808508f8a554107d5a78c29a016c807cf70c47a386a450d365589d920d58136e

Sharing

Copy URL Twitter E-mail

General

Target
808508f8a554107d5a78c29a016c807cf70c47a386a450d365589d920d58136e
Size 4.8MB
Sample260710-dspdpsdx3z
SHA256 808508f8a554107d5a78c29a016c807cf70c47a386a450d365589d920d58136e
MD5 54adf40cbd8fd888493e42e6ed097c61
SHA1 b538f4131417a33c4edaea631e97fe0fd696659a
SHA512 3416abbc9f1ddd25a46cd9688f1384125cf643911864355347c846219506c4ad1a267a1779e786840010c736267307c632c9b9b3148b75aedb007f73450f9c60
SSDEEP 49152:RmeKQV3FoNwwwwsw/e5tGzGyOMlBGkbWa1WHunXey62l1YjbSpRR/sKYgDsS+nT8:RmeKQRFseTCbWq/nXxlISxpwHrz1mh
TLSH
T14D36F131F9628172E5A21270DE7C9BAF856CFB250B3549CB73D40E2E1A609C31A35F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
808508f8a554107d5a78c29a016c807cf70c47a386a450d365589d920d58136e

File Explorer

808508f8a554107d5a78c29a016c807cf70c47a386a450d365589d920d58136e

.exe 4.8MB

808508f8a554107d5a78c29a016c807cf70c47a386a450d365589d920d58136e

IMPHASH 2b4c2f4102cdec6f121a8ef9f0dd88dc
SHA256 808508f8a554107d5a78c29a016c807cf70c47a386a450d365589d920d58136e
MD5 54adf40cbd8fd888493e42e6ed097c61
SHA1 b538f4131417a33c4edaea631e97fe0fd696659a
SHA512 3416abbc9f1ddd25a46cd9688f1384125cf643911864355347c846219506c4ad1a267a1779e786840010c736267307c632c9b9b3148b75aedb007f73450f9c60
SSDEEP 49152:RmeKQV3FoNwwwwsw/e5tGzGyOMlBGkbWa1WHunXey62l1YjbSpRR/sKYgDsS+nT8:RmeKQRFseTCbWq/nXxlISxpwHrz1mh
TLSH
T14D36F131F9628172E5A21270DE7C9BAF856CFB250B3549CB73D40E2E1A609C31A35F67
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

935524

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\955884\out\Release\DataRecoverySetup.pdb

kernel32

OpenProcess SetEndOfFile GetDiskFreeSpaceExW SetFileAttributesW DeleteFileW MoveFileExW GetVolumeInformationW GetFileAttributesExW GetCurrentProcess OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetVersionExW GetVersion InterlockedIncrement GetCommandLineW InitializeCriticalSection GetCurrentProcessId GetUserDefaultLCID ReadFile GetFileSizeEx InterlockedDecrement GetExitCodeThread LoadLibraryW UnmapViewOfFile GetFileSize InterlockedCompareExchange FindNextFileW WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetFileType ExitProcess ExitThread RtlUnwind FindFirstFileW UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW GlobalFree FormatMessageW GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetLastError GetLastError RaiseException CloseHandle DuplicateHandle FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue ReleaseSemaphore GetProcessAffinityMask GlobalMemoryStatus GetStdHandle GetFileInformationByHandle GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP MulDiv CreateDirectoryW GetCurrentDirectoryW SetFileTime GetFileAttributesW VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread LCMapStringW CompareStringW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent GetLongPathNameW GlobalAlloc GetLocalTime FindClose SetFilePointer WriteFile SizeofResource LoadResource GetCurrentThreadId GetProcessHeap HeapSize HeapDestroy LocalFree LockResource SetFilePointerEx GetModuleFileNameW DeleteCriticalSection SetEnvironmentVariableW CreateFileW

user32

InvalidateRect GetCursorPos ScreenToClient OffsetRect IsRectEmpty PtInRect LoadCursorW MonitorFromPoint EqualRect SetCursor CharUpperW UnionRect SetClipboardData EmptyClipboard GetWindowLongW DestroyWindow wsprintfW RegisterClassExW DefWindowProcW PostMessageW SetWindowRgn GetUpdateRect EndPaint BeginPaint ReleaseDC GetDC ReleaseCapture SetCapture GetKeyState GetFocus IsZoomed MoveWindow UpdateLayeredWindow RegisterClassW CreateWindowExW GetWindowThreadProcessId SetForegroundWindow GetForegroundWindow SetActiveWindow BringWindowToTop IsIconic ShowWindow IsWindow AttachThreadInput GetAsyncKeyState ClientToScreen GetSysColor DrawTextW GetDesktopWindow SetWindowLongW IntersectRect CallWindowProcW LoadImageW GetSystemMetrics KillTimer SetTimer GetMonitorInfoW MonitorFromWindow GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect SetWindowTextW EnableWindow SetFocus PostQuitMessage SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW FindWindowW IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard IsWindowVisible SetWindowPos MessageBoxW

gdi32

SetTextColor GetObjectA SelectObject SetStretchBltMode StretchBlt GetObjectW CreateDIBSection SetWindowOrgEx DeleteObject DeleteDC CreateCompatibleDC SetBkMode BitBlt CreateRoundRectRgn CreateFontIndirectW GetStockObject GetDeviceCaps CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC ExtSelectClipRgn SetBkColor

advapi32

RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegEnumKeyExA

shell32

SHGetSpecialFolderPathW ord165 SHGetPathFromIDListW SHGetFolderPathW ShellExecuteW CommandLineToArgvW SHBrowseForFolderW

ole32

CreateStreamOnHGlobal CoTaskMemFree CoUninitialize CoInitializeEx CoCreateInstance CoCreateGuid CoInitialize CoTaskMemRealloc OleInitialize OleUninitialize CoTaskMemAlloc

oleaut32

SysStringLen SysAllocStringLen SysFreeString VariantClear VarUI4FromStr SysAllocString

shlwapi

SHSetValueA SHGetValueA PathIsRelativeW StrTrimA PathFileExistsW StrStrIA SHSetValueW PathRemoveBackslashW StrCmpNIW StrStrIW PathAppendW PathCombineW PathFindFileNameW PathRemoveFileSpecW SHGetValueW PathIsPrefixW PathIsDirectoryW PathCanonicalizeW StrCmpIW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

gdiplus

GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipMeasureString GdipDrawString GdipDeleteFont GdipDeleteGraphics GdipBitmapUnlockBits GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipResetClip GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipSetClipPath GdipGetPropertyItemSize GdipGetPropertyItem GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCloneBrush GdipDeleteBrush GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipCreateFromHDC GdipSetSmoothingMode GdipSetPixelOffsetMode GdipFillRegion GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath GdipDrawImageRectRectI GdipImageSelectActiveFrame

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeSetEvent timeKillEvent

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

crypt32

CryptStringToBinaryA

iphlpapi

GetAdaptersInfo

wininet

InternetCrackUrlW InternetOpenW InternetCloseHandle InternetConnectW HttpSendRequestW InternetSetOptionW HttpOpenRequestW HttpQueryInfoW

msimg32

AlphaBlend

generic

count=31, id=241, version=40116,

count=192, id=243, version=40116,

count=39, id=242, version=40116,

count=12, id=260, version=27051,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=4, id=199, version=41118,

count=28, id=259, version=26706,

count=103, id=261, version=27051,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=12, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=136, id=261, version=26706,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=674, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=1, id=260, version=27048,

count=25, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,