0817b5a27591fe15af291f55da9cb79923769a4cd8775e93e157ce577b995213

Sharing

Copy URL Twitter E-mail

General

Target
0817b5a27591fe15af291f55da9cb79923769a4cd8775e93e157ce577b995213
Size 4.8MB
Sample260417-sdnaesas2m
SHA256 0817b5a27591fe15af291f55da9cb79923769a4cd8775e93e157ce577b995213
MD5 b339a6cfc66e42e27835ea4c63dfafad
SHA1 374199aa48a98f7b33192c6558724f1d5cc569c1
SHA512 05e5aea6952f0b3597dbbe518e8e0dfe903bea637bd4f9440c8389f7fbb74e81281470f652c07a06049c9b831a24f6a866c883bcb3fb4f12a98bb32d08e3e0a9
SSDEEP 98304:W81A5KgkioGv57/uyVYCjKo48Fa7tGfmyMIS8o:WZKkv57/3Dj7H9S8o
TLSH
T1F236CE12FF4281B2E9D2023451FA9B7F4C3D9E14873489C3D7D4296A8D316D26A3F7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0817b5a27591fe15af291f55da9cb79923769a4cd8775e93e157ce577b995213

File Explorer

0817b5a27591fe15af291f55da9cb79923769a4cd8775e93e157ce577b995213

.exe 4.8MB

0817b5a27591fe15af291f55da9cb79923769a4cd8775e93e157ce577b995213

IMPHASH cb05f6d5dae186cdb0c471e4eaedf552
SHA256 0817b5a27591fe15af291f55da9cb79923769a4cd8775e93e157ce577b995213
MD5 b339a6cfc66e42e27835ea4c63dfafad
SHA1 374199aa48a98f7b33192c6558724f1d5cc569c1
SHA512 05e5aea6952f0b3597dbbe518e8e0dfe903bea637bd4f9440c8389f7fbb74e81281470f652c07a06049c9b831a24f6a866c883bcb3fb4f12a98bb32d08e3e0a9
SSDEEP 98304:W81A5KgkioGv57/uyVYCjKo48Fa7tGfmyMIS8o:WZKkv57/3Dj7H9S8o
TLSH
T1F236CE12FF4281B2E9D2023451FA9B7F4C3D9E14873489C3D7D4296A8D316D26A3F7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3196286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\872187\out\Release\SodaDownloader.pdb

crypt32

CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertEnumCertificatesInStore CertFreeCertificateContext CertGetCertificateContextProperty CertFindCertificateInStore CertCloseStore CryptStringToBinaryA CertOpenSystemStoreW CertDuplicateCertificateContext

kernel32

GlobalSize GlobalLock GlobalUnlock SetThreadLocale SystemTimeToTzSpecificLocalTime SystemTimeToFileTime FileTimeToSystemTime GetModuleHandleA GetTempPathW InterlockedIncrement InterlockedDecrement GetCommandLineW CopyFileW CreateDirectoryW MoveFileW QueryPerformanceFrequency GetSystemDirectoryA SleepEx FormatMessageW MoveFileExA CompareFileTime GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe VerSetConditionMask VerifyVersionInfoW GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW TlsAlloc TlsGetValue TlsSetValue TlsFree CreateIoCompletionPort SwitchToFiber DeleteFiber CreateFiberEx GetSystemTime FormatMessageA TryEnterCriticalSection CreateSemaphoreA GetACP ConvertFiberToThread TerminateThread InterlockedExchange lstrlenA GetModuleHandleExW lstrcmpiW lstrcmpA lstrlenW MoveFileExW DeleteFileW SetFileAttributesW GetDriveTypeW WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage SetEndOfFile GetFullPathNameW SetStdHandle IsValidLocale GetConsoleCP SetConsoleCtrlHandler ExitProcess ExitThread RtlUnwind QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList FreeLibraryAndExitThread GetCurrentThread GetProcessAffinityMask ChangeTimerQueueTimer GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue GetSystemWindowsDirectoryW FreeResource GlobalAlloc SetFilePointerEx GetFileSize InterlockedCompareExchange GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW SetFilePointer WriteFile SizeofResource LoadResource GetProcessHeap HeapDestroy LockResource DeviceIoControl DeleteCriticalSection InitializeCriticalSection EnumSystemLocalesW GetUserDefaultLCID GetThreadLocale GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetTimeFormatW GetDateFormatW GetTimeZoneInformation UnregisterWait RegisterWaitForSingleObject MulDiv SetThreadAffinityMask ConvertThreadToFiber LocalFree GlobalFree GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteTimerQueueTimer CreateTimerQueueTimer UnregisterWaitEx UnmapViewOfFile lstrcmpiA InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentDirectoryW SetFileTime HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime GetCPInfo IsDebuggerPresent ReadFile GetFileSizeEx FindNextFileW ExpandEnvironmentStringsW FindClose MapViewOfFileEx Process32NextW Process32FirstW CreateToolhelp32Snapshot FlushFileBuffers PostQueuedCompletionStatus MapViewOfFile CreateFileMappingW VirtualQuery VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetVersionExW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo IsProcessorFeaturePresent GetThreadTimes GetExitCodeThread GetCurrentThreadId CreateThread SwitchToThread TerminateProcess GetCurrentProcessId GetCurrentProcess WaitForMultipleObjects Sleep CreateEventW CreateEventA CreateMutexW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetQueuedCompletionStatus HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetErrorMode SetLastError GetLastError RaiseException AreFileApisANSI GetLongPathNameW GetFileAttributesW FindFirstFileW CreateFileW

