988f79fb6868fb966694d806f100d4394bd5a30f7586dc2b1d9784bf68835852

Sharing

Copy URL

Twitter E-mail

General

Target

988f79fb6868fb966694d806f100d4394bd5a30f7586dc2b1d9784bf68835852
Size

1.0MB
MD5

9c4c9e6bdb6fcb22e6f8865416a158f7
SHA1

536dc94e018bce74ac9630f676527adb6015013c
SHA256

988f79fb6868fb966694d806f100d4394bd5a30f7586dc2b1d9784bf68835852
SHA512

073e68ded2c590dae9bc4195dec3084e04d5049cc93bfa66c3dea958e012cfac273cf8537b466f173affc792658bf22a748c3829f032071f5b2fd70039f5fc72
SSDEEP

12288:LkFlKjuyhlZajPurt1gggLGP08HZa6uA7SpZeOoMiTQvh88ghSYPwTGgAAL6rWXu:LkCuyh8Ap08HmAGp8TjT488iJsZ9O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
988f79fb6868fb966694d806f100d4394bd5a30f7586dc2b1d9784bf68835852

Files

988f79fb6868fb966694d806f100d4394bd5a30f7586dc2b1d9784bf68835852
.exe windows:5 windows x86 arch:x86

5d0076467d8f365634ffb10076526ba7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\673738\out\Release\360SkinView.pdb

Imports

kernel32

Process32FirstW
CreateMutexW
CreateEventW
WaitForSingleObject
GetPrivateProfileStringW
ReadFile
SetFilePointer
DeleteFileW
GetTempFileNameW
GetTempPathW
DeviceIoControl
GlobalFree
lstrcmpiW
MultiByteToWideChar
GetPrivateProfileIntW
WritePrivateProfileStringW
MoveFileW
FindClose
FindFirstFileW
FindNextFileW
lstrcpyW
LocalFree
CreateFileA
WriteFile
FileTimeToDosDateTime
FileTimeToLocalFileTime
FindFirstFileA
GetFileSizeEx
TerminateProcess
lstrlenA
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringA
SetStdHandle
GetTimeZoneInformation
GetStartupInfoA
SetHandleCount
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
GetModuleFileNameA
GetStdHandle
InterlockedDecrement
CreateToolhelp32Snapshot
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetDateFormatA
GetTimeFormatA
GetCPInfo
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoW
GetFileType
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExitProcess
Sleep
RtlUnwind
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
InterlockedExchange
Process32NextW
Module32FirstW
RemoveDirectoryW
CreateFileW
GetFileSize
VirtualProtect
GetCurrentThreadId
GetVersionExW
GetVersion
lstrlenW
FindResourceExW
FindResourceW
LoadResource
LockResource
CloseHandle
FreeLibrary
LoadLibraryW
GetCommandLineW
GetTickCount
SetCurrentDirectoryW
GlobalAlloc
GlobalLock
GlobalUnlock
InterlockedIncrement
GetModuleFileNameW
MulDiv
lstrcmpW
InitializeCriticalSection
HeapCreate
SetLastError
GetModuleHandleW
GetLastError
LCMapStringW
LoadLibraryExW
SizeofResource
LeaveCriticalSection
EnterCriticalSection
RaiseException
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte

