C:\vmagent_new\bin\joblist\807922\out\Release_tr\Setup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe
Resource
win10v2004-20241007-en
General
-
Target
004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f
-
Size
10.0MB
-
MD5
53e7d13e35275d5f45f824a159a40339
-
SHA1
4fa1a45500f2da8b1631f67a4aa1258082cd83b2
-
SHA256
004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f
-
SHA512
4d53be3bd8ad287fb47e17d06df9d5e3133fc25149a39154a6af00241d27788a0988f266051e20fb96e4cccb7c1a57312ff4e60f7d6050ab9715e0edae372758
-
SSDEEP
196608:jZAMKn7gJUDzwzILSSWR4tA+NVRDPImrRz2k/IRrhBRFzL2bBsoQB:jZdwcILSbRN+NVmmrRSk/erRFzLA6oQB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f
Files
-
004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe windows:5 windows x86 arch:x86
280db92e0eb2a44e35e305fc29cdf12a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLocalTime
QueryPerformanceCounter
QueryPerformanceFrequency
lstrlenA
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
GetCurrentDirectoryA
PeekNamedPipe
GetFullPathNameA
GetDriveTypeA
GetVolumeNameForVolumeMountPointW
GetDiskFreeSpaceExW
GlobalAddAtomW
FindAtomW
CreateEventW
SetEvent
GetSystemTime
TerminateProcess
GetCurrentThread
GetCurrentThreadId
MulDiv
GetCurrentProcess
FlushInstructionCache
GlobalAlloc
GlobalFree
GetTickCount
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
GetFullPathNameW
SetLastError
FormatMessageA
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
FreeResource
GetSystemWindowsDirectoryW
lstrcmpiA
lstrcmpA
SetEnvironmentVariableA
CompareStringW
CompareStringA
lstrlenW
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
SetHandleCount
GetFileType
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
HeapCreate
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
GetStartupInfoW
CreateProcessW
GlobalDeleteAtom
CreateMutexW
GetDriveTypeW
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatus
CreateThread
TerminateThread
OutputDebugStringW
GetFileSizeEx
CompareFileTime
OpenProcess
GetVolumeInformationW
SetFileTime
lstrcpyW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
FindFirstFileW
FindNextFileW
FindClose
LocalAlloc
CopyFileW
MoveFileW
MoveFileExW
GetPrivateProfileStringW
GlobalFindAtomW
GetFileAttributesW
WriteFile
CreateDirectoryW
GetTempPathW
GetTempFileNameW
WritePrivateProfileStringW
SetFileAttributesW
InterlockedDecrement
RemoveDirectoryW
DeleteFileW
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
GetSystemDirectoryW
GlobalMemoryStatusEx
GetModuleHandleA
GetSystemInfo
InterlockedCompareExchange
Sleep
GetVersionExW
GetVersion
GetModuleHandleW
GetProcAddress
InterlockedExchange
ReadFile
SetFilePointer
GetCurrentProcessId
CreateFileW
DeviceIoControl
LoadLibraryW
InterlockedIncrement
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
WaitForSingleObject
FreeLibrary
LocalFree
FindResourceExW
FindResourceW
LoadResource
LockResource
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
ExitThread
TlsFree
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
SetFilePointerEx
GetSystemTimeAsFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
TlsAlloc
LockFile
GetStdHandle
SetConsoleTextAttribute
GetFileInformationByHandle
GetFileAttributesA
LocalFileTimeToFileTime
DosDateTimeToFileTime
TlsGetValue
TlsSetValue
ResetEvent
ReadProcessMemory
OpenMutexW
GetExitCodeProcess
GetLongPathNameW
MapViewOfFile
LockFileEx
GetFileAttributesExW
UnlockFile
FindNextFileA
FindFirstFileA
FormatMessageW
SetEndOfFile
WideCharToMultiByte
UnmapViewOfFile
GetFileSize
CreateFileMappingW
GetEnvironmentVariableW
GetLogicalDriveStringsW
GetWindowsDirectoryW
QueryDosDeviceW
FlushFileBuffers
SizeofResource
user32
InflateRect
wvsprintfW
PostMessageW
MessageBoxW
EnableWindow
GetDlgItem
IsWindowEnabled
ShowWindow
SetDlgItemTextW
IsWindowVisible
SetForegroundWindow
EndDialog
GetWindowLongW
SetWindowTextW
MoveWindow
SetWindowPos
GetClientRect
ScreenToClient
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
GetDC
ReleaseDC
SetWindowLongW
UnregisterClassA
ExitWindowsEx
GetWindowTextW
FindWindowExW
InvalidateRect
RedrawWindow
GetDlgCtrlID
SetFocus
MessageBeep
GetWindowTextLengthW
CreateDialogParamW
SetWindowRgn
SetTimer
KillTimer
CopyRect
DefWindowProcW
GetActiveWindow
SendMessageW
SendMessageTimeoutW
FindWindowW
CharNextW
CallWindowProcW
IsWindow
BeginPaint
EndPaint
wsprintfW