user32

PtInRect LoadCursorW SetCursor IntersectRect UnionRect EqualRect SetClipboardData EmptyClipboard GetAsyncKeyState ClientToScreen GetSysColor GetDesktopWindow DrawTextW MonitorFromWindow LoadImageW GetWindowThreadProcessId BringWindowToTop SetActiveWindow GetForegroundWindow SetForegroundWindow wsprintfW IsRectEmpty OffsetRect ScreenToClient GetCursorPos InvalidateRect SetWindowRgn GetUpdateRect EndPaint BeginPaint ReleaseCapture SetCapture GetKeyState GetFocus IsZoomed MoveWindow CallWindowProcW MessageBoxW SetWindowPos MonitorFromPoint RegisterClassExW IsWindowVisible OpenClipboard CloseClipboard FindWindowW SetWindowLongW GetWindowLongW MapWindowPoints ReleaseDC GetClipboardData IsClipboardFormatAvailable CharNextW PeekMessageW KillTimer GetClientRect GetWindowRect GetParent GetWindow GetMonitorInfoW SetFocus EnableWindow SetWindowTextW GetProcessWindowStation IsIconic GetUserObjectInformationW GetMessageW TranslateMessage DispatchMessageW IsWindow ShowWindow SendMessageTimeoutW SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow UpdateLayeredWindow SetTimer GetSystemMetrics GetDC AttachThreadInput

gdi32

GetObjectA CreateDIBSection SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor SelectObject DeleteDC CreateCompatibleDC ExtSelectClipRgn GetDeviceCaps SaveDC CreateFontIndirectW DeleteObject GetStockObject GetObjectW BitBlt CreateRoundRectRgn CreateRectRgnIndirect GetWindowOrgEx RestoreDC SetWindowOrgEx

advapi32

CryptCreateHash CryptEnumProvidersW CryptSignHashW CryptGetUserKey CryptGetProvParam CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource CryptAcquireContextA RegQueryInfoKeyW RegEnumKeyExW RegEnumKeyExA RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetHashParam CryptExportKey CryptDecrypt CryptHashData CryptDestroyHash RegOpenKeyW CloseServiceHandle EnumServicesStatusW OpenSCManagerW OpenProcessToken

shell32

ShellExecuteExW ShellExecuteW SHGetSpecialFolderPathW CommandLineToArgvW ord165 SHGetFolderPathW

ole32

CreateStreamOnHGlobal CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoCreateGuid CoTaskMemRealloc OleInitialize OleUninitialize CoUninitialize CoInitialize CoInitializeEx

oleaut32

SysAllocString LoadRegTypeLi LoadTypeLi SysStringLen VarUI4FromStr VariantInit SysFreeString

shlwapi

SHGetValueA SHSetValueA StrTrimA PathIsRelativeW SHGetValueW PathFileExistsW PathAppendW StrStrIA PathRemoveBackslashW PathIsPrefixW PathCanonicalizeW ord176 PathRemoveFileSpecW StrStrIW StrCmpNIW StrCmpIW PathFindFileNameW PathCombineW

ws2_32

closesocket WSAGetLastError ntohs WSAStartup WSAWaitForMultipleEvents WSACleanup htons bind connect getpeername getsockname recv setsockopt socket accept htonl listen recvfrom sendto ioctlsocket gethostname __WSAFDIsSet select WSASetLastError getaddrinfo freeaddrinfo getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport getservbyname shutdown

version

VerQueryValueW

psapi

GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmDisableIME ImmSetCompositionWindow ImmReleaseContext ImmGetContext

wininet

InternetCrackUrlW InternetOpenW InternetSetOptionW InternetConnectW HttpOpenRequestW HttpQueryInfoW HttpSendRequestW InternetCloseHandle

wldap32

ord45 ord60 ord211 ord50 ord46 ord217 ord143 ord41 ord22 ord26 ord27 ord32 ord301 ord200 ord30 ord79 ord35 ord33

gdiplus

GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawImageRectRectI GdipFillPath GdipFillEllipse GdipDrawPath GdipDrawEllipse GdipDrawRectangleI GdipDrawLineI GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetWorldTransform GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipSetPixelOffsetMode GdipFillRegion GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipImageSelectActiveFrame

msimg32

AlphaBlend

generic

count=33, id=241, version=40116,

count=192, id=243, version=40116,

count=36, id=242, version=40116,

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=10, id=199, version=41118,

count=28, id=259, version=26706,

count=38, id=261, version=27051,

count=3, id=261, version=27045,

count=10, id=260, version=27045,

count=38, id=260, version=26706,

count=131, id=261, version=26706,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, productName=Unmarked objects (old),

count=839, id=260, version=30154,

count=124, id=260, version=30157,

count=57, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=860, id=1, productName=Unmarked objects,

count=1, id=261, version=34123,

count=1, id=260, version=27048,

count=34, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,