2jwHlbKaWY6oL1T0uwJ34dW/QtQF5KXGOTBwfRzPZ15HVCjkNMOuEFcd+wtZqA8s:2yHC/QtQF5kGXZPY+1BFc2AZoyLtkwx
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

584526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\498883\out\Release\QHFileSmasher.pdb

kernel32

ExitThread CreateThread ExitProcess GetStartupInfoW RtlUnwind HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetStdHandle GetModuleFileNameA GetTimeFormatA GetDateFormatA HeapCreate HeapDestroy VirtualFree VirtualAlloc GetConsoleCP GetConsoleMode LCMapStringA SetHandleCount GetFileType GetStartupInfoA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetEnvironmentStringsW GetStringTypeA GetStringTypeW IsDebuggerPresent GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetProcessHeap CreateFileA SetEnvironmentVariableA SetUnhandledExceptionFilter HeapAlloc TerminateProcess GetFileSizeEx LocalFileTimeToFileTime GetLocaleInfoW CompareStringA GetShortPathNameW SetEndOfFile FlushFileBuffers GlobalFlags GlobalAddAtomW GlobalFindAtomW lstrcmpiA GetTempFileNameW OpenMutexW ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock OutputDebugStringW SetFilePointerEx IsProcessorFeaturePresent GlobalDeleteAtom LoadLibraryA GetVersionExA UnhandledExceptionFilter HeapFree lstrlenA lstrcmpA CompareStringW TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue GetFullPathNameW GetLogicalDriveStringsW DeviceIoControl InterlockedExchange MoveFileW GetFileAttributesW RemoveDirectoryW FindClose FindNextFileW FindFirstFileW QueryPerformanceCounter SetFileAttributesW lstrcmpW GlobalAlloc GlobalLock GlobalUnlock SetErrorMode SetEnvironmentVariableW GetCommandLineW ExpandEnvironmentStringsW lstrcmpiW lstrlenW SetFilePointer InterlockedIncrement ProcessIdToSessionId FreeResource GetSystemWindowsDirectoryW LocalAlloc SystemTimeToFileTime GetModuleHandleA GetTimeZoneInformation LocalFree GlobalFree CreateMutexW FreeConsole GetCurrentProcessId LoadLibraryExW GetTempPathW GetDriveTypeW GetWindowsDirectoryW GetUserDefaultUILanguage SetCurrentDirectoryW GetPrivateProfileStringW GetPrivateProfileSectionW GetPrivateProfileSectionNamesW Sleep InterlockedCompareExchange GetVersionExW GetModuleFileNameW MultiByteToWideChar WriteFile ReadFile GetFileSize CreateFileW CopyFileW FreeLibrary LoadLibraryW GetModuleHandleW GetProcAddress InterlockedDecrement MulDiv GetCurrentProcess SetEvent CreateEventW ResetEvent GetTickCount WaitForSingleObject WideCharToMultiByte GetSystemTimeAsFileTime DeleteFileW GetVersion GetSystemDirectoryW SetLastError RaiseException DeleteCriticalSection InitializeCriticalSection CreateProcessW GetLastError OpenProcess FindResourceExW FindResourceW LoadResource LockResource SizeofResource CloseHandle LeaveCriticalSection EnterCriticalSection GetCurrentThreadId FlushInstructionCache GetUserDefaultLCID

user32

GetWindowTextW GetWindowTextLengthW RedrawWindow DrawTextW DispatchMessageW TranslateMessage GetMessageW SetWindowTextW GetWindow MonitorFromWindow MapWindowPoints IsRectEmpty IsDialogMessageW GetClientRect DrawIconEx DestroyIcon GetActiveWindow MessageBoxW InvalidateRect MonitorFromRect PostQuitMessage UnhookWindowsHookEx GetLastActivePopup GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState ValidateRect CallNextHookEx SetWindowsHookExW GetSysColorBrush CheckMenuItem EnableMenuItem ModifyMenuW SetCursor GetDlgCtrlID GetKeyState GetWindowDC BeginPaint LoadBitmapW SetWindowLongW GetWindowLongW DefWindowProcW CallWindowProcW GetWindowThreadProcessId FindWindowW SendMessageTimeoutW IsWindow KillTimer GetMenuCheckMarkDimensions DestroyWindow GetWindowPlacement ShowWindow SetTimer IsWindowVisible RegisterClassExW GetClassInfoExW SetMenu GetMessageTime GetTopWindow RemovePropW GetPropW SetPropW GetCapture WinHelpW DestroyMenu TabbedTextOutW DrawTextExW GrayStringW EndPaint SetCapture ReleaseCapture GetClassLongW SetClassLongW BringWindowToTop SwitchToThisWindow GetSystemMetrics CharNextW PeekMessageW DestroyAcceleratorTable InvalidateRgn FillRect CreateAcceleratorTableW GetSysColor GetClassNameW GetDlgItem IsChild LoadImageW LoadIconW GetDesktopWindow LoadCursorW CreateWindowExW EnableWindow GetParent SendMessageW SetWindowPos LoadStringW UnregisterClassA SetFocus IsWindowEnabled SetRectEmpty RegisterWindowMessageW GetDC ReleaseDC GetFocus CopyRect OffsetRect ClientToScreen GetMessagePos PtInRect ScreenToClient MoveWindow GetWindowRect GetMonitorInfoW AllowSetForegroundWindow GetForegroundWindow AttachThreadInput SetForegroundWindow SetActiveWindow SetMenuItemBitmaps IsIconic SystemParametersInfoA GetMenu AdjustWindowRectEx RegisterClassW PostMessageW GetKeyboardState keybd_event GetClassInfoW

