ebd4b535a875b69ae1188e6e6191048ddb5b40af148d0445e9b305b7e696ead3

Sharing

Copy URL Twitter E-mail

General

Target

ebd4b535a875b69ae1188e6e6191048ddb5b40af148d0445e9b305b7e696ead3
Size

2.7MB
MD5

13dea108a1d2fdb8caf0d32123603b46
SHA1

6ff72be2006ae9cf1bc22b7988035392af79cf33
SHA256

ebd4b535a875b69ae1188e6e6191048ddb5b40af148d0445e9b305b7e696ead3
SHA512

88832a65e7f86194c86d37fc1b73b39fa175bec0a53603b450455a26e611328a46d5d80b3f4d950db2e6d5d5e3057e2542b2bd93b3a911b427979c9b462aa798
SSDEEP

6144:6ssYBmQ9ykxQSRnHFyLTzqw2Rl6KjRmpTyzMqrRX0s:zxykx9RnHcz2RnCyzhR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebd4b535a875b69ae1188e6e6191048ddb5b40af148d0445e9b305b7e696ead3

Files

ebd4b535a875b69ae1188e6e6191048ddb5b40af148d0445e9b305b7e696ead3
.exe windows:5 windows x86 arch:x86

e0b9a8ff7b78a0497f110a033180f8ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\615391\out\Release\360SwitchTips.pdb

Imports

kernel32

LoadLibraryExW
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
SetErrorMode
LockResource
FindResourceExW
SetCurrentDirectoryW
GetCurrentProcess
FlushInstructionCache
SetLastError
InterlockedCompareExchange
Sleep
InterlockedExchange
CreateMutexW
CloseHandle
WideCharToMultiByte
GetTickCount
SetEvent
CreateEventW
WaitForSingleObject
WaitForMultipleObjects
CreateFileW
DeviceIoControl
GetCurrentProcessId
FreeResource
GetSystemWindowsDirectoryW
GetVersionExW
GetSystemDirectoryW
SetFilePointer
ReadFile
FindResourceW
HeapDestroy
HeapAlloc
LoadResource
GetModuleHandleExW
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LCMapStringA
GetLocaleInfoW
GetConsoleMode
SizeofResource
GetModuleHandleA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
GetStdHandle
HeapCreate
MultiByteToWideChar
GetLastError
EnterCriticalSection
RaiseException
LeaveCriticalSection
lstrcmpiW
lstrlenW
GetModuleFileNameW
GetModuleHandleW
FreeLibrary
RtlUnwind
GetStartupInfoW
CreateThread
ExitThread
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
TlsFree
TlsAlloc
ReleaseMutex
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
CreateFileA
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
GetFileSizeEx
WriteFile
SetFilePointerEx
GetProcAddress
GetConsoleCP
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
LoadLibraryW

user32

CreateWindowExW
FindWindowW
IsIconic
SetWindowLongW
LoadCursorW
TranslateMessage
GetClassInfoExW
RegisterClassExW
DestroyWindow
MessageBoxW
GetActiveWindow
DefWindowProcW
PeekMessageW
GetMessageW
PostMessageW
BringWindowToTop
SetForegroundWindow
LoadImageW
GetSystemMetrics
SendMessageW
SetWindowPos
GetWindowLongW
DispatchMessageW
ShowWindow
CharNextW
UnregisterClassA
wsprintfW
CallWindowProcW
SwitchToThisWindow
SetActiveWindow
GetWindowThreadProcessId
AttachThreadInput
GetForegroundWindow
GetLastInputInfo
KillTimer
PostQuitMessage
SetTimer
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
DisableProcessWindowsGhosting
SetWindowTextW

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryValueExA
RegDeleteKeyW
RegCloseKey
RegQueryValueExW

shell32

ShellExecuteW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
DispCallFunc
VariantClear
VariantInit
VarUI4FromStr

shlwapi

SHSetValueW
PathAppendW
PathAddBackslashW
PathFileExistsW
StrCmpNIW
SHGetValueW
PathCombineW
PathRemoveFileSpecW
PathIsRelativeW
PathCanonicalizeW

comctl32

InitCommonControlsEx

version

VerQueryValueW

Sections

.text
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e0b9a8ff7b78a0497f110a033180f8ec

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

Sections

.text Size: 199KB - Virtual size: 199KB

.rdata Size: 34KB - Virtual size: 33KB

.data Size: 9KB - Virtual size: 22KB

.rsrc Size: 81KB - Virtual size: 80KB

.reloc Size: 1.2MB - Virtual size: 1.2MB

.text
Size: 199KB - Virtual size: 199KB

.rdata
Size: 34KB - Virtual size: 33KB

.data
Size: 9KB - Virtual size: 22KB

.rsrc
Size: 81KB - Virtual size: 80KB

.reloc
Size: 1.2MB - Virtual size: 1.2MB