DialogBoxParamW
EnableMenuItem
DestroyWindow
GetSystemMenu
GetClassInfoExW
LoadCursorW
PostQuitMessage
IsIconic
SystemParametersInfoW
LoadIconW
RegisterClassExW
CreateWindowExW
LoadImageW
GetSystemMetrics
PtInRect
GetCursorPos
BringWindowToTop
TrackMouseEvent
GetShellWindow
PostThreadMessageW
UpdateLayeredWindow
GetWindowThreadProcessId
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
gdi32
CreateSolidBrush
CreateCompatibleDC
GetDeviceCaps
SelectObject
BitBlt
DeleteDC
SetBkColor
CombineRgn
CreateRectRgn
SetViewportOrgEx
CreateDIBSection
EnumFontFamiliesW
DeleteObject
CreateCompatibleBitmap
advapi32
RegCloseKey
ImpersonateLoggedOnUser
RevertToSelf
OpenProcessToken
DuplicateTokenEx
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenThreadToken
ImpersonateSelf
AllocateAndInitializeSid
FreeSid
SetSecurityInfo
GetSecurityInfo
GetSecurityDescriptorSacl
IsValidSid
CopySid
RegQueryValueExW
RegQueryInfoKeyW
GetExplicitEntriesFromAclW
GetTrusteeNameW
DeleteAce
LookupAccountSidW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
CryptCreateHash
RegDeleteKeyW
GetUserNameW
LookupAccountNameW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
CryptHashData
RegOpenKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
ChangeServiceConfigW
ControlService
GetTokenInformation
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptGetHashParam
shell32
CommandLineToArgvW
SHGetSpecialFolderPathA
ord680
SHFileOperationW
ord165
ShellExecuteExW
SHBrowseForFolderW
SHChangeNotify
ShellExecuteW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
SHCreateDirectoryExW
ole32
OleRun
CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
CoInitialize
oleaut32
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VariantChangeType
VariantInit
SysFreeString
SysStringLen
SysAllocString
VariantClear
shlwapi
PathRemoveExtensionW
PathFindFileNameW
PathAddBackslashW
PathIsDirectoryW
PathCommonPrefixW
SHSetValueA
StrTrimA
PathIsDirectoryEmptyW
PathMatchSpecW
StrRetToStrW
PathIsSameRootW
StrCatW
StrCpyW
PathIsPrefixW
wnsprintfW
StrCmpW
PathAppendA
SHSetValueW
PathFileExistsW
SHGetValueW
SHDeleteValueW
PathFileExistsA
SHGetValueA
PathCombineW
PathAppendW
PathIsRelativeW
SHDeleteKeyW
StrStrIW
StrCmpNIW
StrStrIA
PathRemoveArgsW
PathUnquoteSpacesW
PathCombineA
PathFindExtensionW
PathRemoveFileSpecW
StrCmpIW
comctl32
InitCommonControlsEx
crypt32
CertDeleteCertificateFromStore
CertCompareCertificate
CertDuplicateCertificateContext
CertCloseStore
CertGetNameStringW
CertEnumCertificatesInStore
CertOpenStore
CryptStringToBinaryA
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertGetNameStringA
CryptQueryObject
CertAddCertificateContextToStore
CertFindCertificateInStore
CertCreateCertificateChainEngine
CertFreeCertificateContext
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
psapi
GetProcessImageFileNameW
GetModuleFileNameExW
EnumProcesses
rpcrt4
RpcBindingFree
NdrAsyncClientCall
RpcStringFreeW
RpcBindingFromStringBindingW
NdrAsyncServerCall
NdrServerCall2
RpcStringBindingComposeW
NdrClientCall2
gdiplus
GdipTranslateWorldTransform
GdipAddPathBezierI
GdipRotateWorldTransform
GdipGraphicsClear
GdipFillPath
GdipDrawString
GdipSaveGraphics
GdipAddPathArcI
GdipClosePathFigure
GdipSetSmoothingMode
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipDeletePath
GdipCreatePath
GdipSetStringFormatLineAlign
GdipSetTextRenderingHint
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteBrush
GdiplusStartup
GdiplusShutdown
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipRestoreGraphics
GdipCloneBrush
GdipCreateFromHDC
GdipDeleteGraphics
GdipCloneImage
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipAlloc
GdipScaleWorldTransform
GdipFree
urlmon
URLDownloadToCacheFileW
URLDownloadToFileW
iphlpapi
GetAdaptersInfo
wininet
InternetOpenW
InternetCrackUrlW
InternetConnectW
InternetCloseHandle
HttpOpenRequestW
HttpSendRequestW
InternetQueryOptionW
InternetSetOptionW
InternetGetConnectedState
HttpQueryInfoW
netapi32
NetApiBufferFree
NetWkstaGetInfo
setupapi
SetupIterateCabinetW
ws2_32
WSASetLastError
__WSAFDIsSet
WSAGetLastError
recv
send
select
closesocket
Sections
.text Size: 728KB - Virtual size: 728KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 199KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 55KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