00e79940befe387e8d0c729d49888cf3b3d621196595db738eb576135ef01c9a

Sharing

Copy URL Twitter E-mail

General

Target

00e79940befe387e8d0c729d49888cf3b3d621196595db738eb576135ef01c9a
Size

2.3MB
MD5

494db334b9a1d13cb33c9068089fb2ea
SHA1

25794eb087dd5ef8d0a00a719e86d5a9a521b380
SHA256

00e79940befe387e8d0c729d49888cf3b3d621196595db738eb576135ef01c9a
SHA512

b1a6eeea29ef514fcf1b39d08929e641acdc9e7a67c9edcea647f0ebec28fc418f820e6ef57db4e2f879ef333f48e7f11911a34fdba06e369dcc408f10897ba4
SSDEEP

24576:ngz2V5Wzj7fDIFMajJpzGzv3qMAbub/KU88G8YupXIa2pXUqRU3g4oRBTVNDyp+U:nD8DD0JZsUCXUdUOU38TVlycEnY

Score

1^/10

Malware Config

Signatures

Files

00e79940befe387e8d0c729d49888cf3b3d621196595db738eb576135ef01c9a
.exe windows:5 windows x86 arch:x86

a27e911773380b58d9bd8608c732c22d

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:5b:f8:6e:85:26:53:40:33:13:83:7b
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

26/04/2023, 03:04

Not After

26/04/2026, 03:04

Subject

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

de:63:fc:b7:a9:be:50:c1:a4:21:35:a8:ae:2e:be:d3:06:1e:00:08:6b:63:e7:08:1e:d7:1f:b5:e4:e2:3d:65
Signer

Actual PE Digest

de:63:fc:b7:a9:be:50:c1:a4:21:35:a8:ae:2e:be:d3:06:1e:00:08:6b:63:e7:08:1e:d7:1f:b5:e4:e2:3d:65

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\vmagent_new\bin\joblist\803991\out\Release\360zip.pdb

Imports

kernel32

GlobalSize
OutputDebugStringW
FormatMessageW
CreateMutexW
GetShortPathNameW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
lstrcatW
GetFileTime
GetDateFormatW
GetTimeFormatW
CompareStringW
OpenEventW
GetSystemTime
SystemTimeToFileTime
CopyFileW
CompareFileTime
SleepEx
FlushFileBuffers
UnmapViewOfFile
CreateFileMappingW
GetSystemInfo
MapViewOfFile
SetFilePointerEx
GetTempFileNameW
WaitForMultipleObjects
lstrcmpiA
GetFileAttributesA
GetCurrentThread
GetThreadContext
VirtualQuery
SetThreadPriority
VirtualAlloc
OpenThread
GetThreadPriority
VirtualProtect
SuspendThread
ResumeThread
GetFullPathNameW
DeactivateActCtx
ReleaseActCtx
CreateActCtxW
ActivateActCtx
GetFileAttributesExW
GetModuleHandleExW
SetEnvironmentVariableA
SetStdHandle
lstrlenA
WriteConsoleA
GetLocaleInfoW
GetModuleHandleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeA
GetConsoleMode
GetConsoleCP
GetStartupInfoA
SetHandleCount
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
CompareStringA
GetStringTypeW
LCMapStringW
LCMapStringA
RtlUnwind
GetFileType
WriteConsoleW
GetCPInfo
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
HeapUnlock
TlsSetValue
TlsGetValue
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
CreateFileA
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetLocaleInfoA
lstrcpynW
DeviceIoControl
GetLocalTime
GetDiskFreeSpaceW
InterlockedExchange
Module32NextW
Module32FirstW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MoveFileW
GetLongPathNameW
GetTempPathW
lstrcpyW
OpenProcess
ProcessIdToSessionId
GetBinaryTypeW
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcmpA
MoveFileExW
SetEndOfFile
WideCharToMultiByte
GetCurrentProcessId
SetFilePointer
GetFileSizeEx
ResetEvent
SetEvent
CreateEventW
GetTickCount
SetLastError
GetSystemWindowsDirectoryW
MulDiv
GetPrivateProfileStringW
OpenMutexW
GetSystemDirectoryW
CreateProcessW
GetStartupInfoW
GetCommandLineW
GetFileSize
WriteFile
GetStdHandle
lstrcmpiW
GetWindowsDirectoryW
Sleep
InterlockedCompareExchange
TerminateProcess
SetFileAttributesW
RemoveDirectoryW
GetFileAttributesW
CreateFileW
ReadFile
CreateDirectoryW
CloseHandle
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
SetPriorityClass
MultiByteToWideChar
LocalFree
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
GetLastError
WritePrivateProfileStringW
FindNextFileW
FindClose
FindFirstFileW
DeleteFileW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
LoadLibraryExW
ExitProcess
LoadLibraryW
EnterCriticalSection
GetProcAddress
LeaveCriticalSection
FreeLibrary
GetPrivateProfileIntW
GlobalAlloc
GlobalLock
GlobalUnlock
GetVersionExW
lstrlenW
GlobalFree
RaiseException
FreeResource
GetVersion
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetConsoleOutputCP
LocalAlloc

