202408168253f93383302d46e0fcdd26f5f7617ffloxifmagniber

Sharing

Copy URL Twitter E-mail

General

Target
202408168253f93383302d46e0fcdd26f5f7617ffloxifmagniber
Size 1.8MB
Sample240816-sdlftsvcrr
SHA256 170ff17f7874c763fd354377bfdf369b551122324fb361a80a8c4f0f4b6cadfd
MD5 8253f93383302d46e0fcdd26f5f7617f
SHA1 d7ccb4b93cfc2b57d66915a7c2525dfde7c885a0
SHA512 5811b68b79cf3ea1e0f470da1c682b769319a38154b79bcab3cd7e864b56092f10897e6958b8342b57ad3ef6716938536ba14536d3362ebcaf226eb4a8d8c4e3
SSDEEP 24576:rqyoppMC3ezCb30zKiKYl+jX+Bk5N9ndZlW0Uc04KzchfuvG51rI2l3VroatPg3w:zQbkzSYl+aFUrhf3LIg3VEarMlyT
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

202408168253f93383302d46e0fcdd26f5f7617ffloxifmagniber

.exe 1.8MB

202408168253f93383302d46e0fcdd26f5f7617ffloxifmagniber

IMPHASH 9e06a884a787798c5a0284c5a9621007
SHA256 170ff17f7874c763fd354377bfdf369b551122324fb361a80a8c4f0f4b6cadfd
MD5 8253f93383302d46e0fcdd26f5f7617f
SHA1 d7ccb4b93cfc2b57d66915a7c2525dfde7c885a0
SHA512 5811b68b79cf3ea1e0f470da1c682b769319a38154b79bcab3cd7e864b56092f10897e6958b8342b57ad3ef6716938536ba14536d3362ebcaf226eb4a8d8c4e3
SSDEEP 24576:rqyoppMC3ezCb30zKiKYl+jX+Bk5N9ndZlW0Uc04KzchfuvG51rI2l3VroatPg3w:zQbkzSYl+aFUrhf3LIg3VEarMlyT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

e4:6d:49:b8:36:8e:17:f9:d6:56:94:34:d2:7b:c1:16:75:1d:18:b8:d2:6a:53:cd:5f:ea:c7:b5:75:95:9c:67

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 30, 2023

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2022 - Jan 6, 2024

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

1211576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\772492\out\Release\360TsLiveUpd.pdb

ws2_32

gethostbyname inet_ntoa

kernel32

CreateToolhelp32Snapshot LocalFree LocalAlloc GetExitCodeThread GetSystemInfo GetModuleHandleA GetModuleHandleExW WideCharToMultiByte ResetEvent SetLastError GetCurrentThreadId InterlockedCompareExchange QueryDosDeviceW GetLogicalDriveStringsW ExpandEnvironmentStringsW GetExitCodeProcess TerminateProcess OpenProcess InterlockedDecrement GetShortPathNameW GetVersion GetPrivateProfileIntW WritePrivateProfileStringW HeapFree HeapAlloc GetProcessHeap GetTickCount lstrcmpiW GetComputerNameW GetBinaryTypeW WaitForMultipleObjects CreateEventW GetModuleFileNameW SetFileTime SystemTimeToFileTime GetSystemTime GetPrivateProfileStringW GetWindowsDirectoryW CreateProcessW GetFileAttributesExW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetOverlappedResult CreateThread ExpandEnvironmentStringsA FileTimeToSystemTime CompareFileTime GetSystemTimeAsFileTime CreateRemoteThread CopyFileW lstrcmpiA lstrlenA Module32NextW Module32FirstW MoveFileW CreateDirectoryW GetLocalTime FreeConsole ReleaseSemaphore GetTempPathW GlobalFree GetTimeZoneInformation OpenMutexW GetCommandLineW Process32FirstW CreateSemaphoreW WritePrivateProfileSectionW GetProcessTimes CreateMutexA FlushInstructionCache InterlockedIncrement GetCurrentProcessId WTSGetActiveConsoleSessionId GetSystemWindowsDirectoryW GetDiskFreeSpaceExW UnmapViewOfFile lstrcmpA SetEnvironmentVariableA CompareStringW CompareStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount GetLocaleInfoW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW IsValidLocale EnumSystemLocalesA CreateMutexW GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount SetConsoleCtrlHandler GetStringTypeA ExitProcess FatalAppExitA HeapCreate GetModuleFileNameA GetStdHandle GetCurrentThread IsValidCodePage GetOEMCP GetACP GetStringTypeW LCMapStringW LCMapStringA GetStartupInfoW ExitThread RtlUnwind GetCPInfo IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree TlsAlloc HeapWalk HeapLock OpenThread HeapUnlock TlsSetValue OutputDebugStringW GetFullPathNameW Process32NextW GetFileSize CreateFileMappingW MapViewOfFileEx SetEndOfFile FlushFileBuffers SetFilePointer WriteFile ReadFile FreeResource InterlockedExchange LoadLibraryExW LoadLibraryW GetCurrentProcess GetSystemPowerStatus GlobalMemoryStatusEx HeapDestroy GlobalMemoryStatus Sleep ProcessIdToSessionId LoadLibraryA FreeLibrary GetSystemDirectoryW GetDriveTypeW CreateFileW DeviceIoControl DeleteFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW MoveFileExW TerminateThread ReadDirectoryChangesW MultiByteToWideChar FindFirstFileW FindNextFileW FindClose ResumeThread SetEvent WaitForSingleObject lstrlenW CloseHandle UnlockFile LockFile GetLastError FindResourceExW FindResourceW LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetVersionExW GetModuleHandleW GetProcAddress GetLocaleInfoA HeapReAlloc HeapSize ReleaseMutex FileTimeToLocalFileTime IsProcessorFeaturePresent VirtualFree VirtualAlloc CreateFileA LocalFileTimeToFileTime SetFilePointerEx GetFileSizeEx TlsGetValue

