84b209c3fd53ecee6344116f61f9b8e3c6333520b5805c1fe638034c87da9a8f

Sharing

Copy URL

Twitter E-mail

General

Target

84b209c3fd53ecee6344116f61f9b8e3c6333520b5805c1fe638034c87da9a8f
Size

1.3MB
MD5

a557975b9bc4b3726468a6b3cf6d4e12
SHA1

637f82035027367dcd7b414dc9ffc594b277c23b
SHA256

84b209c3fd53ecee6344116f61f9b8e3c6333520b5805c1fe638034c87da9a8f
SHA512

aaffec2a5e939d0fbf59d58a05c4891443fe4a9818946eb6fea0fe2231b7211a9020fbe6eedcc43389fc3b8b81c30fdfe2e0c6cd1a55f4d7c4c90173179b30db
SSDEEP

24576:1nIpp65ZouNDaKdDPhoH5Xlpoyt5qqnniyzVM894:WppARbDPhoGyt5qqnG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84b209c3fd53ecee6344116f61f9b8e3c6333520b5805c1fe638034c87da9a8f

Files

84b209c3fd53ecee6344116f61f9b8e3c6333520b5805c1fe638034c87da9a8f
.exe windows:5 windows x86 arch:x86

f9c7e1861613deef22cc2285a58c0a27

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\705277\out\Release\360Safe.pdb

Imports

kernel32

CreateMutexW
ReleaseMutex
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetLongPathNameW
GetShortPathNameW
GlobalFree
WaitForMultipleObjects
GlobalAddAtomW
DeleteFileW
SystemTimeToFileTime
GetTempFileNameW
GetTempPathW
CopyFileW
CreateDirectoryW
FreeResource
GetFileAttributesExW
GetSystemWindowsDirectoryW
ResetEvent
FindClose
FindNextFileW
FindFirstFileW
MoveFileExW
SetFileAttributesW
RemoveDirectoryW
GetFileAttributesW
GetDriveTypeW
GetLogicalDriveStringsW
MapViewOfFileEx
CreateFileMappingW
UnmapViewOfFile
CreateRemoteThread
LoadLibraryA
OpenMutexW
WTSGetActiveConsoleSessionId
GetComputerNameW
GetVersion
lstrcmpA
OutputDebugStringW
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
DeviceIoControl
SetHandleCount
GetFileType
SetStdHandle
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
GetStdHandle
HeapCreate
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetDateFormatA
GetTimeFormatA
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
MoveFileW
IsDebuggerPresent
UnhandledExceptionFilter
CreateThread
ExitThread
ExitProcess
RtlUnwind
TlsFree
TlsAlloc
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
TlsGetValue
SetFilePointerEx
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
CreateFileA
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
ProcessIdToSessionId
GlobalAlloc
GlobalUnlock
GlobalLock
lstrlenA
GetVersionExW
SetUnhandledExceptionFilter
GetTickCount
GlobalFindAtomW
GlobalDeleteAtom
GetStartupInfoW
CreateProcessW
GetProcessTimes
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocalTime
GetCurrentProcessId
ReadFile
GetFileSizeEx
SetFilePointer
SetEndOfFile
WideCharToMultiByte
GetFileSize
SetEvent
WaitForSingleObject
CreateEventW
InterlockedCompareExchange
Sleep
CreateFileW
LoadLibraryW
FlushInstructionCache
SetLastError
GetPrivateProfileIntW
LocalFree
OpenProcess
GetPrivateProfileStringW
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
InitializeCriticalSection
GetLastError
lstrlenW
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
FindResourceExW
FreeLibrary
LoadResource
LockResource
SizeofResource
FindResourceW
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetCurrentThreadId
SetEnvironmentVariableW
GetSystemDirectoryW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
CloseHandle
GetModuleFileNameW
VirtualProtect
GetModuleHandleA
GetCommandLineW
TerminateProcess
GetProcAddress
IsWow64Process
WriteFile
GetCurrentProcess
GetModuleHandleW
GetStartupInfoA

user32

DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
CharNextW
FindWindowW
ReleaseDC
GetDC
GetWindowThreadProcessId
IsWindow
WaitForInputIdle
SendMessageTimeoutW
UnregisterClassA
SetWindowLongW
MessageBoxW
GetActiveWindow
GetClassInfoExW
LoadCursorW
RegisterClassExW
ShowWindow
DialogBoxParamW
EndDialog
DestroyWindow
GetWindowLongW
SetWindowPos
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
DefWindowProcW
AllowSetForegroundWindow
LoadStringW
EndPaint
BeginPaint
wsprintfW
InvalidateRect
SetCursor
IntersectRect
IsIconic
GetWindow
GetParent
CopyRect
RedrawWindow
SetWindowTextW
ReplyMessage
GetSystemMetrics
CreateWindowExW
GetCursorPos
ClientToScreen
CallWindowProcW
MoveWindow
IsWindowVisible
SetTimer
SetForegroundWindow
BringWindowToTop
SetActiveWindow
OpenClipboard
KillTimer
PtInRect
OffsetRect
RegisterWindowMessageW
SendMessageW
FindWindowExW
PostMessageW
RegisterClassW
GetClassInfoW
IsWindowEnabled
CreateDialogParamW
ScreenToClient
EnableWindow
GetDesktopWindow
SetRect
DisableProcessWindowsGhosting
PostQuitMessage
SetLayeredWindowAttributes
SetRectEmpty
InflateRect
SubtractRect
CloseClipboard
EmptyClipboard
SetClipboardData
LoadImageW