user32

GetSysColorBrush
GetFocus
SetScrollInfo
LoadImageW
UnregisterClassA
ReleaseDC
GetDC
GetClientRect
SendMessageW
GetParent
InvalidateRect
PostMessageW
SetWindowLongW
EndDialog
GetWindowLongW
KillTimer
MapWindowPoints
GetCursorPos
SetTimer
LoadCursorW
GetMenuItemCount
MonitorFromPoint
ScreenToClient
MoveWindow
UpdateWindow
SetWindowRgn
IsWindowEnabled
ClientToScreen
WindowFromPoint
SetCursor
FillRect
ReleaseCapture
SetCapture
GetCapture
PtInRect
EndPaint
BeginPaint
DeleteMenu
GetMenuItemInfoW
SetMenuItemInfoW
InsertMenuW
InflateRect
GetSysColor
GetWindowDC
GetClassNameW
GetAncestor
GetForegroundWindow
GetKeyState
IsDialogMessageW
SetRect
LockWindowUpdate
SetParent
LoadBitmapW
EnableMenuItem
IsZoomed
IsClipboardFormatAvailable
GetMenuState
RegisterClipboardFormatW
GetClipboardData
CheckMenuItem
GetMenuStringW
wvsprintfW
SetRectEmpty
AppendMenuW
InsertMenuItemW
GetMessagePos
DrawEdge
SystemParametersInfoW
GetDlgItemInt
SetDlgItemInt
GetClassInfoW
RegisterClassW
SendMessageTimeoutW
CharLowerBuffW
CreatePopupMenu
SetPropW
GetPropW
IsIconic
FindWindowExW
GetWindowThreadProcessId
PostThreadMessageW
SetWindowTextW
LoadIconW
SetWindowPos
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetActiveWindow
DestroyIcon
MessageBoxW
DefWindowProcW
GetDlgItem
SetFocus
ShowWindow
GetWindowTextW
GetWindowTextLengthW
CallWindowProcW
GetSystemMetrics
PostQuitMessage
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
SetActiveWindow
IsWindow
RegisterWindowMessageW
DestroyWindow
DispatchMessageA
DispatchMessageW
TranslateMessage
GetMessageA
GetMessageW
IsWindowUnicode
PeekMessageW
MsgWaitForMultipleObjects
CreateWindowExW
DestroyMenu
FindWindowW
GetLastInputInfo
IntersectRect
SetForegroundWindow
SetDlgItemTextW
BringWindowToTop
EnableWindow
CheckDlgButton
GetSubMenu
LoadMenuW
RedrawWindow
MessageBeep
GetMenuItemID
TrackPopupMenu
SetMenuDefaultItem
CreateDialogParamW
GetClassInfoExW
RegisterClassExW
DialogBoxParamW
IsMenu
DrawTextW
GetCaretPos
CopyRect
GetDlgCtrlID
GetIconInfo
FrameRect
AdjustWindowRectEx
GetScrollPos
GetScrollInfo
ScrollWindow
SetScrollPos
IsRectEmpty
ShowScrollBar
wsprintfW
CharNextW
GetDesktopWindow
IsDlgButtonChecked

gdi32

SaveDC
CreateDIBSection
CreatePatternBrush
CreateBitmap
PatBlt
ExtTextOutW
StretchBlt
RestoreDC
BitBlt
GetTextExtentPoint32W
CreateRoundRectRgn
CreatePolygonRgn
CreateFontW
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
DeleteDC
CreateCompatibleDC
DeleteObject
CreateFontIndirectW
GetStockObject
SetStretchBltMode
SetBkMode
SetTextColor
GetPixel
CreateRectRgn
CombineRgn
CreateSolidBrush
GetCurrentObject
GetTextColor
GetBkColor
DPtoLP
GetTextMetricsW
CreateDCW
EnumFontFamiliesExW
GetTextExtentPointA
GetTextMetricsA
CreatePenIndirect
SetViewportOrgEx
RoundRect
GetObjectW
SetBkColor

comdlg32

ChooseColorW
GetOpenFileNameW
GetSaveFileNameW
ChooseFontW

advapi32

RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
LookupAccountNameW
SaferComputeTokenFromLevel
CreateProcessAsUserW
SaferCreateLevel
SaferCloseLevel
AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertSidToStringSidW
GetUserNameW
OpenProcessToken
GetTokenInformation
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExA
RegSetValueExW
RegCloseKey

