ae4e33da7c619c223d4d4df40b3e3c48de8c16673f2272269506d40f5a436294

Sharing

Copy URL

Twitter E-mail

General

Target

ae4e33da7c619c223d4d4df40b3e3c48de8c16673f2272269506d40f5a436294
Size

2.5MB
MD5

c64008aae8ffca8a0ec35b22e998ecff
SHA1

bfad7f6a0068f887a4d1dea8eae3dcdc4bf39889
SHA256

ae4e33da7c619c223d4d4df40b3e3c48de8c16673f2272269506d40f5a436294
SHA512

b27a081da9903ee890a666448b12351ce07dcb229904b3aa21db4906775a6f3fb91592384cd165a0126bc5a98304c203415f161dbd00a708ff5f4cefc38a3cfa
SSDEEP

49152:E2IT06Pvga0bnFX33pUc9WFy/DLANum9tfZf79CA4LFemHXOcILBWHlkr:GzmlNiyDgumnBQAoO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae4e33da7c619c223d4d4df40b3e3c48de8c16673f2272269506d40f5a436294

Files

ae4e33da7c619c223d4d4df40b3e3c48de8c16673f2272269506d40f5a436294
.exe windows:5 windows x86 arch:x86

584591003d8f32e2bc947ca15ec66084

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\703332\out\Release\360speedld.pdb

Imports

kernel32

OpenEventW
SearchPathW
GetLongPathNameW
WaitForMultipleObjects
GetFileTime
GetThreadLocale
SetThreadLocale
GetProcessTimes
GetFileAttributesExA
SetFileAttributesA
DeleteFileA
GetModuleFileNameA
GetComputerNameW
OutputDebugStringW
GetUserDefaultLangID
GetLocalTime
FindFirstFileW
FindClose
MoveFileExW
CreateDirectoryW
GetSystemTimeAsFileTime
OpenMutexW
ProcessIdToSessionId
WriteFile
SetThreadContext
GetThreadContext
GetModuleHandleExW
InterlockedExchangeAdd
SetEnvironmentVariableA
CompareStringA
GetDriveTypeA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
FlushFileBuffers
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringW
GetConsoleMode
GetConsoleCP
SetStdHandle
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapCreate
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
VirtualQuery
MoveFileA
GetDriveTypeW
CreateThread
ExitThread
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
TlsGetValue
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GlobalMemoryStatusEx
GetCurrentThread
DeviceIoControl
ResumeThread
SuspendThread
SetConsoleCtrlHandler
SetFilePointer
CreateMutexW
GetVersion
GetProcessAffinityMask
SetErrorMode
SetFileAttributesW
VirtualProtect
GetModuleHandleA
GetSystemInfo
GetFileAttributesExW
GetTempPathW
GetFileSize
lstrcmpiW
GlobalUnlock
GlobalLock
DeleteFileW
GlobalReAlloc
TerminateProcess
SetProcessAffinityMask
InterlockedExchange
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentThreadId
FlushInstructionCache
GetCommandLineW
lstrlenA
SetLastError
GetCurrentProcessId
RaiseException
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetWindowsDirectoryW
InitializeCriticalSection
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
GetVersionExW
GetSystemWindowsDirectoryW
GetCurrentProcess
ReadFile
GetFileSizeEx
CreateFileW
WaitForSingleObject
SetEvent
CreateEventW
GetTickCount
FileTimeToLocalFileTime
FileTimeToSystemTime
GetEnvironmentVariableW
InterlockedCompareExchange
LocalFree
LocalAlloc
GetLastError
lstrlenW
FreeResource
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsW
LoadLibraryW
MulDiv
OpenProcess
LoadLibraryExW
GetModuleHandleW
GetSystemDirectoryW
CopyFileW
MultiByteToWideChar
GetModuleFileNameW
Sleep
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcAddress
FreeLibrary
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetStringTypeA

user32

CallWindowProcW
GetForegroundWindow
GetMessagePos
wsprintfW
UnregisterClassA
ReleaseDC
GetDC
LoadImageW
DrawIconEx
DrawTextW
LoadCursorW
SetFocus
UpdateLayeredWindow
EqualRect
SetWindowTextW
CreatePopupMenu
TrackPopupMenu
InsertMenuItemW
DestroyMenu
MonitorFromPoint
GetScrollInfo
ShowScrollBar
GetKeyState
PrivateExtractIconsW
DestroyIcon
GetLastInputInfo
ClientToScreen
AppendMenuW
SetRect
DisableProcessWindowsGhosting
GetAsyncKeyState
GetDlgItem
GetDlgCtrlID
SetCursor
GetActiveWindow
MessageBoxW
SetRectEmpty
IsRectEmpty
MsgWaitForMultipleObjects
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
GetSystemMetrics
PrintWindow
GetClassInfoExW
RegisterClassExW
DialogBoxIndirectParamW
CreateWindowExW
ExitWindowsEx
PostQuitMessage
TrackMouseEvent
BringWindowToTop
SetForegroundWindow
MonitorFromRect
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
LockSetForegroundWindow
RedrawWindow
FindWindowW
DefWindowProcW
AdjustWindowRectEx
SendMessageTimeoutW
GetClassNameW
IsZoomed
GetWindowDC
IsWindowVisible
GetWindowThreadProcessId
GetTopWindow
GetDesktopWindow
SystemParametersInfoW
IsWindow
RegisterWindowMessageW
MoveWindow
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
SetWindowPos
SetWindowLongW
GetCapture
SetCapture
ReleaseCapture
PostMessageW
InvalidateRect
OffsetRect
GetParent
UpdateWindow
CopyRect
SetTimer
ScreenToClient
BeginPaint
EndPaint
IntersectRect
GetClassLongW
FillRect
GetCursorPos
GetClientRect
MapWindowPoints
WindowFromPoint
KillTimer
SendMessageW
PtInRect
GetWindowLongW
EndDialog
WaitForInputIdle

