910671f5ccd09562e5cbbbd1f6124b1e3e8a95aa666e3dd1fcaa839240235588

Sharing

Copy URL

Twitter E-mail

General

Target

910671f5ccd09562e5cbbbd1f6124b1e3e8a95aa666e3dd1fcaa839240235588
Size

1001KB
MD5

bf2c7bb21e7aeab1b93d05f1bb26ffa8
SHA1

5e24a71302fd88320708439985b685fb0b9c9474
SHA256

910671f5ccd09562e5cbbbd1f6124b1e3e8a95aa666e3dd1fcaa839240235588
SHA512

9bcb9a7d82e4c85facfb1992f07e1e2414c490dd354f67c98585a3eb23be0dcb478cc246f2b862f2abce7a735e0ea9e46ca338246d76bc9652bb91ddc7fa33e2
SSDEEP

24576:XWtrQSEshKO1axQ31DvJc9cQDmyEMMlYdHD/yQQQQQQQQQQ+QQQQQQQQQQQQQQl8:GZDhKO1ay3bcNnHMlY5yQQQQQQQQQQ+G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
910671f5ccd09562e5cbbbd1f6124b1e3e8a95aa666e3dd1fcaa839240235588

Files

910671f5ccd09562e5cbbbd1f6124b1e3e8a95aa666e3dd1fcaa839240235588
.exe windows:5 windows x86 arch:x86

58d19917bc6c11e32f5b9c03a2129217

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\850922\out\Release\InstallSoft.pdb

Imports

kernel32

PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
ReadFile
GetCurrentProcessId
GlobalAlloc
lstrlenA
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetWindowsDirectoryW
GetTickCount
ReleaseMutex
lstrcmpiW
FormatMessageA
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
InitializeCriticalSection
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
SetFilePointer
FlushFileBuffers
LeaveCriticalSection
EnterCriticalSection
FlushInstructionCache
GetCurrentThreadId
InterlockedCompareExchange
Sleep
LoadLibraryW
LoadLibraryExW
FreeResource
FreeLibrary
GetSystemWindowsDirectoryW
GetVersionExW
lstrcpyW
MultiByteToWideChar
FindResourceExW
GetCurrentDirectoryA
LockResource
SizeofResource
FindResourceW
GetDriveTypeW
QueryDosDeviceW
DeviceIoControl
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetFileAttributesW
SetFileAttributesW
LocalFree
CreateFileW
WriteFile
DeleteFileW
WideCharToMultiByte
SetConsoleCtrlHandler
GetModuleFileNameA
GetStdHandle
FatalAppExitA
HeapCreate
LCMapStringW
LCMapStringA
GetCurrentThread
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleHandleA
GetStartupInfoW
ExitProcess
CreateThread
ExitThread
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
lstrcmpiA
lstrcmpA
TlsFree
TlsAlloc
HeapWalk
HeapLock
OpenThread
HeapUnlock
CreateProcessW
WaitForSingleObject
TlsSetValue
OutputDebugStringW
TlsGetValue
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
CreateMutexW
OpenMutexW
GetTempPathW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetFileAttributesA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
LoadResource
SetCurrentDirectoryA
GetExitCodeProcess
lstrlenW
GetFullPathNameW
GetSystemDirectoryW
GetLastError
CloseHandle
FindFirstFileW
FindNextFileW
FindClose
SetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetCurrentProcess
GetCommandLineW
RaiseException

user32

wsprintfW
SetPropW
GetWindowRect
ReleaseDC
GetDC
SetWindowLongW
GetWindowLongW
RemovePropW
GetPropW
CallWindowProcW
UnregisterClassA
IsWindowVisible
MoveWindow
SetWindowPos
DefWindowProcW
CreateWindowExW
GetClassInfoExW
LoadCursorW
PtInRect
SetCursor
SendMessageTimeoutW
FindWindowW
CreateDialogParamW
PeekMessageW
DestroyWindow
ShowWindow
CharNextW
LoadImageW
GetSystemMetrics
GetMonitorInfoW
MonitorFromWindow
GetClientRect
PostQuitMessage
EndPaint
BeginPaint
KillTimer
ScreenToClient
GetCursorPos
CopyRect
SetWindowTextW
SendMessageW
IsDialogMessageW
MessageBoxW
GetActiveWindow
DispatchMessageW
TranslateMessage
InvalidateRect
PostMessageW
IsWindow
GetCapture
SetCapture
GetMessageW
ReleaseCapture
RegisterClassExW

