c43d0ef4109d1de22d368d0d72ce43206d4b1c7a48605ce1a77b3101d7d0e78f

Sharing

Copy URL

Twitter E-mail

General

Target

c43d0ef4109d1de22d368d0d72ce43206d4b1c7a48605ce1a77b3101d7d0e78f
Size

7.3MB
MD5

f7006bbe5e9bbf7cae377b8feb65dde5
SHA1

6d3a253de5882e787aa6e5d2a12c8f353b5fd44f
SHA256

c43d0ef4109d1de22d368d0d72ce43206d4b1c7a48605ce1a77b3101d7d0e78f
SHA512

a8480fb5244932ba60a4eadfed9d819827ac9821c639c80054d1b57518ba38ce35c1dab428df6eb067ced3701e2f8a322129957286df3dc7889f6421bb1b706d
SSDEEP

196608:tBj6X7gJUm5wzILSSWR4tA+NVRDPImrRz2k/IRrhBDL:tB/xiILSbRN+NVmmrRSk/erDL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c43d0ef4109d1de22d368d0d72ce43206d4b1c7a48605ce1a77b3101d7d0e78f

Files

c43d0ef4109d1de22d368d0d72ce43206d4b1c7a48605ce1a77b3101d7d0e78f
.exe windows:5 windows x86 arch:x86

6f064b2f76071fe840018573987f3291

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\828959\out\Release\Setup.pdb

Imports

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
lstrlenA
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
GetCurrentDirectoryA
PeekNamedPipe
GetFullPathNameA
GetDriveTypeA
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
GetDiskFreeSpaceExW
GlobalAddAtomW
FindAtomW
CreateEventW
SetEvent
GetSystemTime
GetWindowsDirectoryW
GetDriveTypeW
GetCurrentThreadId
MulDiv
GetCurrentProcess
FlushInstructionCache
GlobalAlloc
GlobalFree
GetTickCount
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
lstrcmpiW
FormatMessageA
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
FreeResource
GetSystemWindowsDirectoryW
lstrcmpiA
lstrcmpA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
GetLocaleInfoW
WriteConsoleW
LeaveCriticalSection
WriteConsoleA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
SetHandleCount
GetFileType
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
HeapCreate
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
GetStartupInfoW
ExitProcess
TerminateProcess
GetCurrentThread
CreateProcessW
GlobalDeleteAtom
CreateMutexW
PostQueuedCompletionStatus
GetLogicalDriveStringsW
CreateIoCompletionPort
GetQueuedCompletionStatus
CreateThread
TerminateThread
OutputDebugStringW
GetFileSizeEx
CompareFileTime
OpenProcess
GetVolumeInformationW
EnterCriticalSection
GetLocalTime
SetLastError
lstrlenW
lstrcpyW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
FindFirstFileW
FindNextFileW
FindClose
LocalAlloc
CopyFileW
MoveFileW
MoveFileExW
GetPrivateProfileStringW
GlobalFindAtomW
GetFileAttributesW
WriteFile
CreateDirectoryW
GetTempPathW
GetTempFileNameW
WritePrivateProfileStringW
SetFileAttributesW
InterlockedDecrement
RemoveDirectoryW
DeleteFileW
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
GetSystemDirectoryW
GlobalMemoryStatusEx
GetModuleHandleA
GetSystemInfo
InterlockedCompareExchange
Sleep
GetVersionExW
GetVersion
GetModuleHandleW
GetProcAddress
InterlockedExchange
ReadFile
SetFilePointer
GetCurrentProcessId
CreateFileW
DeviceIoControl
LoadLibraryW
InterlockedIncrement
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
WaitForSingleObject
FreeLibrary
LocalFree
FindResourceExW
FindResourceW
LoadResource
LockResource
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
ExitThread
TlsFree
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
SetFilePointerEx
GetSystemTimeAsFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
TlsAlloc
LockFile
GetStdHandle
SetConsoleTextAttribute
GetFileAttributesA
GetFileInformationByHandle
LocalFileTimeToFileTime
DosDateTimeToFileTime
TlsGetValue
TlsSetValue
ResetEvent
ReadProcessMemory
OpenMutexW
GetExitCodeProcess
GetLongPathNameW
MapViewOfFile
LockFileEx
GetFileAttributesExW
UnlockFile
FindNextFileA
FindFirstFileA
GetFullPathNameW
FormatMessageW
SetFileTime
SetEndOfFile
WideCharToMultiByte
UnmapViewOfFile
GetFileSize
CreateFileMappingW
GetEnvironmentVariableW
GetConsoleOutputCP
SizeofResource

user32

InflateRect
EnableWindow
wvsprintfW
PostMessageW
MessageBoxW
GetDlgItem
IsWindowEnabled
ShowWindow
SetDlgItemTextW
IsWindowVisible
SetForegroundWindow
EndDialog
GetWindowLongW
SetWindowTextW
MoveWindow
SetWindowPos
GetClientRect
ScreenToClient
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
GetDC
UnregisterClassA
ExitWindowsEx
wsprintfW
ReleaseDC
SetWindowLongW
GetWindowTextW
FindWindowExW
InvalidateRect
RedrawWindow
GetDlgCtrlID
SetFocus
MessageBeep
GetWindowTextLengthW
CreateDialogParamW
SetWindowRgn
SetTimer
KillTimer
CopyRect
GetActiveWindow
SendMessageW
SendMessageTimeoutW
FindWindowW
CharNextW
DefWindowProcW
IsWindow
CallWindowProcW
BeginPaint
EndPaint
DialogBoxParamW
EnableMenuItem
DestroyWindow
GetSystemMenu
GetClassInfoExW
LoadCursorW
PostQuitMessage
IsIconic
SystemParametersInfoW
LoadIconW
RegisterClassExW
CreateWindowExW
LoadImageW
GetSystemMetrics
PtInRect
GetCursorPos
BringWindowToTop
TrackMouseEvent
GetShellWindow
PostThreadMessageW
UpdateLayeredWindow
GetWindowThreadProcessId
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW

