360vz[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

360vz.exe
Size

96KB
MD5

c71eacf3ffaf82787a533eb452bcf3e7
SHA1

c9149fdc1eacf2c61e606050d5d3e82284578ffb
SHA256

927d0f45bf59f19e915b8a8807372f547d151b60455a7fe40f696b8742d3ae3a
SHA512

26c9deb31071f1606b2eb8c09e3c1ea761701be0c8ba99673986abd44bb42affb9e8787e46059a277e9c2e40827f3619cbeaf39fefdedeb20a2a4e6925ca815e
SSDEEP

1536:GRtxXnig5/VUJyWryEXe8T1g6hypxc/lkJ5jj1fV8cGDmtw:GhN5/VmbTC6hyQ/OJRj1V8cGCtw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
360vz.exe

Files

360vz.exe
.exe windows:4 windows x86 arch:x86

2f42d9bf2e4bd6a55ae0fba78a741ee5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_addr
inet_ntoa
gethostname
closesocket
sendto
htonl
htons
setsockopt
WSAGetLastError
WSASocketA
select
__WSAFDIsSet
recv
WSAIoctl
connect
send
socket
WSAStartup
gethostbyname

pdh

PdhAddCounterA
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhEnumObjectItemsA
PdhOpenQueryA
PdhCloseQuery

iphlpapi

GetAdaptersInfo
GetIfTable

user32

wsprintfA

advapi32

CreateServiceA
OpenServiceA
StartServiceA
RegSetValueExA
CloseServiceHandle
RegOpenKeyExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyA
RegQueryValueExA
RegCloseKey
OpenSCManagerA

kernel32

GetStringTypeA
MultiByteToWideChar
FlushFileBuffers
SetFilePointer
SetUnhandledExceptionFilter
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
GetStringTypeW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
SetEnvironmentVariableA
WideCharToMultiByte
SetPriorityClass
GetTickCount
GetLocalTime
Sleep
ExitThread
GetCurrentProcessId
GetLastError
GetSystemTimes
GetVersionExA
CreateThread
WinExec
GetProcAddress
GetTempPathA
LoadLibraryA
ResumeThread
CreateProcessA
SetThreadPriority
GetCurrentThread
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
SetFileAttributesA
GetWindowsDirectoryA
CloseHandle
WaitForSingleObject
ExitProcess
CreateMutexA
lstrlenA
CopyFileA
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
CreateDirectoryA
TerminateProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
RaiseException
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy

Sections

.text
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2f42d9bf2e4bd6a55ae0fba78a741ee5

Headers

File Characteristics

Imports

ws2_32

pdh

iphlpapi

user32

advapi32

kernel32

Sections

.text Size: 64KB - Virtual size: 62KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 19KB

.sxdata Size: 4KB - Virtual size: 24B

.text
Size: 64KB - Virtual size: 62KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 19KB

.sxdata
Size: 4KB - Virtual size: 24B