40d8fbbe4923f67dd1bbafcab9cb3e5749f5056b106033fb6760eca1c7daee09

Sharing

Copy URL Twitter E-mail

General

Target

40d8fbbe4923f67dd1bbafcab9cb3e5749f5056b106033fb6760eca1c7daee09
Size

2.9MB
MD5

a90718fcca02c44ec7545888d61993f7
SHA1

55368970dc5a66c912e768aa0027d521d344d783
SHA256

40d8fbbe4923f67dd1bbafcab9cb3e5749f5056b106033fb6760eca1c7daee09
SHA512

a3d5034ee5a13ab55adea82d32ced5dd4d4ae4e372ec2ccce325962cf6cbf5c10627323fc59670d6ac6fe78026f4337f8645a96ca4332b3204948ec4365f2c91
SSDEEP

49152:5qGAt/R7gLrWLpwSHZZKQX8Erw/NEUVy3SfcZz/lgPPHXx1/WfPi1UwOnv2rD1+:5uxRnKQMLNEDv2rh+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40d8fbbe4923f67dd1bbafcab9cb3e5749f5056b106033fb6760eca1c7daee09

Files

40d8fbbe4923f67dd1bbafcab9cb3e5749f5056b106033fb6760eca1c7daee09
.exe windows:5 windows x86 arch:x86

5735a010a7dbb1476d2b2da74a613dce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\800493\out\Release\Reader.pdb

Imports

kernel32

FindFirstFileW
FindNextFileW
GetTempPathW
GetTempFileNameW
SetFilePointerEx
GlobalAlloc
GlobalFree
SetEndOfFile
RemoveDirectoryW
GetVolumeInformationW
GetFileAttributesExW
OpenThread
GetModuleHandleExW
Thread32First
Thread32Next
GlobalSize
GlobalLock
GlobalUnlock
GetThreadLocale
SetThreadLocale
SystemTimeToFileTime
GetModuleHandleA
InterlockedIncrement
InterlockedDecrement
FlushFileBuffers
CopyFileW
MulDiv
LocalAlloc
GetBinaryTypeW
SleepEx
GetCommandLineW
SetCurrentDirectoryW
FormatMessageW
MapViewOfFile
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
GetExitCodeThread
TerminateThread
GetCurrentThreadId
InterlockedExchange
MapViewOfFileEx
LoadLibraryW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetLocalTime
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
GetFileType
GetStdHandle
ExitProcess
ExitThread
RtlUnwind
CreateFileMappingW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
GetProcessAffinityMask
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrcmpiW
GetACP
GetCurrentDirectoryW
GetFileAttributesW
VerSetConditionMask
VerifyVersionInfoW
ReleaseMutex
HeapWalk
HeapUnlock
HeapLock
CreateFileA
LocalFileTimeToFileTime
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThread
SwitchToThread
DuplicateHandle
TryEnterCriticalSection
GetStringTypeW
LoadLibraryExA
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
ExpandEnvironmentStringsW
FindClose
GetEnvironmentStringsW
lstrlenA
UnmapViewOfFile
GetFileSize
InterlockedCompareExchange
GetVersionExW
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceExW
FindResourceW
OutputDebugStringW
SetFilePointer
SizeofResource
LoadResource
GetVersion
LockResource
MoveFileExW
GetCurrentProcess
DeleteFileW
SetFileAttributesW
lstrlenW
ReadFile
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetTimeFormatW
GetDateFormatW
SetThreadAffinityMask
LoadLibraryExW
GetProcAddress
GetModuleHandleW
FreeLibrary
VirtualFree
VirtualProtect
VirtualAlloc
GetNativeSystemInfo
GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
GetThreadTimes
TerminateProcess
Sleep
CreateEventW
CreateMutexW
WaitForSingleObjectEx
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
HeapFree
HeapReAlloc
HeapAlloc
SetErrorMode
SetLastError
GetLastError
RaiseException
CloseHandle
WriteFile
GetFileSizeEx
GetProcessHeap
HeapSize
HeapDestroy
CreateProcessW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetUserDefaultLCID
LocalFree
OpenProcess
GetEnvironmentVariableW
CreateToolhelp32Snapshot
CreateFileW

user32

SetWindowPos
IsWindowVisible
OpenClipboard
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
CallWindowProcW
GetSystemMetrics
ClientToScreen
LoadImageW
UnregisterClassW
CopyRect
PostQuitMessage
MoveWindow
SetTimer
KillTimer
GetClientRect
GetWindowRect
MapWindowPoints
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetDlgItem
EnableWindow
GetUpdateRect
ShowWindow
SendMessageW
FindWindowW
SetForegroundWindow
GetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
ScreenToClient
LoadCursorW
LoadIconW
GetDC
SetFocus
GetWindowPlacement
IsZoomed
MonitorFromPoint
MonitorFromRect
GetDlgCtrlID
RedrawWindow
ReleaseDC
DrawTextW
IsRectEmpty
SystemParametersInfoW
BringWindowToTop
IsIconic
AttachThreadInput
SendMessageTimeoutW
GetWindowThreadProcessId
GetMessageW
TranslateMessage
DispatchMessageW
GetKeyState
CharNextW
GetSysColor
PeekMessageW
GetKeyNameTextW
MapVirtualKeyW
UpdateLayeredWindow
SetCapture
ReleaseCapture
SetCursor
PtInRect
GetCursorPos
RegisterWindowMessageW
GetFocus
IntersectRect
OffsetRect
SetActiveWindow
EmptyClipboard
SetClipboardData
GetDesktopWindow
FindWindowExW
EqualRect
SetWindowLongW
GetWindowLongW
GetMessagePos
GetAsyncKeyState
UnionRect
RegisterClassW
InvalidateRect
BeginPaint
GetClassInfoExW
EndPaint
DestroyWindow
IsWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostMessageW
SetWindowTextW
SetWindowRgn