gdi32

CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteDC
SetBkColor
CombineRgn
CreateRectRgn
SetViewportOrgEx
CreateDIBSection
EnumFontFamiliesW
DeleteObject
CreateSolidBrush

advapi32

RegOpenKeyExW
ImpersonateLoggedOnUser
RevertToSelf
OpenProcessToken
DuplicateTokenEx
QueryServiceStatusEx
StartServiceW
ChangeServiceConfigW
ControlService
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenThreadToken
ImpersonateSelf
AllocateAndInitializeSid
FreeSid
SetSecurityInfo
GetSecurityInfo
GetSecurityDescriptorSacl
IsValidSid
CopySid
RegQueryValueExW
RegQueryInfoKeyW
GetExplicitEntriesFromAclW
GetTrusteeNameW
DeleteAce
LookupAccountSidW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyW
RegEnumKeyExW
CryptCreateHash
RegDeleteValueW
RegEnumValueW
RegCloseKey
RegDeleteKeyW
GetUserNameW
LookupAccountNameW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
CryptHashData
RegOpenKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
GetTokenInformation
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptGetHashParam

shell32

ord680
SHGetSpecialFolderPathA
ord165
CommandLineToArgvW
ShellExecuteExW
SHBrowseForFolderW
SHCreateDirectoryExW
SHFileOperationW
SHChangeNotify
ShellExecuteW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc

ole32

OleRun
CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
CoInitialize

oleaut32

VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysAllocStringLen
VariantChangeType
VariantInit
SysStringLen
SysAllocString
SysFreeString

shlwapi

PathRemoveExtensionW
PathFindFileNameW
PathAddBackslashW
PathIsDirectoryW
PathCommonPrefixW
SHSetValueA
StrTrimA
StrCmpNIW
PathIsPrefixW
PathMatchSpecW
StrRetToStrW
PathIsSameRootW
StrCatW
StrCpyW
wnsprintfW
StrCmpW
PathAppendA
PathRemoveArgsW
SHSetValueW
PathFileExistsW
SHGetValueW
SHDeleteValueW
PathFileExistsA
SHGetValueA
PathCombineW
PathAppendW
PathIsRelativeW
SHDeleteKeyW
StrStrIA
StrCmpIW
PathUnquoteSpacesW
PathCombineA
PathIsDirectoryEmptyW
PathFindExtensionW
StrStrIW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

crypt32

CertDeleteCertificateFromStore
CertCompareCertificate
CertDuplicateCertificateContext
CertCloseStore
CertGetNameStringW
CertEnumCertificatesInStore
CertOpenStore
CryptStringToBinaryA
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertGetNameStringA
CryptQueryObject
CertAddCertificateContextToStore
CertFindCertificateInStore
CertCreateCertificateChainEngine
CertFreeCertificateContext

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

GetProcessImageFileNameW
GetModuleFileNameExW
EnumProcesses

rpcrt4

RpcBindingFree
NdrAsyncClientCall
NdrClientCall2
RpcStringFreeW
RpcBindingFromStringBindingW
NdrAsyncServerCall
NdrServerCall2
RpcStringBindingComposeW

gdiplus

GdipTranslateWorldTransform
GdipAddPathBezierI
GdipRotateWorldTransform
GdipGraphicsClear
GdipFillPath
GdipDrawString
GdipAddPathArcI
GdipClosePathFigure
GdipSetStringFormatLineAlign
GdipSetSmoothingMode
GdipCreateSolidFill
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipDeletePath
GdipCreatePath
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetTextRenderingHint
GdipCreateStringFormat
GdipDeleteBrush
GdiplusStartup
GdiplusShutdown
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipSaveGraphics
GdipRestoreGraphics
GdipCreateFromHDC
GdipDeleteGraphics
GdipCloneBrush
GdipCloneImage
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipAlloc
GdipScaleWorldTransform
GdipFree

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

iphlpapi

GetAdaptersInfo

wininet

InternetConnectW
InternetOpenW
InternetCrackUrlW
InternetCloseHandle
HttpOpenRequestW
HttpSendRequestW
InternetQueryOptionW
InternetSetOptionW
InternetGetConnectedState
HttpQueryInfoW

netapi32

NetApiBufferFree
NetWkstaGetInfo

setupapi

SetupIterateCabinetW

ws2_32

WSASetLastError
__WSAFDIsSet
WSAGetLastError
recv
send
select
closesocket

Sections

.text
Size: 728KB - Virtual size: 727KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7.6MB - Virtual size: 7.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f064b2f76071fe840018573987f3291

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

crypt32

version

psapi

rpcrt4

gdiplus

urlmon

iphlpapi

wininet

netapi32

setupapi

ws2_32

Sections

.text Size: 728KB - Virtual size: 727KB

.rdata Size: 200KB - Virtual size: 200KB

.data Size: 55KB - Virtual size: 76KB

.rsrc Size: 7.6MB - Virtual size: 7.6MB

.reloc Size: 81KB - Virtual size: 81KB

.text
Size: 728KB - Virtual size: 727KB

.rdata
Size: 200KB - Virtual size: 200KB

.data
Size: 55KB - Virtual size: 76KB

.rsrc
Size: 7.6MB - Virtual size: 7.6MB

.reloc
Size: 81KB - Virtual size: 81KB