gdi32

ScaleWindowExtEx PtVisible SetWindowExtEx SetMapMode RestoreDC SaveDC ExtTextOutW GetClipBox CreateBitmap ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx Escape TextOutW RectVisible GetStockObject BitBlt SetViewportOrgEx GetPixel CreateCompatibleBitmap CreateFontW SetTextColor SetBkColor CreateSolidBrush GetTextExtentPoint32W GetTextMetricsW GetObjectA GetObjectW SelectObject CreateCompatibleDC DeleteDC DeleteObject GetDeviceCaps

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegOpenKeyExA ConvertSidToStringSidW RegQueryValueExA RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW GetSidSubAuthority GetTokenInformation OpenProcessToken RegCreateKeyExW RegSetValueExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExA

shell32

SHOpenFolderAndSelectItems SHGetMalloc SHGetSpecialFolderLocation ord155 ord190 DragAcceptFiles DragFinish DragQueryFileW SHGetFileInfoW ShellExecuteExW ShellExecuteW SHGetPathFromIDListW ord680 SHGetSpecialFolderPathW SHGetFolderPathW ord165

ole32

OleLockRunning StringFromGUID2 OleUninitialize OleInitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize CoUninitialize CoGetClassObject CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal

oleaut32

VariantChangeType LoadTypeLi LoadRegTypeLi SysStringLen OleCreateFontIndirect VarUI4FromStr SysAllocStringLen VarBstrCmp SafeArrayUnlock SafeArrayLock SafeArrayDestroy SafeArrayCreate SafeArrayGetUBound SafeArrayGetLBound VariantCopy SafeArrayCopy SafeArrayGetVartype DispCallFunc VariantInit VariantClear SysAllocString SysFreeString

shlwapi

StrCmpIW PathCompactPathW PathStripPathW ord437 PathFindFileNameW PathIsDirectoryW PathAddBackslashW StrStrIW PathRemoveFileSpecW PathAppendW PathCombineW SHSetValueA SHGetValueA PathFileExistsW ColorHLSToRGB ColorRGBToHLS SHGetValueW wnsprintfW

comctl32

InitCommonControlsEx

gdiplus

GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipDrawImageRectRectI GdipDrawLine GdipAddPathEllipseI GdipGetPathGradientPointCount GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipCreateFromHWND GdipGetFontHeight GdipCreatePen2 GdipDrawRectangleI GdipCreateLineBrushFromRect GdipAddPathRectangleI GdipPrivateAddMemoryFont GdipSetPenWidth GdipDrawEllipseI GdipSetPenDashOffset GdipAddPathLineI GdipSetPixelOffsetMode GdipDrawImageRectI GdipGetImageGraphicsContext GdipGetImagePixelFormat GdipDrawImagePointRectI GdipResetWorldTransform GdipCreateBitmapFromScan0 GdipDrawPath GdipFillPath GdipSetSmoothingMode GdipGetSmoothingMode GdipResetClip GdipCreatePath GdipFillRectangleI GdipRotateWorldTransform GdipGetPixelOffsetMode GdipTranslateWorldTransform GdipSetClipRectI GdipSetTextRenderingHint GdipCreateFont GdipGetFontCollectionFamilyList GdipCreateLineBrushFromRectI GdipClosePathFigure GdipAddPathArcI GdipResetPath GdipDrawString GdipMeasureString GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawRectangle GdipDrawLineI GdipSetPenDashStyle GdipDeletePen GdipCreatePen1 GdipBitmapSetPixel GdipBitmapGetPixel GdipGetImageHeight GdipGetImageWidth GdipCreateBitmapFromFile GdipCloneImage GdipDisposeImage GdipFillRectangle GdipCloneBrush GdipAlloc GdipFree GdipDeleteBrush GdipCreateSolidFill GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromStream GdipSetPathGradientGammaCorrection GdipSetPathGradientCenterPoint GdipAddPathLine2 GdipGetPathWorldBoundsI GdipAddPathPie GdipAddPathLine GdipAddPathArc GdipSaveImageToFile GdipGetImageEncoders GdipGetImageEncodersSize GdipSetInterpolationMode GdipCloneFontFamily GdipDeleteFontFamily GdipDeletePath GdipSetLinePresetBlend

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetCloseHandle HttpQueryInfoW InternetSetOptionW InternetReadFile InternetOpenUrlW DeleteUrlCacheEntryW InternetOpenW

psapi

GetModuleFileNameExW

imm32

ImmDisableIME

rpcrt4

NdrAsyncClientCall RpcAsyncInitializeHandle RpcStringBindingComposeW RpcBindingFromStringBindingW RpcAsyncCompleteCall RpcStringFreeW RpcBindingFree

oleacc

LresultFromObject CreateStdAccessibleObject

wtsapi32

WTSQuerySessionInformationW

userenv

GetUserProfileDirectoryW