47462c92f60a912c281d1464ba8b6d024f699ac6b9beb693fd8770982c49ff94

Sharing

Copy URL Twitter E-mail

General

Target
47462c92f60a912c281d1464ba8b6d024f699ac6b9beb693fd8770982c49ff94
Size 4.8MB
Sample260710-dv3dcadx6x
SHA256 47462c92f60a912c281d1464ba8b6d024f699ac6b9beb693fd8770982c49ff94
MD5 37f3956f6fef3dd2ca40fea4d7badc8a
SHA1 897402cbb831756fe7ca4f1ddd005f230dbf25dd
SHA512 2b12c8b4dfeea30f29df1f576b36fa74ef5c5d2deceb66e799f403d8989d62fdc686d3c4c21261e8589e0ed0f5ffdedbd9df94510fa629db515eefdeb6de1d86
SSDEEP 98304:cLjfmTlHanM9fyBAF2jIwdWkJXLyvAzJZP:c/eAcuvdVJuKTP
TLSH
T10C36F131BA43C036E5B641B19E7D9AAF816DB7340B3459CB73C80F2E1E605C35E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
47462c92f60a912c281d1464ba8b6d024f699ac6b9beb693fd8770982c49ff94

File Explorer

47462c92f60a912c281d1464ba8b6d024f699ac6b9beb693fd8770982c49ff94

.exe 4.8MB

47462c92f60a912c281d1464ba8b6d024f699ac6b9beb693fd8770982c49ff94

IMPHASH 6e7da919ef5e6a478ed32c4f8945856d
SHA256 47462c92f60a912c281d1464ba8b6d024f699ac6b9beb693fd8770982c49ff94
MD5 37f3956f6fef3dd2ca40fea4d7badc8a
SHA1 897402cbb831756fe7ca4f1ddd005f230dbf25dd
SHA512 2b12c8b4dfeea30f29df1f576b36fa74ef5c5d2deceb66e799f403d8989d62fdc686d3c4c21261e8589e0ed0f5ffdedbd9df94510fa629db515eefdeb6de1d86
SSDEEP 98304:cLjfmTlHanM9fyBAF2jIwdWkJXLyvAzJZP:c/eAcuvdVJuKTP
TLSH
T10C36F131BA43C036E5B641B19E7D9AAF816DB7340B3459CB73C80F2E1E605C35E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1037542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\836521\out\Release\SudaSetup.pdb

kernel32

InterlockedDecrement GetFileSizeEx ReadFile SetFilePointerEx GlobalAlloc GlobalFree GetLongPathNameW OpenProcess SetEndOfFile GetDiskFreeSpaceExW SetFileAttributesW DeleteFileW MoveFileExW GetVolumeInformationW GetFileAttributesExW GetCurrentProcess OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetVersionExW InterlockedIncrement GetCommandLineW GetFileInformationByHandle GetStdHandle SetFileTime GetCurrentDirectoryW CreateDirectoryW GetFileAttributesW GlobalMemoryStatus GetProcessAffinityMask IsProcessorFeaturePresent ReleaseSemaphore MapViewOfFile GetCurrentThreadId LoadLibraryW CreateFileMappingW UnmapViewOfFile InterlockedCompareExchange GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW SetFilePointer WriteFile SizeofResource LoadResource GetProcessHeap HeapSize HeapDestroy WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode FindFirstFileW FlushFileBuffers GetTimeZoneInformation FindClose IsValidLocale GetFileType ExitProcess ExitThread RtlUnwind LockResource GetModuleFileNameW DeleteCriticalSection InitializeCriticalSection GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP MulDiv VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo FormatMessageW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent FindNextFileW GetConsoleCP GetLastError RaiseException CloseHandle GetLocalTime LocalFree Process32NextW Process32FirstW EnumSystemLocalesW CreateToolhelp32Snapshot CreateFileW

user32

BringWindowToTop PostMessageW DefWindowProcW RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow GetWindowLongW SetWindowLongW AttachThreadInput IsIconic CloseClipboard SetActiveWindow GetForegroundWindow SetForegroundWindow FindWindowW GetWindowThreadProcessId wsprintfW SetWindowPos IsWindowVisible GetDesktopWindow DrawTextW GetSysColor ClientToScreen GetAsyncKeyState EmptyClipboard SetClipboardData UnionRect IntersectRect SetCursor EqualRect MonitorFromPoint SetWindowTextW EnableWindow SetFocus GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect GetSystemMetrics KillTimer SetTimer PostQuitMessage SendMessageW CharUpperW PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW IsClipboardFormatAvailable GetClipboardData LoadCursorW OpenClipboard CallWindowProcW RegisterClassW UpdateLayeredWindow MoveWindow IsZoomed GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect SetWindowRgn InvalidateRect GetCursorPos ScreenToClient OffsetRect IsRectEmpty PtInRect

advapi32

EnumServicesStatusW RegDeleteKeyW RegEnumKeyExA RegCloseKey RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken OpenSCManagerW RegDeleteValueW CloseServiceHandle RegOpenKeyW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA

shell32

ShellExecuteExW ShellExecuteW SHBrowseForFolderW SHGetSpecialFolderPathW SHGetPathFromIDListW SHFileOperationW CommandLineToArgvW ord165 SHGetFolderPathW

ole32

OleUninitialize OleInitialize CoTaskMemRealloc CreateStreamOnHGlobal CoCreateGuid CoCreateInstance CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

SysFreeString VarUI4FromStr VariantClear SysStringLen SysAllocString SysAllocStringLen

shlwapi

PathAddBackslashW StrStrIW StrCmpNIW StrCmpIW PathFindFileNameW PathCombineW PathAppendW SHDeleteValueW StrTrimA PathCanonicalizeW PathIsDirectoryW PathRemoveFileSpecW SHSetValueA SHGetValueA PathIsPrefixW SHGetValueW StrStrIA PathRemoveExtensionW SHSetValueW StrCpyNW PathFileExistsW PathIsRelativeW PathRemoveBackslashW

version

VerQueryValueW

psapi

GetModuleFileNameExW

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

crypt32

CryptBinaryToStringA

iphlpapi

GetAdaptersInfo

wininet

InternetConnectW HttpQueryInfoW HttpOpenRequestW InternetSetOptionW InternetCloseHandle InternetCrackUrlW InternetOpenW HttpSendRequestW

msi

ord217 ord173

gdi32

CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC DeleteObject CreateCompatibleDC DeleteDC SelectObject SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection GetObjectA SetWindowOrgEx BitBlt CreateRoundRectRgn ExtSelectClipRgn

gdiplus

GdipMeasureString GdipStringFormatGetGenericTypographic GdipResetClip GdipSetClipPath GdipCreateFontFromDC GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipDrawString GdipCreateFontFromLogfontA GdipDrawImageRectRectI GdipDeleteFont GdipSetStringFormatAlign GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCloneBrush GdipDeleteBrush GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipFillRegion GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath

msimg32

AlphaBlend

generic

count=31, id=241, version=40116,

count=192, id=243, version=40116,

count=39, id=242, version=40116,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=3, id=199, version=41118,

count=29, id=259, version=26706,

count=67, id=261, version=27051,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=12, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=134, id=261, version=26706,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=662, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=32, id=260, version=27048,

count=112, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,