8342b097e4fe1e8b397f16206e4b6b964b1f1fa1a4a4374a923ce1110d10d79d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
8342b097e4fe1e8b397f16206e4b6b964b1f1fa1a4a4374a923ce1110d10d79d.exe
Size 11.4MB
Sample260709-2ay27aat2n
SHA256 8342b097e4fe1e8b397f16206e4b6b964b1f1fa1a4a4374a923ce1110d10d79d
MD5 bd8afb28ce3e184cac56a82d4a9114e5
SHA1 03bedcb4df206e47621326672da66ba1195df13a
SHA512 d2f1692f6c1bd49a9c7a79278433136b95de286c9d5fbec9009ab6edc9bdd431d3f7858e7eabf4edacafec21476d20fa1484c62e86a09ea2e1acb53c4bd7ce59
SSDEEP 196608:P0QYK7gJUmOQfYIBUWDeS706h5tf45eJYIPrgY171y26jRsLckEFHO:P0lxLfYIBU8z7zhff4E3npAdFsLczHO
TLSH
T170C6331177D9C475E1A20575D669D36B29BAFD321B32C8CBA3D80A5D4A31AC2CC39F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8342b097e4fe1e8b397f16206e4b6b964b1f1fa1a4a4374a923ce1110d10d79d.exe

File Explorer

8342b097e4fe1e8b397f16206e4b6b964b1f1fa1a4a4374a923ce1110d10d79d.exe

.exe 11.4MB

8342b097e4fe1e8b397f16206e4b6b964b1f1fa1a4a4374a923ce1110d10d79d.exe

IMPHASH cfc06d691521b9559e22a3aec16277ff
SHA256 8342b097e4fe1e8b397f16206e4b6b964b1f1fa1a4a4374a923ce1110d10d79d
MD5 bd8afb28ce3e184cac56a82d4a9114e5
SHA1 03bedcb4df206e47621326672da66ba1195df13a
SHA512 d2f1692f6c1bd49a9c7a79278433136b95de286c9d5fbec9009ab6edc9bdd431d3f7858e7eabf4edacafec21476d20fa1484c62e86a09ea2e1acb53c4bd7ce59
SSDEEP 196608:P0QYK7gJUmOQfYIBUWDeS706h5tf45eJYIPrgY171y26jRsLckEFHO:P0lxLfYIBU8z7zhff4E3npAdFsLczHO
TLSH
T170C6331177D9C475E1A20575D669D36B29BAFD321B32C8CBA3D80A5D4A31AC2CC39F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

511126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\968786\out\Release\Setup.pdb