shell32

ord16
SHCreateDirectoryExW
SHGetSpecialFolderPathA
ord2
DragAcceptFiles
ord152
DragQueryFileW
DragQueryPoint
ord155
ord153
ord17
ord23
SHBrowseForFolderW
ord190
ord71
ord21
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW
SHBindToParent
SHGetMalloc
SHGetDesktopFolder
ShellExecuteExW
ord165
SHFileOperationW
SHChangeNotify
Shell_NotifyIconW
SHGetSpecialFolderPathW
ord18
ord680
CommandLineToArgvW
ord4
ShellExecuteW
SHCreateDirectoryExA

ole32

StgCreateDocfileOnILockBytes
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoCreateGuid
OleCreateStaticFromData
OleSetContainedObject
CoTaskMemRealloc
CreateILockBytesOnHGlobal
OleDuplicateData
ReleaseStgMedium
CreateStreamOnHGlobal
StgCreateDocfile
IIDFromString
DoDragDrop
CoUninitialize
CoInitialize

oleaut32

SystemTimeToVariantTime
VarUI4FromStr
SysAllocStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysStringLen
VariantInit
VariantClear
SafeArrayCreateVector
OleTranslateColor
OleLoadPicture
VariantTimeToSystemTime

shlwapi

PathRenameExtensionW
SHSetValueW
PathIsPrefixW
UrlUnescapeW
PathRemoveFileSpecW
PathAppendW
PathCombineW
SHDeleteKeyW
PathFileExistsW
PathIsRelativeW
PathFindExtensionW
PathRemoveExtensionW
StrCmpIW
PathAddBackslashW
StrStrIA
PathFindFileNameW
PathIsDirectoryW
ord437
PathCanonicalizeW
SHGetValueA
SHSetValueA
SHDeleteValueW
PathAddExtensionW
PathCompactPathExW
PathIsUNCW
PathRemoveBackslashW
PathSearchAndQualifyW
StrRStrIW
PathFileExistsA
PathAppendA
StrStrIW
PathCombineA
StrCmpW
SHGetValueW

comctl32

_TrackMouseEvent
InitCommonControlsEx
ImageList_Draw
ImageList_Create
ImageList_Destroy
ImageList_Remove
ImageList_SetImageCount
ImageList_Replace

gdiplus

GdiplusStartup
GdiplusShutdown
GdipDeleteGraphics
GdipCreateHBITMAPFromBitmap
GdipDrawImageRectI
GdipSetInterpolationMode
GdipGraphicsClear
GdipGetImageGraphicsContext
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipBitmapSetResolution
GdipBitmapGetPixel
GdipBitmapUnlockBits
GdipBitmapSetPixel
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipFree
GdipAlloc

wininet

InternetCanonicalizeUrlW
InternetReadFile
InternetSetFilePointer
InternetCrackUrlW
InternetSetOptionW
InternetQueryOptionW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetCloseHandle
HttpQueryInfoW
InternetOpenW

setupapi

SetupIterateCabinetW

urlmon

URLDownloadToFileW

crypt32

CryptBinaryToStringA
CryptStringToBinaryA

oleacc

AccessibleObjectFromPoint

secur32

GetUserNameExW

netapi32

Netbios

rpcrt4

RpcBindingFree
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall2

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 262KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 196KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a27e911773380b58d9bd8608c732c22d

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:5b:f8:6e:85:26:53:40:33:13:83:7bCertificate

Extended Key Usages

Key Usages

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

de:63:fc:b7:a9:be:50:c1:a4:21:35:a8:ae:2e:be:d3:06:1e:00:08:6b:63:e7:08:1e:d7:1f:b5:e4:e2:3d:65Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

wininet

setupapi

urlmon

crypt32

oleacc

secur32

netapi32

rpcrt4

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 262KB - Virtual size: 261KB

.data Size: 196KB - Virtual size: 224KB

.rsrc Size: 89KB - Virtual size: 89KB

.reloc Size: 175KB - Virtual size: 175KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:5b:f8:6e:85:26:53:40:33:13:83:7b
Certificate

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

de:63:fc:b7:a9:be:50:c1:a4:21:35:a8:ae:2e:be:d3:06:1e:00:08:6b:63:e7:08:1e:d7:1f:b5:e4:e2:3d:65
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 262KB - Virtual size: 261KB

.data
Size: 196KB - Virtual size: 224KB

.rsrc
Size: 89KB - Virtual size: 89KB

.reloc
Size: 175KB - Virtual size: 175KB