6cb6f2cf56440ee2c788bef3f5e27a1b40f108e0059f119837be23eb863499e2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6cb6f2cf56440ee2c788bef3f5e27a1b40f108e0059f119837be23eb863499e2.exe
Size 11.0MB
Sample260529-e8b9racy3r
SHA256 6cb6f2cf56440ee2c788bef3f5e27a1b40f108e0059f119837be23eb863499e2
MD5 339fa647efce4b752107dd0fa17b78d0
SHA1 0d8ecc906273de3b484cdcc0de4091c6c23e2ae7
SHA512 5207ecff7d495fa8a3cbf4ef6bdadfe4e511d6cc3ed1cebfbeabf429dc65c675a7488ae5f7923c110c374196b30b947a7d391bdea31c1f454fe9eabfb7c00df6
SSDEEP 196608:U0QY+7gJUmOQfYIhUWDeS706h5tf45eJYIPrgY171y26pJLckED:U0FxLfYIhU8z7zhff4E3npAdpJLcN
TLSH
T11AC6231177D6C431D1A20575D66AD36B69BAFD325B32C8CBA3D40A5D4A32AC2CC39F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6cb6f2cf56440ee2c788bef3f5e27a1b40f108e0059f119837be23eb863499e2.exe

File Explorer

6cb6f2cf56440ee2c788bef3f5e27a1b40f108e0059f119837be23eb863499e2.exe

.exe 11.0MB

6cb6f2cf56440ee2c788bef3f5e27a1b40f108e0059f119837be23eb863499e2.exe

IMPHASH cfc06d691521b9559e22a3aec16277ff
SHA256 6cb6f2cf56440ee2c788bef3f5e27a1b40f108e0059f119837be23eb863499e2
MD5 339fa647efce4b752107dd0fa17b78d0
SHA1 0d8ecc906273de3b484cdcc0de4091c6c23e2ae7
SHA512 5207ecff7d495fa8a3cbf4ef6bdadfe4e511d6cc3ed1cebfbeabf429dc65c675a7488ae5f7923c110c374196b30b947a7d391bdea31c1f454fe9eabfb7c00df6
SSDEEP 196608:U0QY+7gJUmOQfYIhUWDeS706h5tf45eJYIPrgY171y26pJLckED:U0FxLfYIhU8z7zhff4E3npAdpJLcN
TLSH
T11AC6231177D6C431D1A20575D66AD36B69BAFD325B32C8CBA3D40A5D4A32AC2CC39F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

511126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\968786\out\Release\Setup.pdb

