a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4

Sharing

Copy URL Twitter E-mail

General

Target
a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4
Size 14.1MB
Sample240907-zaex7swcpc
SHA256 a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4
MD5 a902264e59e85b37cd6da652ccb249cb
SHA1 8c33b1bf078e073ba1d95af768ee6a58edd1d88a
SHA512 381505c42c2df40da36e3d8d439c350b9d8977100291ae8bd2a033f9eb0b54b408cd4678b5c22a4c2c8a656a4b991b902373ef26fafc7598c5e7232b5ca78dac
SSDEEP 393216:qjIzYaUD7iS+o8VU4vLPNXV/Q+VhvR88FT5:HzhUqo8a4vLFF3VhvRzZ5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4

File Explorer

a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4

.exe 14.1MB

a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4

IMPHASH 3008ba2d73a6802b5057dc195b74283d
SHA256 a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4
MD5 a902264e59e85b37cd6da652ccb249cb
SHA1 8c33b1bf078e073ba1d95af768ee6a58edd1d88a
SHA512 381505c42c2df40da36e3d8d439c350b9d8977100291ae8bd2a033f9eb0b54b408cd4678b5c22a4c2c8a656a4b991b902373ef26fafc7598c5e7232b5ca78dac
SSDEEP 393216:qjIzYaUD7iS+o8VU4vLPNXV/Q+VhvR88FT5:HzhUqo8a4vLFF3VhvRzZ5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

240346

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\804071\out\Release\SetupX.pdb

kernel32

InterlockedDecrement WaitForSingleObject GetDiskFreeSpaceExW lstrlenW GetCommandLineW CreateProcessW CreateEventW DuplicateHandle OpenProcess TerminateProcess MoveFileExW GetTickCount CreateToolhelp32Snapshot Process32FirstW Process32NextW SetEvent WriteFile lstrcmpiW RaiseException InterlockedIncrement SetErrorMode GetWindowsDirectoryW FlushInstructionCache SetCurrentDirectoryW GetSystemDirectoryW WaitForMultipleObjects ResetEvent GetFileType SystemTimeToFileTime DosDateTimeToFileTime SetFileTime CreateFileMappingW MapViewOfFile UnmapViewOfFile GetVersionExW GetTempPathW GetStringTypeW GetStringTypeA LCMapStringA SetStdHandle WriteConsoleW GetSystemWindowsDirectoryW WriteConsoleA GetLocaleInfoA GetModuleHandleA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW HeapCreate LCMapStringW GetStartupInfoA SetHandleCount IsValidCodePage InterlockedCompareExchange GetCPInfo FlushFileBuffers GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount GetModuleFileNameA GetStdHandle RtlUnwind GetStartupInfoW CreateThread ExitThread ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree TlsAlloc ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock TlsSetValue OutputDebugStringW SetLastError DeleteFileW CreateDirectoryW GetCurrentThreadId GetCurrentProcess LoadLibraryExW FreeResource LoadLibraryW FindResourceExW FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar GetACP FormatMessageW WideCharToMultiByte GetLastError CreateMutexW GetModuleFileNameW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetModuleHandleW DeviceIoControl GetCurrentProcessId CreateFileW SetFilePointer ReadFile CloseHandle GetProcAddress TlsGetValue GetFileSizeEx SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime GetSystemTimeAsFileTime CreateFileA VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetOEMCP Sleep FreeLibrary GetConsoleOutputCP

user32

IsIconic FindWindowW MessageBoxW UnregisterClassA GetActiveWindow CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW CharNextW CallWindowProcW DestroyWindow ShowWindow DispatchMessageW TranslateMessage GetMessageW PeekMessageW RegisterWindowMessageW PostThreadMessageW PostQuitMessage PostMessageW DisableProcessWindowsGhosting MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints SetWindowLongW SetWindowPos SetWindowTextW SendMessageW GetSystemMetrics LoadImageW GetParent IsWindowVisible GetWindow GetWindowLongW GetWindowRect LoadStringW DefWindowProcW

advapi32

SetTokenInformation SaferCreateLevel QueryServiceStatusEx OpenServiceW ControlService RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW CloseServiceHandle StartServiceW CreateServiceW OpenSCManagerW RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SaferCloseLevel CreateProcessAsUserW FreeSid GetLengthSid AllocateAndInitializeSid SaferComputeTokenFromLevel RegQueryValueExA

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetSpecialFolderPathW ShellExecuteW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoUninitialize CoInitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear DispCallFunc VarUI4FromStr

shlwapi

PathCombineW SHGetValueW PathFileExistsW StrCmpNIW StrStrIW PathFindExtensionW StrCmpIW PathRemoveBackslashW PathIsRootW PathAppendW PathStripToRootW PathRemoveFileSpecW PathFindFileNameW

comctl32

InitCommonControlsEx

psapi

GetModuleFileNameExW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

version

generic