user32

MonitorFromWindow MonitorFromPoint SetFocus SetActiveWindow SetForegroundWindow AttachThreadInput GetForegroundWindow GetSystemMetrics ExitWindowsEx IsWindowVisible GetWindowThreadProcessId EnumWindows UnregisterClassA AllowSetForegroundWindow keybd_event GetKeyboardState MonitorFromRect GetWindowRect SetWindowPos GetWindowLongW UpdateWindow InvalidateRect SetWindowRgn WaitForInputIdle LoadStringW PostMessageW IsWindow FindWindowW SendMessageW SendMessageTimeoutW RegisterWindowMessageW EnumDisplaySettingsW DefWindowProcW GetClassInfoW RegisterClassW CreateDialogParamW CharNextW PeekMessageW GetMessageW TranslateMessage DispatchMessageW IsDialogMessageW SetWindowLongW PostQuitMessage LoadImageW GetParent GetWindow LoadIconW GetClientRect MapWindowPoints KillTimer SetTimer DestroyWindow GetDesktopWindow WindowFromPoint GetActiveWindow MessageBoxW GetMonitorInfoW

gdi32

CreatePolygonRgn

advapi32

LookupPrivilegeValueW RegEnumKeyExA RegQueryInfoKeyW InitializeSecurityDescriptor SetSecurityDescriptorDacl CreateServiceW OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle ChangeServiceConfigW ControlService StartServiceW QueryServiceStatusEx QueryServiceStatus GetNamedSecurityInfoW SetEntriesInAclW SetNamedSecurityInfoW RegCreateKeyA RegEnumValueW RegNotifyChangeKeyValue ConvertSidToStringSidW LookupAccountSidW RegUnLoadKeyW RegLoadKeyW RegDeleteKeyW ConvertStringSidToSidW GetLengthSid SetTokenInformation CreateProcessAsUserW RegDeleteValueW AllocateAndInitializeSid EqualSid CryptImportKey RegCreateKeyW GetSidSubAuthority DuplicateTokenEx GetTokenInformation RegOpenKeyW OpenEventLogW ReadEventLogW CloseEventLog OpenProcessToken AdjustTokenPrivileges FreeSid CryptAcquireContextW CryptGetKeyParam CryptDecrypt CryptEncrypt CryptDestroyHash CryptDestroyKey CryptReleaseContext RegSetValueExW RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ord680 ord165 ShellExecuteW CommandLineToArgvW SHParseDisplayName SHBrowseForFolderW SHGetPathFromIDListW SHGetSpecialFolderPathW ShellExecuteExW SHBindToParent SHGetDataFromIDListW ExtractIconExW SHGetFileInfoW SHGetFolderPathW Shell_NotifyIconW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoTaskMemFree CoInitialize CoUninitialize CLSIDFromProgID CoCreateInstance

oleaut32

VariantInit GetErrorInfo VariantChangeType SetErrorInfo CreateErrorInfo SysFreeString VarUI4FromStr VariantClear SysAllocString

shlwapi

StrCmpNIW PathRemoveFileSpecW PathFindFileNameW PathIsDirectoryW PathRemoveExtensionW AssocQueryStringW PathUnquoteSpacesW StrChrW StrCmpNW PathAddBackslashW StrStrIA SHSetValueA SHDeleteValueA StrCmpW PathStripPathW PathStripToRootW ord437 StrCpyW StrCatW SHGetValueA PathFindExtensionW StrCmpIW PathAppendW PathFileExistsW SHDeleteValueW StrToIntExW SHSetValueW SHGetValueW wnsprintfW StrStrIW PathCombineW SHDeleteKeyW

comctl32

InitCommonControlsEx

psapi

EnumProcesses EnumProcessModules GetModuleFileNameExW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

HttpQueryInfoW InternetReadFile InternetGetConnectedState InternetCloseHandle InternetOpenUrlW InternetQueryOptionW DeleteUrlCacheEntryW InternetOpenW InternetSetOptionW

powrprof

GetPwrCapabilities

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

userenv

GetUserProfileDirectoryW DestroyEnvironmentBlock CreateEnvironmentBlock

crypt32

CryptProtectData CryptUnprotectData CertGetNameStringW

Sharing

General

Malware Config

Signatures

File Explorer

202408168253f93383302d46e0fcdd26f5f7617ffloxifmagniber

PE Signature issue

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

version

wininet

powrprof

wintrust

wtsapi32

userenv

crypt32

generic