0b7d7ab10a28dac05980b3976ac279e84164500e4f8dc1afb169ace5ca2ba556[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
0b7d7ab10a28dac05980b3976ac279e84164500e4f8dc1afb169ace5ca2ba556.exe
Size 12.9MB
Sample260528-n488csfx2x
SHA256 0b7d7ab10a28dac05980b3976ac279e84164500e4f8dc1afb169ace5ca2ba556
MD5 62bde4a7bd41a0b28ffd886e482ca659
SHA1 2351e09d29e2d05a5358e7952f30e8f85b0ad843
SHA512 eae3d7a8daf588581c9aad4975fb545f5307d423cc5b63d5065c8e6c8cac21ac5d377cee51d0d3f6b56b3dce7cc0972e9ab9df650d4271ccc6c83185698475ed
SSDEEP 393216:U0FxLfYIhU8z7zhff4E3npAdpJLc7HwnPp/Qf:Hxj3mE7P3pSpJuQnPtG
TLSH
T172D6331177D68435E1620575D66AD36B68BAFD321B32C8CBB3D50A9D4A31AC2CC39F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b7d7ab10a28dac05980b3976ac279e84164500e4f8dc1afb169ace5ca2ba556.exe

File Explorer

0b7d7ab10a28dac05980b3976ac279e84164500e4f8dc1afb169ace5ca2ba556.exe

.exe 12.9MB

0b7d7ab10a28dac05980b3976ac279e84164500e4f8dc1afb169ace5ca2ba556.exe

IMPHASH cfc06d691521b9559e22a3aec16277ff
SHA256 0b7d7ab10a28dac05980b3976ac279e84164500e4f8dc1afb169ace5ca2ba556
MD5 62bde4a7bd41a0b28ffd886e482ca659
SHA1 2351e09d29e2d05a5358e7952f30e8f85b0ad843
SHA512 eae3d7a8daf588581c9aad4975fb545f5307d423cc5b63d5065c8e6c8cac21ac5d377cee51d0d3f6b56b3dce7cc0972e9ab9df650d4271ccc6c83185698475ed
SSDEEP 393216:U0FxLfYIhU8z7zhff4E3npAdpJLc7HwnPp/Qf:Hxj3mE7P3pSpJuQnPtG
TLSH
T172D6331177D68435E1620575D66AD36B68BAFD321B32C8CBB3D50A9D4A31AC2CC39F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

511126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\968786\out\Release\Setup.pdb