kernel32

QueryPerformanceCounter QueryPerformanceFrequency lstrlenA SystemTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetFileTime GetCurrentDirectoryA PeekNamedPipe GetFullPathNameA GetDriveTypeA QueryDosDeviceW GetVolumeNameForVolumeMountPointW GetDiskFreeSpaceExW GlobalAddAtomW FindAtomW CreateEventW SetEvent GetSystemTime GetWindowsDirectoryW GetDriveTypeW GetCurrentThreadId MulDiv GetCurrentProcess FlushInstructionCache GlobalAlloc GlobalFree GetTickCount GetCommandLineW LoadLibraryExW MultiByteToWideChar lstrcmpiW FormatMessageA ExpandEnvironmentStringsA GetSystemDirectoryA VerSetConditionMask VerifyVersionInfoA FreeResource GetSystemWindowsDirectoryW lstrcmpiA lstrcmpA SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers GetLocaleInfoW WriteConsoleW LeaveCriticalSection WriteConsoleA GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA SetHandleCount GetFileType SetStdHandle GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation HeapCreate InitializeCriticalSectionAndSpinCount GetModuleFileNameA IsValidCodePage GetOEMCP GetACP GetCPInfo LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP GetStartupInfoW ExitProcess TerminateProcess GetCurrentThread CreateProcessW GlobalDeleteAtom CreateMutexW PostQueuedCompletionStatus GetLogicalDriveStringsW CreateIoCompletionPort GetQueuedCompletionStatus CreateThread TerminateThread OutputDebugStringW GetFileSizeEx CompareFileTime OpenProcess GetVolumeInformationW EnterCriticalSection GetLocalTime SetLastError lstrlenW lstrcpyW DeleteCriticalSection InitializeCriticalSection RaiseException FindFirstFileW FindNextFileW FindClose LocalAlloc CopyFileW MoveFileW MoveFileExW GetPrivateProfileStringW GlobalFindAtomW GetFileAttributesW WriteFile CreateDirectoryW GetTempPathW GetTempFileNameW WritePrivateProfileStringW SetFileAttributesW InterlockedDecrement RemoveDirectoryW DeleteFileW GetLastError GetProcessHeap HeapAlloc HeapFree GetSystemDirectoryW GlobalMemoryStatusEx GetModuleHandleA GetSystemInfo InterlockedCompareExchange Sleep GetVersionExW GetVersion GetModuleHandleW GetProcAddress InterlockedExchange ReadFile SetFilePointer GetCurrentProcessId CreateFileW DeviceIoControl LoadLibraryW InterlockedIncrement GetModuleFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle WaitForSingleObject FreeLibrary LocalFree FindResourceExW FindResourceW LoadResource LockResource IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind ExitThread TlsFree ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock SetFilePointerEx GetSystemTimeAsFileTime CreateFileA VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapSize HeapReAlloc HeapDestroy TlsAlloc LockFile GetStdHandle SetConsoleTextAttribute GetFileAttributesA GetFileInformationByHandle LocalFileTimeToFileTime DosDateTimeToFileTime TlsGetValue TlsSetValue ResetEvent ReadProcessMemory OpenMutexW GetExitCodeProcess GetLongPathNameW MapViewOfFile LockFileEx GetFileAttributesExW UnlockFile FindNextFileA FindFirstFileA GetFullPathNameW FormatMessageW SetFileTime SetEndOfFile WideCharToMultiByte UnmapViewOfFile GetFileSize CreateFileMappingW GetEnvironmentVariableW GetConsoleOutputCP SizeofResource

user32

InflateRect EnableWindow GetDlgItem IsWindowEnabled wvsprintfW PostMessageW MessageBoxW ShowWindow SetDlgItemTextW IsWindowVisible SetForegroundWindow EndDialog GetWindowLongW SetWindowTextW MoveWindow SetWindowPos GetClientRect ScreenToClient MapWindowPoints GetMonitorInfoW MonitorFromWindow GetWindowRect GetWindow GetParent GetDC UnregisterClassA ExitWindowsEx wsprintfW ReleaseDC SetWindowLongW GetWindowTextW FindWindowExW InvalidateRect RedrawWindow GetDlgCtrlID SetFocus MessageBeep GetWindowTextLengthW CreateDialogParamW SetWindowRgn SetTimer KillTimer CopyRect GetActiveWindow SendMessageW SendMessageTimeoutW FindWindowW CharNextW IsWindow DefWindowProcW CallWindowProcW BeginPaint EndPaint DialogBoxParamW EnableMenuItem DestroyWindow GetSystemMenu GetClassInfoExW LoadCursorW PostQuitMessage IsIconic SystemParametersInfoW LoadIconW RegisterClassExW CreateWindowExW LoadImageW GetSystemMetrics PtInRect GetCursorPos BringWindowToTop TrackMouseEvent GetShellWindow PostThreadMessageW UpdateLayeredWindow GetWindowThreadProcessId PeekMessageW GetMessageW TranslateMessage DispatchMessageW

gdi32

CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap SelectObject BitBlt DeleteDC SetBkColor CombineRgn CreateRectRgn SetViewportOrgEx CreateDIBSection EnumFontFamiliesW DeleteObject CreateSolidBrush