gdi32

GetTextExtentPoint32W
DeleteDC
DeleteObject
CreateCompatibleDC
BitBlt
SetViewportOrgEx
CreateCompatibleBitmap
SelectObject

advapi32

CryptGenRandom
GetTokenInformation
OpenProcessToken
CryptReleaseContext
CryptAcquireContextW
LookupPrivilegeValueW
AdjustTokenPrivileges
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
RegUnLoadKeyW
RegLoadKeyW
RegEnumValueW
DuplicateTokenEx
GetLengthSid
SetTokenInformation
LookupAccountSidW
RegCreateKeyA
ConvertStringSidToSidW
AllocateAndInitializeSid
EqualSid
FreeSid
SaferCreateLevel
SaferComputeTokenFromLevel
CreateProcessAsUserW
SaferCloseLevel
QueryServiceStatus
OpenSCManagerW
OpenServiceW
StartServiceW
ChangeServiceConfigW
ControlService
CloseServiceHandle
RegOpenKeyW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueExA

shell32

SHGetFolderPathW
SHChangeNotify
CommandLineToArgvW
ord165
SHCreateDirectoryExW
SHAppBarMessage
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW

ole32

CoInitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateGuid
CoUninitialize
CreateStreamOnHGlobal

oleaut32

VariantChangeType
SysStringLen
VariantCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayRedim
SafeArrayDestroy
SafeArrayCreate
SafeArrayGetUBound
VarUI4FromStr
VariantInit
SysAllocString
VariantClear
SysFreeString
DispCallFunc
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
SafeArrayCopy
SafeArrayGetVartype
SafeArrayGetLBound

shlwapi

StrCmpIW
SHDeleteKeyW
SHDeleteValueW
PathIsDirectoryW
PathFindExtensionW
PathCanonicalizeW
PathFindFileNameA
SHGetValueA
SHSetValueA
PathRemoveExtensionW
PathIsRootW
StrStrIA
PathFindFileNameW
SHSetValueW
StrStrIW
SHGetValueW
PathAppendW
PathAddBackslashW
PathFileExistsW
PathCombineW
PathRemoveFileSpecW
PathIsRelativeW
StrCmpNIW

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

gdiplus

GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipAlloc
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI
GdipDeleteCachedBitmap
GdipCreateCachedBitmap
GdipRestoreGraphics
GdipSaveGraphics
GdipDrawImageI
GdipCreateBitmapFromScan0
GdipDrawImageRectRect
GdipDrawImageRectI
GdipFillRectangleI
GdipSetSmoothingMode
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateFromHDC
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCloneImage
GdipDisposeImage
GdipFree

crypt32

CertGetNameStringW
CryptDecodeObject
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CryptBinaryToStringA
CryptStringToBinaryA

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

rpcrt4

RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcAsyncInitializeHandle
NdrClientCall2
NdrAsyncClientCall
RpcBindingFree
RpcAsyncCompleteCall
RpcStringFreeW

psapi

GetModuleFileNameExW

iphlpapi

GetAdaptersInfo
NotifyAddrChange
GetIpAddrTable

ws2_32

ntohl
htons
ntohs
htonl
inet_addr
WSACreateEvent
WSAResetEvent
WSACloseEvent

wininet

InternetOpenW
InternetOpenUrlW
InternetReadFile
HttpQueryInfoW
InternetCloseHandle

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
ExpandEnvironmentStringsForUserW

ntdll

RtlCreateHeap
ZwAllocateVirtualMemory
ZwProtectVirtualMemory
NtDelayExecution
RtlAllocateHeap
RtlReAllocateHeap
ZwFreeVirtualMemory
ZwQueryVirtualMemory
RtlDestroyHeap
ZwQuerySystemInformation

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 36KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 106KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f9c7e1861613deef22cc2285a58c0a27

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

version

gdiplus

crypt32

wintrust

rpcrt4

psapi

iphlpapi

ws2_32

wininet

wtsapi32

userenv

ntdll

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 132KB - Virtual size: 132KB

.data Size: 36KB - Virtual size: 59KB

.rsrc Size: 60KB - Virtual size: 59KB

.reloc Size: 106KB - Virtual size: 108KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 132KB - Virtual size: 132KB

.data
Size: 36KB - Virtual size: 59KB

.rsrc
Size: 60KB - Virtual size: 59KB

.reloc
Size: 106KB - Virtual size: 108KB