b9b2a504ac888ef7eda2793b1dbfa65009f4647b1ac535a1e56b193d85c972ce

Sharing

Copy URL

Twitter E-mail

General

Target

b9b2a504ac888ef7eda2793b1dbfa65009f4647b1ac535a1e56b193d85c972ce
Size

1.2MB
MD5

d138b4baea2c559f76c78958d9874934
SHA1

55434115a44e8e890d6b5936bf656c2c67d6e8f2
SHA256

b9b2a504ac888ef7eda2793b1dbfa65009f4647b1ac535a1e56b193d85c972ce
SHA512

7a998eaff4b3b67a8d0154b5efcb2b21b95073648676b7e6b0713645c82d58a8bd8be8282e862c2d00b2d831217b691854bc184e694210825b867c11080efbe9
SSDEEP

24576:L9w+/edKSSdBrTwHfKxWLzK54KNMBt4osFeBXO0J49i:L9BNpwHfBLz0MBKeBX/5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9b2a504ac888ef7eda2793b1dbfa65009f4647b1ac535a1e56b193d85c972ce

Files

b9b2a504ac888ef7eda2793b1dbfa65009f4647b1ac535a1e56b193d85c972ce
.exe windows:5 windows x86 arch:x86

3b7b95445800f491c9135128c82b103b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\612914\out\Release\360speedldEx.pdb

Imports

kernel32

CreateMutexW
GetProcessAffinityMask
SetProcessAffinityMask
GetVersion
TerminateProcess
GetSystemDirectoryA
InterlockedExchange
LoadLibraryA
DeviceIoControl
GlobalMemoryStatusEx
GetSystemInfo
GetThreadLocale
SetThreadLocale
WriteFile
GetModuleFileNameA
OutputDebugStringW
GetTempPathW
GetUserDefaultLangID
LocalAlloc
GetModuleHandleExW
InterlockedExchangeAdd
SetEnvironmentVariableA
CompareStringA
GetDriveTypeA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringW
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
GetStringTypeW
SetErrorMode
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapCreate
GetStartupInfoA
GetFileType
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStdHandle
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetACP
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
CreateDirectoryW
FindFirstFileW
GetDriveTypeW
FindClose
ExitProcess
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
TlsGetValue
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
lstrcmpiW
GetCommandLineW
VirtualProtect
GetModuleHandleA
GetFileSize
GetFileAttributesExW
GlobalUnlock
GlobalLock
lstrcpynW
lstrcpyW
InterlockedIncrement
InterlockedDecrement
CreateEventW
SetEvent
ResetEvent
lstrlenA
SetLastError
RaiseException
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcessId
MultiByteToWideChar
GetLastError
MulDiv
SetFilePointer
ReadFile
GetFileSizeEx
CreateFileW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetVersionExW
GetSystemWindowsDirectoryW
GetCurrentProcess
GetWindowsDirectoryW
LoadLibraryExW
GetSystemDirectoryW
CreateProcessW
GetStartupInfoW
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSection
FreeResource
GlobalAlloc
GlobalFree
GetModuleHandleW
ExpandEnvironmentStringsW
LoadLibraryW
EnterCriticalSection
GetProcAddress
LeaveCriticalSection
lstrlenW
GetModuleFileNameW
WaitForSingleObject
CloseHandle
GetTickCount
FileTimeToLocalFileTime
FileTimeToSystemTime
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetEnvironmentVariableW
InterlockedCompareExchange
Sleep
FreeLibrary
GetStringTypeA