advapi32

RegOpenKeyExW ImpersonateLoggedOnUser RevertToSelf OpenProcessToken DuplicateTokenEx QueryServiceStatusEx StartServiceW ChangeServiceConfigW ControlService OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceStatus LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken ImpersonateSelf AllocateAndInitializeSid FreeSid SetSecurityInfo GetSecurityInfo GetSecurityDescriptorSacl IsValidSid CopySid RegQueryValueExW RegQueryInfoKeyW GetExplicitEntriesFromAclW GetTrusteeNameW DeleteAce LookupAccountSidW RegCreateKeyExW RegSetValueExW RegOpenKeyW RegEnumKeyExW CryptCreateHash RegDeleteValueW RegEnumValueW RegCloseKey RegDeleteKeyW GetUserNameW LookupAccountNameW GetFileSecurityW InitializeSecurityDescriptor GetSecurityDescriptorDacl GetAclInformation GetLengthSid InitializeAcl GetAce EqualSid AddAce AddAccessAllowedAce SetSecurityDescriptorDacl GetSecurityDescriptorControl SetFileSecurityW GetNamedSecurityInfoW BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW CryptHashData RegOpenKeyExA RegQueryValueExA RegQueryInfoKeyA RegEnumKeyExA RegEnumValueA GetTokenInformation CryptReleaseContext CryptGenRandom CryptAcquireContextA CryptDestroyHash CryptGetHashParam

shell32

SHCreateDirectoryExW SHGetMalloc ShellExecuteExW CommandLineToArgvW SHGetSpecialFolderPathA SHBrowseForFolderW ord680 SHGetSpecialFolderLocation ord165 SHFileOperationW SHChangeNotify ShellExecuteW SHGetSpecialFolderPathW SHGetPathFromIDListW

ole32

OleRun CoCreateGuid CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoInitialize CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CoUninitialize

oleaut32

SysAllocStringLen VarUI4FromStr VariantChangeType SysAllocStringByteLen VariantClear VariantInit SysFreeString SysStringByteLen SysAllocString SysStringLen

shlwapi

StrRetToStrW PathMatchSpecW PathRemoveExtensionW PathFindFileNameW PathAddBackslashW SHSetValueA StrTrimA StrCmpNIW StrStrIA StrCmpIW PathIsPrefixW PathIsSameRootW StrCatW StrCpyW wnsprintfW StrCmpW PathAppendA PathRemoveArgsW PathUnquoteSpacesW PathCombineA SHSetValueW PathFileExistsW SHGetValueW SHDeleteValueW PathFileExistsA SHGetValueA PathCombineW PathAppendW PathIsRelativeW SHDeleteKeyW PathFindExtensionW PathCommonPrefixW PathIsDirectoryEmptyW PathIsDirectoryW StrStrIW PathRemoveFileSpecW

comctl32

InitCommonControlsEx

crypt32

CertDeleteCertificateFromStore CertCompareCertificate CertDuplicateCertificateContext CertCloseStore CertGetNameStringW CertEnumCertificatesInStore CertOpenStore CryptStringToBinaryA CertGetCertificateChain CertFreeCertificateChainEngine CertFreeCertificateChain CertGetNameStringA CryptQueryObject CertAddCertificateContextToStore CertFindCertificateInStore CertCreateCertificateChainEngine CertFreeCertificateContext

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

psapi

GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

rpcrt4

NdrAsyncServerCall RpcBindingFree NdrClientCall2 RpcStringBindingComposeW RpcStringFreeW RpcBindingFromStringBindingW NdrAsyncClientCall NdrServerCall2

gdiplus

GdipTranslateWorldTransform GdipAddPathBezierI GdipRotateWorldTransform GdipGraphicsClear GdipAddPathArcI GdipClosePathFigure GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCreateSolidFill GdipSetSmoothingMode GdipCreateFont GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFontFamilyFromName GdipDeletePath GdipCreatePath GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipSetTextRenderingHint GdiplusStartup GdiplusShutdown GdipDrawImageRectRectI GdipDrawImagePointRectI GdipFillPath GdipDrawString GdipCloneBrush GdipRestoreGraphics GdipCreateFromHDC GdipDeleteGraphics GdipSaveGraphics GdipCloneImage GdipDrawImageRectRect GdipSetImageAttributesColorMatrix GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDisposeImageAttributes GdipCreateImageAttributes GdipAlloc GdipScaleWorldTransform GdipFree

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

setupapi

SetupIterateCabinetW

ws2_32

WSASetLastError __WSAFDIsSet select recv send WSAGetLastError closesocket