kernel32

QueryPerformanceCounter QueryPerformanceFrequency lstrlenA SystemTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetFileTime GetCurrentDirectoryA PeekNamedPipe GetFullPathNameA GetDriveTypeA QueryDosDeviceW GetVolumeNameForVolumeMountPointW GetDiskFreeSpaceExW GlobalAddAtomW FindAtomW CreateEventW SetEvent GetSystemTime GetWindowsDirectoryW GetDriveTypeW GetCurrentThreadId MulDiv GetCurrentProcess FlushInstructionCache GlobalAlloc GlobalFree GetTickCount GetCommandLineW LoadLibraryExW MultiByteToWideChar lstrcmpiW FormatMessageA ExpandEnvironmentStringsA GetSystemDirectoryA VerSetConditionMask VerifyVersionInfoA FreeResource GetSystemWindowsDirectoryW lstrcmpiA lstrcmpA SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers GetLocaleInfoW WriteConsoleW LeaveCriticalSection WriteConsoleA GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA SetHandleCount GetFileType SetStdHandle GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation HeapCreate InitializeCriticalSectionAndSpinCount GetModuleFileNameA IsValidCodePage GetOEMCP GetACP GetCPInfo LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP GetStartupInfoW ExitProcess TerminateProcess GetCurrentThread CreateProcessW GlobalDeleteAtom CreateMutexW PostQueuedCompletionStatus GetLogicalDriveStringsW CreateIoCompletionPort GetQueuedCompletionStatus CreateThread TerminateThread OutputDebugStringW GetFileSizeEx CompareFileTime OpenProcess GetVolumeInformationW EnterCriticalSection GetLocalTime SetLastError lstrlenW lstrcpyW DeleteCriticalSection InitializeCriticalSection RaiseException FindFirstFileW FindNextFileW FindClose LocalAlloc CopyFileW MoveFileW MoveFileExW GetPrivateProfileStringW GlobalFindAtomW GetFileAttributesW WriteFile CreateDirectoryW GetTempPathW GetTempFileNameW WritePrivateProfileStringW SetFileAttributesW InterlockedDecrement RemoveDirectoryW DeleteFileW GetLastError GetProcessHeap HeapAlloc HeapFree GetSystemDirectoryW GlobalMemoryStatusEx GetModuleHandleA GetSystemInfo InterlockedCompareExchange Sleep GetVersionExW GetVersion GetModuleHandleW GetProcAddress InterlockedExchange ReadFile SetFilePointer GetCurrentProcessId CreateFileW DeviceIoControl LoadLibraryW InterlockedIncrement GetModuleFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle WaitForSingleObject FreeLibrary LocalFree FindResourceExW FindResourceW LoadResource LockResource IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind ExitThread TlsFree ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock SetFilePointerEx GetSystemTimeAsFileTime CreateFileA VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapSize HeapReAlloc HeapDestroy TlsAlloc LockFile GetStdHandle SetConsoleTextAttribute GetFileAttributesA GetFileInformationByHandle LocalFileTimeToFileTime DosDateTimeToFileTime TlsGetValue TlsSetValue ResetEvent ReadProcessMemory OpenMutexW GetExitCodeProcess GetLongPathNameW MapViewOfFile LockFileEx GetFileAttributesExW UnlockFile FindNextFileA FindFirstFileA GetFullPathNameW FormatMessageW SetFileTime SetEndOfFile WideCharToMultiByte UnmapViewOfFile GetFileSize CreateFileMappingW GetEnvironmentVariableW GetConsoleOutputCP SizeofResource

user32

InflateRect EnableWindow GetDlgItem IsWindowEnabled wvsprintfW PostMessageW MessageBoxW ShowWindow SetDlgItemTextW IsWindowVisible SetForegroundWindow EndDialog GetWindowLongW SetWindowTextW MoveWindow SetWindowPos GetClientRect ScreenToClient MapWindowPoints GetMonitorInfoW MonitorFromWindow GetWindowRect GetWindow GetParent GetDC UnregisterClassA ExitWindowsEx wsprintfW ReleaseDC SetWindowLongW GetWindowTextW FindWindowExW InvalidateRect RedrawWindow GetDlgCtrlID SetFocus MessageBeep GetWindowTextLengthW CreateDialogParamW SetWindowRgn SetTimer KillTimer CopyRect GetActiveWindow SendMessageW SendMessageTimeoutW FindWindowW CharNextW IsWindow DefWindowProcW CallWindowProcW BeginPaint EndPaint DialogBoxParamW EnableMenuItem DestroyWindow GetSystemMenu GetClassInfoExW LoadCursorW PostQuitMessage IsIconic SystemParametersInfoW LoadIconW RegisterClassExW CreateWindowExW LoadImageW GetSystemMetrics PtInRect GetCursorPos BringWindowToTop TrackMouseEvent GetShellWindow PostThreadMessageW UpdateLayeredWindow GetWindowThreadProcessId PeekMessageW GetMessageW TranslateMessage DispatchMessageW

gdi32

CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap SelectObject BitBlt DeleteDC SetBkColor CombineRgn CreateRectRgn SetViewportOrgEx CreateDIBSection EnumFontFamiliesW DeleteObject CreateSolidBrush