kernel32

QueryPerformanceCounter QueryPerformanceFrequency lstrlenA SystemTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetFileTime GetCurrentDirectoryA PeekNamedPipe GetFullPathNameA GetDriveTypeA QueryDosDeviceW GetVolumeNameForVolumeMountPointW GetDiskFreeSpaceExW GlobalAddAtomW FindAtomW CreateEventW SetEvent GetSystemTime GetWindowsDirectoryW GetDriveTypeW GetCurrentThreadId MulDiv GetCurrentProcess FlushInstructionCache GlobalAlloc GlobalFree GetTickCount GetCommandLineW LoadLibraryExW MultiByteToWideChar lstrcmpiW FormatMessageA ExpandEnvironmentStringsA GetSystemDirectoryA VerSetConditionMask VerifyVersionInfoA FreeResource GetSystemWindowsDirectoryW lstrcmpiA lstrcmpA SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers GetLocaleInfoW WriteConsoleW LeaveCriticalSection WriteConsoleA GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA SetHandleCount GetFileType SetStdHandle GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation HeapCreate InitializeCriticalSectionAndSpinCount GetModuleFileNameA IsValidCodePage GetOEMCP GetACP GetCPInfo LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP GetStartupInfoW ExitProcess TerminateProcess GetCurrentThread CreateProcessW GlobalDeleteAtom CreateMutexW PostQueuedCompletionStatus GetLogicalDriveStringsW CreateIoCompletionPort GetQueuedCompletionStatus CreateThread TerminateThread OutputDebugStringW GetFileSizeEx CompareFileTime OpenProcess GetVolumeInformationW EnterCriticalSection GetLocalTime SetLastError lstrlenW lstrcpyW DeleteCriticalSection InitializeCriticalSection RaiseException FindFirstFileW FindNextFileW FindClose LocalAlloc CopyFileW MoveFileW MoveFileExW GetPrivateProfileStringW GlobalFindAtomW GetFileAttributesW WriteFile CreateDirectoryW GetTempPathW GetTempFileNameW WritePrivateProfileStringW SetFileAttributesW InterlockedDecrement RemoveDirectoryW DeleteFileW GetLastError GetProcessHeap HeapAlloc HeapFree GetSystemDirectoryW GlobalMemoryStatusEx GetModuleHandleA GetSystemInfo InterlockedCompareExchange Sleep GetVersionExW GetVersion GetModuleHandleW GetProcAddress InterlockedExchange ReadFile SetFilePointer GetCurrentProcessId CreateFileW DeviceIoControl LoadLibraryW InterlockedIncrement GetModuleFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle WaitForSingleObject FreeLibrary LocalFree FindResourceExW FindResourceW LoadResource LockResource IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind ExitThread TlsFree ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock SetFilePointerEx GetSystemTimeAsFileTime CreateFileA VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapSize HeapReAlloc HeapDestroy TlsAlloc LockFile GetStdHandle SetConsoleTextAttribute GetFileAttributesA GetFileInformationByHandle LocalFileTimeToFileTime DosDateTimeToFileTime TlsGetValue TlsSetValue ResetEvent ReadProcessMemory OpenMutexW GetExitCodeProcess GetLongPathNameW MapViewOfFile LockFileEx GetFileAttributesExW UnlockFile FindNextFileA FindFirstFileA GetFullPathNameW FormatMessageW SetFileTime SetEndOfFile WideCharToMultiByte UnmapViewOfFile GetFileSize CreateFileMappingW GetEnvironmentVariableW GetConsoleOutputCP SizeofResource

user32

InflateRect EnableWindow GetDlgItem IsWindowEnabled wvsprintfW PostMessageW MessageBoxW ShowWindow SetDlgItemTextW IsWindowVisible SetForegroundWindow EndDialog GetWindowLongW SetWindowTextW MoveWindow SetWindowPos GetClientRect ScreenToClient MapWindowPoints GetMonitorInfoW MonitorFromWindow GetWindowRect GetWindow GetParent GetDC UnregisterClassA ExitWindowsEx wsprintfW ReleaseDC SetWindowLongW GetWindowTextW FindWindowExW InvalidateRect RedrawWindow GetDlgCtrlID SetFocus MessageBeep GetWindowTextLengthW CreateDialogParamW SetWindowRgn SetTimer KillTimer CopyRect GetActiveWindow SendMessageW SendMessageTimeoutW FindWindowW CharNextW IsWindow DefWindowProcW CallWindowProcW BeginPaint EndPaint DialogBoxParamW EnableMenuItem DestroyWindow GetSystemMenu GetClassInfoExW LoadCursorW PostQuitMessage IsIconic SystemParametersInfoW LoadIconW RegisterClassExW CreateWindowExW LoadImageW GetSystemMetrics PtInRect GetCursorPos BringWindowToTop TrackMouseEvent GetShellWindow PostThreadMessageW UpdateLayeredWindow GetWindowThreadProcessId PeekMessageW GetMessageW TranslateMessage DispatchMessageW

gdi32

CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap SelectObject BitBlt DeleteDC SetBkColor CombineRgn CreateRectRgn SetViewportOrgEx CreateDIBSection EnumFontFamiliesW DeleteObject CreateSolidBrush