user32

SetCursor
GetDC
UnregisterClassA
ReleaseDC
SetWindowTextW
LoadCursorW
GetActiveWindow
DisableProcessWindowsGhosting
EnableWindow
MessageBoxW
LoadImageW
DrawIconEx
SetFocus
GetDlgItem
GetDlgCtrlID
GetKeyState
CloseWindow
UpdateLayeredWindow
CharNextW
PrintWindow
DestroyIcon
MonitorFromPoint
DestroyMenu
AppendMenuW
TrackPopupMenu
CreatePopupMenu
GetAsyncKeyState
TrackMouseEvent
LoadIconW
ShowWindow
PostQuitMessage
MoveWindow
SetForegroundWindow
SetWindowPos
SetLayeredWindowAttributes
CopyRect
GetMonitorInfoW
MonitorFromWindow
RegisterWindowMessageW
DrawTextW
BeginPaint
EndPaint
RedrawWindow
GetCursorPos
MapWindowPoints
WindowFromPoint
SetTimer
KillTimer
GetSystemMetrics
GetCapture
SetCapture
ReleaseCapture
IntersectRect
GetClassLongW
FillRect
InvalidateRect
UpdateWindow
GetClientRect
PtInRect
PostMessageW
CreateWindowExW
GetClassInfoExW
RegisterClassExW
SendMessageW
DestroyWindow
CallWindowProcW
DefWindowProcW
SetWindowLongW
GetParent
OffsetRect
ScreenToClient
GetWindowDC
IsWindowVisible
GetWindowLongW
SystemParametersInfoW
SetRectEmpty
GetWindowRect
IsWindow

gdi32

GetStockObject
EnumFontFamiliesExW
CreateFontIndirectW
CreateDIBSection
ExtTextOutW
SetDIBits
GetObjectA
SetStretchBltMode
StretchBlt
IntersectClipRect
GetClipBox
OffsetViewportOrgEx
ExcludeClipRect
SetViewportOrgEx
GetDeviceCaps
CreateDCW
GetDIBits
BitBlt
SetBkMode
GetTextColor
SetEnhMetaFileBits
GetEnhMetaFileHeader
PlayEnhMetaFile
DeleteEnhMetaFile
CreateCompatibleBitmap
GetObjectW
TextOutW
SelectObject
SetTextColor
DeleteObject
DeleteDC
CreateCompatibleDC
GetTextExtentPoint32W
SetBkColor
SetDIBColorTable

advapi32

CreateProcessAsUserW
SaferComputeTokenFromLevel
SaferCreateLevel
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
SaferCloseLevel
RegQueryValueExA

shell32

SHCreateDirectoryExW
Shell_NotifyIconW
ord680
SHGetFolderPathW
ShellExecuteW

ole32

CoInitializeSecurity
CoTaskMemAlloc
CreateStreamOnHGlobal
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemRealloc

oleaut32

SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VarUI4FromStr
VariantClear
SystemTimeToVariantTime
VariantTimeToSystemTime

shlwapi

PathCanonicalizeW
StrCmpNIW
SHSetValueW
SHGetValueW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
PathCombineW
PathQuoteSpacesW
PathAddBackslashW
StrStrIA
StrStrW
PathIsRelativeW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

imm32

ImmDisableIME

Exports

Exports

??0ShellResourceRequestDetails@@QAE@XZ
??1ShellResourceRequestDetails@@QAE@XZ
??4ShellResourceRequestDetails@@QAEAAU0@ABU0@@Z

Sections

.text
Size: 620KB - Virtual size: 620KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 18KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 45B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 347KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 126KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3b7b95445800f491c9135128c82b103b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

imm32

Exports

Exports

Sections

.text Size: 620KB - Virtual size: 620KB

.rdata Size: 119KB - Virtual size: 118KB

.data Size: 18KB - Virtual size: 42KB

.tls Size: 512B - Virtual size: 45B

.rsrc Size: 347KB - Virtual size: 347KB

.reloc Size: 126KB - Virtual size: 128KB

.text
Size: 620KB - Virtual size: 620KB

.rdata
Size: 119KB - Virtual size: 118KB

.data
Size: 18KB - Virtual size: 42KB

.tls
Size: 512B - Virtual size: 45B

.rsrc
Size: 347KB - Virtual size: 347KB

.reloc
Size: 126KB - Virtual size: 128KB