gdi32

SetBkMode
TextOutW
SetTextColor
BitBlt
CreateDCW
GetDIBits
DeleteObject
SetEnhMetaFileBits
GetEnhMetaFileHeader
PlayEnhMetaFile
DeleteEnhMetaFile
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
GetObjectW
CreateFontIndirectW
ExcludeClipRect
SetViewportOrgEx
GetTextExtentPoint32W
GetObjectA
IntersectClipRect
SetBkColor
ExtTextOutW
RectVisible
CreateRectRgn
CreateRectRgnIndirect
CombineRgn
EqualRgn
StretchBlt
SetStretchBltMode
SetDIBColorTable
CreateDIBSection
SetDIBits
EnumFontFamiliesExW
GetDeviceCaps
SelectClipRgn
CreateSolidBrush
OffsetViewportOrgEx
GetStockObject
GetTextColor
GetClipBox

advapi32

OpenEventLogW
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
QueryServiceStatus
CloseServiceHandle
ControlService
StartServiceW
OpenServiceW
OpenSCManagerW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
ChangeServiceConfigW
QueryServiceConfigW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
SaferCloseLevel
CreateProcessAsUserW
SaferComputeTokenFromLevel
SaferCreateLevel
QueryServiceStatusEx
EnumServicesStatusW
RegSetValueW
GetUserNameW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
OpenThreadToken
GetAce
GetAclInformation
AddAce
InitializeAcl
EqualSid
IsValidSid
GetLengthSid
CopySid
RegEnumValueW
CloseEventLog
RegQueryValueExA
ReadEventLogW

shell32

SHCreateDirectoryExW
SHGetFileInfoW
ExtractIconW
SHGetFolderPathW
ord165
ShellExecuteW
ShellExecuteExW
CommandLineToArgvW
SHGetSpecialFolderPathW
ord680

ole32

CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitializeSecurity
PropVariantClear
CoInitializeEx

oleaut32

SysStringByteLen
SysAllocStringByteLen
VarUI4FromStr
VariantClear
SysStringLen
SafeArrayPutElement
VariantInit
SafeArrayCreate
SysAllocString
VarBstrCmp
SysAllocStringLen
SysFreeString
SystemTimeToVariantTime
VariantTimeToSystemTime

shlwapi

PathRemoveExtensionW
StrCmpIW
PathRemoveBackslashW
PathFindExtensionW
PathAddBackslashW
PathCombineW
PathFindFileNameW
SHDeleteValueW
SHDeleteKeyW
StrStrW
PathUnquoteSpacesW
PathIsRelativeW
PathCanonicalizeW
StrStrA
PathIsDirectoryW
StrCmpNIW
PathFileExistsA
PathRemoveFileSpecA
PathAppendA
PathRemoveArgsW
SHQueryValueExW
StrRStrIW
StrStrIA
PathIsURLW
PathFileExistsW
StrStrIW
SHGetValueW
PathRemoveFileSpecW
PathAppendW
SHSetValueA
SHSetValueW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

imm32

ImmDisableIME

Exports

Exports

??0ShellResourceRequestDetails@@QAE@XZ
??1ShellResourceRequestDetails@@QAE@XZ
??4ShellResourceRequestDetails@@QAEAAU0@ABU0@@Z

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 29KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 45B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 419KB - Virtual size: 419KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 193KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

584591003d8f32e2bc947ca15ec66084

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

imm32

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 289KB - Virtual size: 289KB

.data Size: 29KB - Virtual size: 59KB

.tls Size: 512B - Virtual size: 45B

.rsrc Size: 419KB - Virtual size: 419KB

.reloc Size: 193KB - Virtual size: 196KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 289KB - Virtual size: 289KB

.data
Size: 29KB - Virtual size: 59KB

.tls
Size: 512B - Virtual size: 45B

.rsrc
Size: 419KB - Virtual size: 419KB

.reloc
Size: 193KB - Virtual size: 196KB