gdi32

GetTextExtentPoint32W
SetBkMode
SetBkColor
SelectObject
GetCurrentObject
CreateCompatibleDC
DPtoLP
GetObjectW
CreateDIBSection
DeleteDC
CreateFontIndirectW
GetDeviceCaps
DeleteObject
CreateFontW
SetTextColor
GetStockObject
EnumFontFamiliesW
BitBlt
CreateRoundRectRgn
GetWindowOrgEx
CreateRectRgnIndirect
SaveDC
ExtSelectClipRgn
RestoreDC
SetWindowOrgEx
SetStretchBltMode
StretchBlt
GetObjectA

comdlg32

CommDlgExtendedError
ChooseColorW
GetOpenFileNameW

advapi32

DuplicateTokenEx
RegCloseKey
RegOpenCurrentUser
RegEnumKeyExW
RegQueryInfoKeyW
LookupPrivilegeValueW
GetSidSubAuthorityCount
GetSidSubAuthority
AdjustTokenPrivileges
GetTokenInformation
OpenProcessToken
RegOpenKeyW
RegSetValueExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW

shell32

SHFreeNameMappings
ord190
ExtractAssociatedIconW
SHOpenFolderAndSelectItems
SHBrowseForFolderW
SHGetPathFromIDListW
SHFileOperationW
ShellExecuteW
ord155
SHGetFolderPathW
ord75
ord165
SHGetSpecialFolderPathW
ord680
ShellExecuteExW
SHChangeNotify
CommandLineToArgvW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
GetHGlobalFromStream
CoTaskMemRealloc
CoInitialize
PropVariantClear
CoCreateInstance
CoInitializeEx
CreateStreamOnHGlobal

oleaut32

VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
SysStringLen
DispCallFunc
SysAllocStringLen
SysAllocString
SysFreeString
VariantInit
VariantClear

shlwapi

PathFileExistsW
PathAppendW
PathCombineW
PathFindExtensionW
PathFindFileNameW
PathRemoveFileSpecW
SHGetValueW
PathIsDirectoryW
StrCmpIW
StrCmpNIW
PathAddBackslashW
UrlGetPartW
PathIsRelativeW
PathStripPathW
PathRemoveExtensionW
SHSetValueW
StrCpyNW
PathIsRootW
StrFormatByteSizeW
ord176
SHDeleteValueW
SHStrDupW
StrStrIW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

gdiplus

GdipAddPathRectangle
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipGetWorldTransform
GdipDisposeImageAttributes
GdipLoadImageFromFile
GdipImageRotateFlip
GdipDrawImageRect
GdipSetWorldTransform
GdipRotateMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix
GdipSetLineBlend
GdipCreateLineBrushFromRect
GdipDrawArc
GdipDeletePen
GdipCreatePen1
GdipGetPropertyItem
GdipSetImageAttributesColorMatrix
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipFillRegion
GdipSetPathGradientFocusScales
GdipDeleteRegion
GdipCreateRegionPath
GdipSetPathGradientWrapMode
GdipSetPathGradientPresetBlend
GdipCreatePathGradientFromPath
GdipAddPathPath
GdipDeletePath
GdipAddPathLine
GdipDrawLineI
GdipDrawRectangleI
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipCreateSolidFill
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectRectI
GdipFillPath
GdipFillRectangleI
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipCreateLineBrushFromRectI
GdipDeleteBrush
GdipCloneBrush
GdipClosePathFigure
GdipDeleteCachedBitmap
GdipCreateCachedBitmap
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdipAddPathEllipse
ord1
GdipCreatePath
GdipDrawPath
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCreateImageAttributes
GdipDeleteFont
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipDrawString
GdipDrawEllipse
GdipFillEllipse
GdipMeasureString
GdipBitmapLockBits
GdipGetPropertyItemSize
GdipBitmapUnlockBits
GdipCreatePen2

comctl32

InitCommonControlsEx
ord17
_TrackMouseEvent

msimg32

AlphaBlend

winmm

timeKillEvent
timeSetEvent

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

crypt32

CryptBinaryToStringA
CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
CertGetNameStringW
CryptStringToBinaryA
CertFindCertificateInStore

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 389KB - Virtual size: 389KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 81KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 388KB - Virtual size: 388KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5735a010a7dbb1476d2b2da74a613dce

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

version

psapi

gdiplus

comctl32

msimg32

winmm

imm32

crypt32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 389KB - Virtual size: 389KB

.data Size: 81KB - Virtual size: 92KB

.rsrc Size: 388KB - Virtual size: 388KB

.reloc Size: 184KB - Virtual size: 184KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 389KB - Virtual size: 389KB

.data
Size: 81KB - Virtual size: 92KB

.rsrc
Size: 388KB - Virtual size: 388KB

.reloc
Size: 184KB - Virtual size: 184KB