f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe
Size 15.6MB
Sample260529-e7zcwscy3m
SHA256 f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6
MD5 da94fa262346da3d8ab5dd884b71a036
SHA1 a013099c743785f14320dd5a32f63af385f582f7
SHA512 92c348cb33abf37e04cc29f139a98e5db31ef335dd1015b40a7577540a282bde8e5f9fe431cf453729280fd2b9c8f88e14da4f1791be8243e6f22b5a233583bc
SSDEEP 393216:U0FxLfYIhU8z7zhff4E3npAdpJLc7HwnPp/QgEeKlUH:Hxj3mE7P3pSpJuQnPt1H
TLSH
T136F6331177EA8831E1620671D66AD36B65BBFD321B31C4CBB3D5065D4A36A82CC39F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe

File Explorer

f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe

.exe 15.6MB

f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6.exe

IMPHASH cfc06d691521b9559e22a3aec16277ff
SHA256 f2295ae5e51c06b52d8ba6eb329f28677c40439b0794f4f1a45e3aba01d034b6
MD5 da94fa262346da3d8ab5dd884b71a036
SHA1 a013099c743785f14320dd5a32f63af385f582f7
SHA512 92c348cb33abf37e04cc29f139a98e5db31ef335dd1015b40a7577540a282bde8e5f9fe431cf453729280fd2b9c8f88e14da4f1791be8243e6f22b5a233583bc
SSDEEP 393216:U0FxLfYIhU8z7zhff4E3npAdpJLc7HwnPp/QgEeKlUH:Hxj3mE7P3pSpJuQnPt1H
TLSH
T136F6331177EA8831E1620671D66AD36B65BBFD321B31C4CBB3D5065D4A36A82CC39F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

511126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\968786\out\Release\Setup.pdb

kernel32

QueryPerformanceCounter QueryPerformanceFrequency lstrlenA SystemTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetFileTime GetCurrentDirectoryA PeekNamedPipe GetFullPathNameA GetDriveTypeA QueryDosDeviceW GetVolumeNameForVolumeMountPointW GetDiskFreeSpaceExW GlobalAddAtomW FindAtomW CreateEventW SetEvent GetSystemTime GetWindowsDirectoryW GetDriveTypeW GetCurrentThreadId MulDiv GetCurrentProcess FlushInstructionCache GlobalAlloc GlobalFree GetTickCount GetCommandLineW LoadLibraryExW MultiByteToWideChar lstrcmpiW FormatMessageA ExpandEnvironmentStringsA GetSystemDirectoryA VerSetConditionMask VerifyVersionInfoA FreeResource GetSystemWindowsDirectoryW lstrcmpiA lstrcmpA SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers GetLocaleInfoW WriteConsoleW LeaveCriticalSection WriteConsoleA GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA SetHandleCount GetFileType SetStdHandle GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation HeapCreate InitializeCriticalSectionAndSpinCount GetModuleFileNameA IsValidCodePage GetOEMCP GetACP GetCPInfo LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP GetStartupInfoW ExitProcess TerminateProcess GetCurrentThread CreateProcessW GlobalDeleteAtom CreateMutexW PostQueuedCompletionStatus GetLogicalDriveStringsW CreateIoCompletionPort GetQueuedCompletionStatus CreateThread TerminateThread OutputDebugStringW GetFileSizeEx CompareFileTime OpenProcess GetVolumeInformationW EnterCriticalSection GetLocalTime SetLastError lstrlenW lstrcpyW DeleteCriticalSection InitializeCriticalSection RaiseException FindFirstFileW FindNextFileW FindClose LocalAlloc CopyFileW MoveFileW MoveFileExW GetPrivateProfileStringW GlobalFindAtomW GetFileAttributesW WriteFile CreateDirectoryW GetTempPathW GetTempFileNameW WritePrivateProfileStringW SetFileAttributesW InterlockedDecrement RemoveDirectoryW DeleteFileW GetLastError GetProcessHeap HeapAlloc HeapFree GetSystemDirectoryW GlobalMemoryStatusEx GetModuleHandleA GetSystemInfo InterlockedCompareExchange Sleep GetVersionExW GetVersion GetModuleHandleW GetProcAddress InterlockedExchange ReadFile SetFilePointer GetCurrentProcessId CreateFileW DeviceIoControl LoadLibraryW InterlockedIncrement GetModuleFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle WaitForSingleObject FreeLibrary LocalFree FindResourceExW FindResourceW LoadResource LockResource IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind ExitThread TlsFree ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock SetFilePointerEx GetSystemTimeAsFileTime CreateFileA VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapSize HeapReAlloc HeapDestroy TlsAlloc LockFile GetStdHandle SetConsoleTextAttribute GetFileAttributesA GetFileInformationByHandle LocalFileTimeToFileTime DosDateTimeToFileTime TlsGetValue TlsSetValue ResetEvent ReadProcessMemory OpenMutexW GetExitCodeProcess GetLongPathNameW MapViewOfFile LockFileEx GetFileAttributesExW UnlockFile FindNextFileA FindFirstFileA GetFullPathNameW FormatMessageW SetFileTime SetEndOfFile WideCharToMultiByte UnmapViewOfFile GetFileSize CreateFileMappingW GetEnvironmentVariableW GetConsoleOutputCP SizeofResource