advapi32

RegOpenKeyExW ImpersonateLoggedOnUser RevertToSelf OpenProcessToken DuplicateTokenEx QueryServiceStatusEx StartServiceW ChangeServiceConfigW ControlService OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceStatus LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken ImpersonateSelf AllocateAndInitializeSid FreeSid SetSecurityInfo GetSecurityInfo GetSecurityDescriptorSacl IsValidSid CopySid RegQueryValueExW RegQueryInfoKeyW GetExplicitEntriesFromAclW GetTrusteeNameW DeleteAce LookupAccountSidW RegCreateKeyExW RegSetValueExW RegOpenKeyW RegEnumKeyExW CryptCreateHash RegDeleteValueW RegEnumValueW RegCloseKey RegDeleteKeyW GetUserNameW LookupAccountNameW GetFileSecurityW InitializeSecurityDescriptor GetSecurityDescriptorDacl GetAclInformation GetLengthSid InitializeAcl GetAce EqualSid AddAce AddAccessAllowedAce SetSecurityDescriptorDacl GetSecurityDescriptorControl SetFileSecurityW GetNamedSecurityInfoW BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW CryptHashData RegOpenKeyExA RegQueryValueExA RegQueryInfoKeyA RegEnumKeyExA RegEnumValueA GetTokenInformation CryptReleaseContext CryptGenRandom CryptAcquireContextA CryptDestroyHash CryptGetHashParam

shell32

SHCreateDirectoryExW SHGetMalloc ShellExecuteExW CommandLineToArgvW SHGetSpecialFolderPathA SHBrowseForFolderW ord680 SHGetSpecialFolderLocation ord165 SHFileOperationW SHChangeNotify ShellExecuteW SHGetSpecialFolderPathW SHGetPathFromIDListW

ole32

OleRun CoCreateGuid CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoInitialize CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CoUninitialize

oleaut32

SysAllocStringLen VarUI4FromStr VariantChangeType SysAllocStringByteLen VariantClear VariantInit SysFreeString SysStringByteLen SysAllocString SysStringLen

shlwapi

StrRetToStrW PathMatchSpecW PathRemoveExtensionW PathFindFileNameW PathAddBackslashW SHSetValueA StrTrimA StrCmpNIW StrStrIA StrCmpIW PathIsPrefixW PathIsSameRootW StrCatW StrCpyW wnsprintfW StrCmpW PathAppendA PathRemoveArgsW PathUnquoteSpacesW PathCombineA SHSetValueW PathFileExistsW SHGetValueW SHDeleteValueW PathFileExistsA SHGetValueA PathCombineW PathAppendW PathIsRelativeW SHDeleteKeyW PathFindExtensionW PathCommonPrefixW PathIsDirectoryEmptyW PathIsDirectoryW StrStrIW PathRemoveFileSpecW

comctl32

InitCommonControlsEx

crypt32

CertDeleteCertificateFromStore CertCompareCertificate CertDuplicateCertificateContext CertCloseStore CertGetNameStringW CertEnumCertificatesInStore CertOpenStore CryptStringToBinaryA CertGetCertificateChain CertFreeCertificateChainEngine CertFreeCertificateChain CertGetNameStringA CryptQueryObject CertAddCertificateContextToStore CertFindCertificateInStore CertCreateCertificateChainEngine CertFreeCertificateContext

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

psapi

GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

rpcrt4

NdrAsyncServerCall RpcBindingFree NdrClientCall2 RpcStringBindingComposeW RpcStringFreeW RpcBindingFromStringBindingW NdrAsyncClientCall NdrServerCall2

gdiplus

GdipTranslateWorldTransform GdipAddPathBezierI GdipRotateWorldTransform GdipGraphicsClear GdipAddPathArcI GdipClosePathFigure GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCreateSolidFill GdipSetSmoothingMode GdipCreateFont GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFontFamilyFromName GdipDeletePath GdipCreatePath GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipSetTextRenderingHint GdiplusStartup GdiplusShutdown GdipDrawImageRectRectI GdipDrawImagePointRectI GdipFillPath GdipDrawString GdipCloneBrush GdipRestoreGraphics GdipCreateFromHDC GdipDeleteGraphics GdipSaveGraphics GdipCloneImage GdipDrawImageRectRect GdipSetImageAttributesColorMatrix GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDisposeImageAttributes GdipCreateImageAttributes GdipAlloc GdipScaleWorldTransform GdipFree

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

setupapi

SetupIterateCabinetW

ws2_32

WSASetLastError __WSAFDIsSet select recv send WSAGetLastError closesocket