advapi32

RegOpenKeyExW ImpersonateLoggedOnUser RevertToSelf OpenProcessToken DuplicateTokenEx QueryServiceStatusEx StartServiceW ChangeServiceConfigW ControlService OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceStatus LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken ImpersonateSelf AllocateAndInitializeSid FreeSid SetSecurityInfo GetSecurityInfo GetSecurityDescriptorSacl IsValidSid CopySid RegQueryValueExW RegQueryInfoKeyW GetExplicitEntriesFromAclW GetTrusteeNameW DeleteAce LookupAccountSidW RegCreateKeyExW RegSetValueExW RegOpenKeyW RegEnumKeyExW CryptCreateHash RegDeleteValueW RegEnumValueW RegCloseKey RegDeleteKeyW GetUserNameW LookupAccountNameW GetFileSecurityW InitializeSecurityDescriptor GetSecurityDescriptorDacl GetAclInformation GetLengthSid InitializeAcl GetAce EqualSid AddAce AddAccessAllowedAce SetSecurityDescriptorDacl GetSecurityDescriptorControl SetFileSecurityW GetNamedSecurityInfoW BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW CryptHashData RegOpenKeyExA RegQueryValueExA RegQueryInfoKeyA RegEnumKeyExA RegEnumValueA GetTokenInformation CryptReleaseContext CryptGenRandom CryptAcquireContextA CryptDestroyHash CryptGetHashParam

shell32

SHCreateDirectoryExW SHGetMalloc ShellExecuteExW CommandLineToArgvW SHGetSpecialFolderPathA SHBrowseForFolderW ord680 SHGetSpecialFolderLocation ord165 SHFileOperationW SHChangeNotify ShellExecuteW SHGetSpecialFolderPathW SHGetPathFromIDListW

ole32

OleRun CoCreateGuid CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoInitialize CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CoUninitialize

oleaut32

SysAllocStringLen VarUI4FromStr VariantChangeType SysAllocStringByteLen VariantClear VariantInit SysFreeString SysStringByteLen SysAllocString SysStringLen

shlwapi

StrRetToStrW PathMatchSpecW PathRemoveExtensionW PathFindFileNameW PathAddBackslashW SHSetValueA StrTrimA StrCmpNIW StrStrIA StrCmpIW PathIsPrefixW PathIsSameRootW StrCatW StrCpyW wnsprintfW StrCmpW PathAppendA PathRemoveArgsW PathUnquoteSpacesW PathCombineA SHSetValueW PathFileExistsW SHGetValueW SHDeleteValueW PathFileExistsA SHGetValueA PathCombineW PathAppendW PathIsRelativeW SHDeleteKeyW PathFindExtensionW PathCommonPrefixW PathIsDirectoryEmptyW PathIsDirectoryW StrStrIW PathRemoveFileSpecW

comctl32

InitCommonControlsEx

crypt32

CertDeleteCertificateFromStore CertCompareCertificate CertDuplicateCertificateContext CertCloseStore CertGetNameStringW CertEnumCertificatesInStore CertOpenStore CryptStringToBinaryA CertGetCertificateChain CertFreeCertificateChainEngine CertFreeCertificateChain CertGetNameStringA CryptQueryObject CertAddCertificateContextToStore CertFindCertificateInStore CertCreateCertificateChainEngine CertFreeCertificateContext

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

psapi

GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

rpcrt4

NdrAsyncServerCall RpcBindingFree NdrClientCall2 RpcStringBindingComposeW RpcStringFreeW RpcBindingFromStringBindingW NdrAsyncClientCall NdrServerCall2

gdiplus

GdipTranslateWorldTransform GdipAddPathBezierI GdipRotateWorldTransform GdipGraphicsClear GdipAddPathArcI GdipClosePathFigure GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCreateSolidFill GdipSetSmoothingMode GdipCreateFont GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFontFamilyFromName GdipDeletePath GdipCreatePath GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipSetTextRenderingHint GdiplusStartup GdiplusShutdown GdipDrawImageRectRectI GdipDrawImagePointRectI GdipFillPath GdipDrawString GdipCloneBrush GdipRestoreGraphics GdipCreateFromHDC GdipDeleteGraphics GdipSaveGraphics GdipCloneImage GdipDrawImageRectRect GdipSetImageAttributesColorMatrix GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDisposeImageAttributes GdipCreateImageAttributes GdipAlloc GdipScaleWorldTransform GdipFree

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

setupapi

SetupIterateCabinetW

ws2_32

WSASetLastError __WSAFDIsSet select recv send WSAGetLastError closesocket