user32

WaitForInputIdle
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
MoveWindow
SetWindowPos
IsWindowVisible
SetTimer
KillTimer
SetFocus
GetFocus
SetWindowLongW
IsWindow
GetParent
EndDialog
InflateRect
EqualRect
IntersectRect
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
UnregisterClassA
PostMessageW
DefWindowProcW
DestroyWindow
CreateDialogParamW
GetSysColor
CharNextW
GetClientRect
ClientToScreen
ScreenToClient
GetDC
SendMessageW
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetDlgItem
GetClassNameW
ReleaseCapture
FillRect
CallWindowProcW
EndPaint
BeginPaint
GetDesktopWindow
DestroyAcceleratorTable
GetWindow
GetClassInfoExW
LoadCursorW
RegisterClassExW
CreateWindowExW
CreateAcceleratorTableW
MessageBoxW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
RegisterClassW
GetClassInfoW
FindWindowW
SendMessageTimeoutW
SetForegroundWindow
BringWindowToTop
ShowWindow
IsIconic
wsprintfW
CopyRect
OffsetRect
FindWindowExW
UpdateWindow
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
PostQuitMessage
DialogBoxParamW
DisableProcessWindowsGhosting
LoadImageW
GetSystemMetrics
SetCursor
SystemParametersInfoW
IsRectEmpty
PtInRect
SwitchToThisWindow
IsDialogMessageW
UpdateLayeredWindow
GetCursorPos
SetActiveWindow
GetActiveWindow
EnumChildWindows
GetWindowLongW
ReleaseDC

gdi32

GetTextMetricsW
GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
SetViewportOrgEx
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
CreateDIBSection
GetBitmapBits
BitBlt
SetTextColor

comdlg32

GetSaveFileNameW
GetOpenFileNameW
ChooseColorW

advapi32

RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
GetTokenInformation
OpenProcessToken
CryptReleaseContext
RegDeleteValueW
RegQueryValueExA
CryptGenRandom
CryptAcquireContextW

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
ShellExecuteW
SHCreateDirectoryExW
ShellExecuteExW
CommandLineToArgvW

ole32

CoTaskMemAlloc
CoUninitialize
CoInitialize
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
CoTaskMemFree
CoTaskMemRealloc

oleaut32

SysStringByteLen
SysAllocStringByteLen
SafeArrayGetLBound
VarUI4FromStr
SafeArrayGetUBound
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
VariantChangeType
DispCallFunc
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VariantClear
VariantInit
SysAllocStringLen
SysStringLen
SysAllocString
SysFreeString

shlwapi

PathFileExistsW
StrCmpNIW
PathAddBackslashW
StrStrIW
PathFindExtensionW
SHSetValueW
PathRemoveExtensionW
PathIsRelativeW
PathFindFileNameW
PathIsDirectoryW
PathCombineW
PathRemoveFileSpecW
SHGetValueW
PathAppendW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

setupapi

SetupIterateCabinetW

gdiplus

GdipFillRectangleI
GdipDrawRectangleI
GdipReleaseDC
GdipGetDC
GdipGetImageGraphicsContext
GdipSetPenDashArray
GdipCreateBitmapFromScan0
GdipImageRotateFlip
GdipDeleteCachedBitmap
GdipCreateCachedBitmap
GdipDeletePen
GdipCreatePen1
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipCloneBrush
GdipDrawImageRectRectI
GdipGraphicsClear
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipDeleteFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteGraphics
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteBrush
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCloneImage
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipDrawImageI
GdipDrawString
GdipDrawImageRectRect
GdipCreateFont
GdipSetImageAttributesColorMatrix

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CryptStringToBinaryA
CertGetNameStringW
CryptBinaryToStringA

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

Sections

.text
Size: 440KB - Virtual size: 439KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 19KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 367KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5d0076467d8f365634ffb10076526ba7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

version

setupapi

gdiplus

wintrust

crypt32

iphlpapi

wininet

urlmon

Sections

.text Size: 440KB - Virtual size: 439KB

.rdata Size: 105KB - Virtual size: 105KB

.data Size: 19KB - Virtual size: 34KB

.rsrc Size: 367KB - Virtual size: 366KB

.reloc Size: 97KB - Virtual size: 100KB

.text
Size: 440KB - Virtual size: 439KB

.rdata
Size: 105KB - Virtual size: 105KB

.data
Size: 19KB - Virtual size: 34KB

.rsrc
Size: 367KB - Virtual size: 366KB

.reloc
Size: 97KB - Virtual size: 100KB