gdi32

CreateCompatibleDC
SelectObject
GetObjectW
DeleteObject
EnumFontsW
GetDeviceCaps
DeleteDC
SetViewportOrgEx
CreateCompatibleBitmap
BitBlt
ExtTextOutW
SetBkColor
CreateDIBSection

advapi32

AdjustTokenPrivileges
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetTokenInformation
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
IsValidSid
LookupAccountNameW
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
GetUserNameW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
OpenProcessToken
LookupPrivilegeValueW
CryptCreateHash

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
ord165
ShellExecuteW

ole32

CoTaskMemRealloc
CoCreateGuid
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CreateStreamOnHGlobal
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize

oleaut32

VariantInit
VariantClear
SysFreeString
VarUI4FromStr
SysAllocString

shlwapi

SHDeleteValueW
StrCpyW
StrStrIW
SHSetValueW
PathStripToRootW
PathRemoveExtensionW
StrStrIA
StrCmpIW
StrCmpNIW
StrTrimA
SHSetValueA
SHGetValueA
StrToIntExW
PathIsDirectoryW
PathCombineW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW
SHGetValueW

comctl32

_TrackMouseEvent

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

gdiplus

GdipDeleteStringFormat
GdipCreateStringFormat
GdipSetStringFormatLineAlign
GdipFree
GdipAlloc
GdipDeleteBrush
GdipCreateSolidFill
GdipDrawImageRectRectI
GdipGraphicsClear
GdipSetInterpolationMode
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipCloneBrush
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRect
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDrawImageRect
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipDisposeImage
GdipCloneImage
GdipSetStringFormatAlign
GdiplusStartup
GdiplusShutdown
GdipDeleteFont
GdipSetTextRenderingHint
GdipDrawString
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipMeasureString
GdipCreateFont
GdipCreateFontFamilyFromName

wininet

InternetReadFile
HttpOpenRequestW
InternetConnectW
InternetCloseHandle
HttpSendRequestW
InternetCrackUrlW
HttpQueryInfoW
InternetSetOptionW
InternetQueryOptionW
InternetOpenW

imm32

ImmDisableIME

crypt32

CertCreateCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertAddCertificateContextToStore
CryptQueryObject
CertGetNameStringA
CertFreeCertificateChain
CryptBinaryToStringA
CryptStringToBinaryA

urlmon

URLDownloadToCacheFileW

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

ws2_32

bind
gethostbyname
WSACleanup
inet_ntoa
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
recv
send
WSAIoctl
setsockopt
getsockname
ntohs
htons
getsockopt
getpeername
closesocket
socket
connect
freeaddrinfo
getaddrinfo
ioctlsocket
WSAStartup

Sections

.text
Size: 759KB - Virtual size: 759KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

58d19917bc6c11e32f5b9c03a2129217

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

gdiplus

wininet

imm32

crypt32

urlmon

setupapi

iphlpapi

ws2_32

Sections

.text Size: 759KB - Virtual size: 759KB

.rdata Size: 97KB - Virtual size: 96KB

.data Size: 17KB - Virtual size: 30KB

.rsrc Size: 94KB - Virtual size: 94KB

.reloc Size: 32KB - Virtual size: 32KB

.text
Size: 759KB - Virtual size: 759KB

.rdata
Size: 97KB - Virtual size: 96KB

.data
Size: 17KB - Virtual size: 30KB

.rsrc
Size: 94KB - Virtual size: 94KB

.reloc
Size: 32KB - Virtual size: 32KB