user32

InflateRect EnableWindow GetDlgItem IsWindowEnabled wvsprintfW PostMessageW MessageBoxW ShowWindow SetDlgItemTextW IsWindowVisible SetForegroundWindow EndDialog GetWindowLongW SetWindowTextW MoveWindow SetWindowPos GetClientRect ScreenToClient MapWindowPoints GetMonitorInfoW MonitorFromWindow GetWindowRect GetWindow GetParent GetDC UnregisterClassA ExitWindowsEx wsprintfW ReleaseDC SetWindowLongW GetWindowTextW FindWindowExW InvalidateRect RedrawWindow GetDlgCtrlID SetFocus MessageBeep GetWindowTextLengthW CreateDialogParamW SetWindowRgn SetTimer KillTimer CopyRect GetActiveWindow SendMessageW SendMessageTimeoutW FindWindowW CharNextW IsWindow DefWindowProcW CallWindowProcW BeginPaint EndPaint DialogBoxParamW EnableMenuItem DestroyWindow GetSystemMenu GetClassInfoExW LoadCursorW PostQuitMessage IsIconic SystemParametersInfoW LoadIconW RegisterClassExW CreateWindowExW LoadImageW GetSystemMetrics PtInRect GetCursorPos BringWindowToTop TrackMouseEvent GetShellWindow PostThreadMessageW UpdateLayeredWindow GetWindowThreadProcessId PeekMessageW GetMessageW TranslateMessage DispatchMessageW

gdi32

CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap SelectObject BitBlt DeleteDC SetBkColor CombineRgn CreateRectRgn SetViewportOrgEx CreateDIBSection EnumFontFamiliesW DeleteObject CreateSolidBrush

advapi32

RegOpenKeyExW ImpersonateLoggedOnUser RevertToSelf OpenProcessToken DuplicateTokenEx QueryServiceStatusEx StartServiceW ChangeServiceConfigW ControlService OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceStatus LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken ImpersonateSelf AllocateAndInitializeSid FreeSid SetSecurityInfo GetSecurityInfo GetSecurityDescriptorSacl IsValidSid CopySid RegQueryValueExW RegQueryInfoKeyW GetExplicitEntriesFromAclW GetTrusteeNameW DeleteAce LookupAccountSidW RegCreateKeyExW RegSetValueExW RegOpenKeyW RegEnumKeyExW CryptCreateHash RegDeleteValueW RegEnumValueW RegCloseKey RegDeleteKeyW GetUserNameW LookupAccountNameW GetFileSecurityW InitializeSecurityDescriptor GetSecurityDescriptorDacl GetAclInformation GetLengthSid InitializeAcl GetAce EqualSid AddAce AddAccessAllowedAce SetSecurityDescriptorDacl GetSecurityDescriptorControl SetFileSecurityW GetNamedSecurityInfoW BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW CryptHashData RegOpenKeyExA RegQueryValueExA RegQueryInfoKeyA RegEnumKeyExA RegEnumValueA GetTokenInformation CryptReleaseContext CryptGenRandom CryptAcquireContextA CryptDestroyHash CryptGetHashParam

shell32

SHCreateDirectoryExW SHGetMalloc ShellExecuteExW CommandLineToArgvW SHGetSpecialFolderPathA SHBrowseForFolderW ord680 SHGetSpecialFolderLocation ord165 SHFileOperationW SHChangeNotify ShellExecuteW SHGetSpecialFolderPathW SHGetPathFromIDListW

ole32

OleRun CoCreateGuid CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoInitialize CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CoUninitialize

oleaut32

SysAllocStringLen VarUI4FromStr VariantChangeType SysAllocStringByteLen VariantClear VariantInit SysFreeString SysStringByteLen SysAllocString SysStringLen

shlwapi

StrRetToStrW PathMatchSpecW PathRemoveExtensionW PathFindFileNameW PathAddBackslashW SHSetValueA StrTrimA StrCmpNIW StrStrIA StrCmpIW PathIsPrefixW PathIsSameRootW StrCatW StrCpyW wnsprintfW StrCmpW PathAppendA PathRemoveArgsW PathUnquoteSpacesW PathCombineA SHSetValueW PathFileExistsW SHGetValueW SHDeleteValueW PathFileExistsA SHGetValueA PathCombineW PathAppendW PathIsRelativeW SHDeleteKeyW PathFindExtensionW PathCommonPrefixW PathIsDirectoryEmptyW PathIsDirectoryW StrStrIW PathRemoveFileSpecW

comctl32

InitCommonControlsEx

crypt32

CertDeleteCertificateFromStore CertCompareCertificate CertDuplicateCertificateContext CertCloseStore CertGetNameStringW CertEnumCertificatesInStore CertOpenStore CryptStringToBinaryA CertGetCertificateChain CertFreeCertificateChainEngine CertFreeCertificateChain CertGetNameStringA CryptQueryObject CertAddCertificateContextToStore CertFindCertificateInStore CertCreateCertificateChainEngine CertFreeCertificateContext

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

psapi

GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

rpcrt4

NdrAsyncServerCall RpcBindingFree NdrClientCall2 RpcStringBindingComposeW RpcStringFreeW RpcBindingFromStringBindingW NdrAsyncClientCall NdrServerCall2

gdiplus

GdipTranslateWorldTransform GdipAddPathBezierI GdipRotateWorldTransform GdipGraphicsClear GdipAddPathArcI GdipClosePathFigure GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCreateSolidFill GdipSetSmoothingMode GdipCreateFont GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFontFamilyFromName GdipDeletePath GdipCreatePath GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipSetTextRenderingHint GdiplusStartup GdiplusShutdown GdipDrawImageRectRectI GdipDrawImagePointRectI GdipFillPath GdipDrawString GdipCloneBrush GdipRestoreGraphics GdipCreateFromHDC GdipDeleteGraphics GdipSaveGraphics GdipCloneImage GdipDrawImageRectRect GdipSetImageAttributesColorMatrix GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDisposeImageAttributes GdipCreateImageAttributes GdipAlloc GdipScaleWorldTransform GdipFree

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

setupapi

SetupIterateCabinetW

ws2_32

WSASetLastError __WSAFDIsSet select recv send WSAGetLastError closesocket