396308aef964ddb8d1196748e3202fa754e45957646fb4c6fbc5a52dcf2af116

Sharing

Copy URL Twitter E-mail

General

Target
396308aef964ddb8d1196748e3202fa754e45957646fb4c6fbc5a52dcf2af116
Size 4.8MB
Sample260710-exsscses4y
SHA256 396308aef964ddb8d1196748e3202fa754e45957646fb4c6fbc5a52dcf2af116
MD5 68cd24e512e84209b880bff3abef4b00
SHA1 6eb7ad91d7066d03c01dceb3e88ccc0f3f9ae8c2
SHA512 fc15b07ec035afa61c7ba7adecc199799e1e700187482b39127d1b3611a0f949ce65c92dd7f900234904f06d4bf48b2d2d8910ff3b6740da3c1bbcbe826c4605
SSDEEP 49152:RmeKQV3FoNwwwwsw/e5tGzGyOMlBGkbWa1WHunXey62l1YjbSpRR/sKYgDsS+nTO:RmeKQRFseTCbWq/nXxlISxpwHrz1m5
TLSH
T13436F131F9628172E5A21270DE7C9BAF856CFB250B3549CB73D40E2E1A609C31A35F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
396308aef964ddb8d1196748e3202fa754e45957646fb4c6fbc5a52dcf2af116

File Explorer

396308aef964ddb8d1196748e3202fa754e45957646fb4c6fbc5a52dcf2af116

.exe 4.8MB

396308aef964ddb8d1196748e3202fa754e45957646fb4c6fbc5a52dcf2af116

IMPHASH 2b4c2f4102cdec6f121a8ef9f0dd88dc
SHA256 396308aef964ddb8d1196748e3202fa754e45957646fb4c6fbc5a52dcf2af116
MD5 68cd24e512e84209b880bff3abef4b00
SHA1 6eb7ad91d7066d03c01dceb3e88ccc0f3f9ae8c2
SHA512 fc15b07ec035afa61c7ba7adecc199799e1e700187482b39127d1b3611a0f949ce65c92dd7f900234904f06d4bf48b2d2d8910ff3b6740da3c1bbcbe826c4605
SSDEEP 49152:RmeKQV3FoNwwwwsw/e5tGzGyOMlBGkbWa1WHunXey62l1YjbSpRR/sKYgDsS+nTO:RmeKQRFseTCbWq/nXxlISxpwHrz1m5
TLSH
T13436F131F9628172E5A21270DE7C9BAF856CFB250B3549CB73D40E2E1A609C31A35F67
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

935524

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\955884\out\Release\DataRecoverySetup.pdb

kernel32

OpenProcess SetEndOfFile GetDiskFreeSpaceExW SetFileAttributesW DeleteFileW MoveFileExW GetVolumeInformationW GetFileAttributesExW GetCurrentProcess OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetVersionExW GetVersion InterlockedIncrement GetCommandLineW InitializeCriticalSection GetCurrentProcessId GetUserDefaultLCID ReadFile GetFileSizeEx InterlockedDecrement GetExitCodeThread LoadLibraryW UnmapViewOfFile GetFileSize InterlockedCompareExchange FindNextFileW WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetFileType ExitProcess ExitThread RtlUnwind FindFirstFileW UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW GlobalFree FormatMessageW GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetLastError GetLastError RaiseException CloseHandle DuplicateHandle FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue ReleaseSemaphore GetProcessAffinityMask GlobalMemoryStatus GetStdHandle GetFileInformationByHandle GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP MulDiv CreateDirectoryW GetCurrentDirectoryW SetFileTime GetFileAttributesW VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread LCMapStringW CompareStringW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent GetLongPathNameW GlobalAlloc GetLocalTime FindClose SetFilePointer WriteFile SizeofResource LoadResource GetCurrentThreadId GetProcessHeap HeapSize HeapDestroy LocalFree LockResource SetFilePointerEx GetModuleFileNameW DeleteCriticalSection SetEnvironmentVariableW CreateFileW

user32

InvalidateRect GetCursorPos ScreenToClient OffsetRect IsRectEmpty PtInRect LoadCursorW MonitorFromPoint EqualRect SetCursor CharUpperW UnionRect SetClipboardData EmptyClipboard GetWindowLongW DestroyWindow wsprintfW RegisterClassExW DefWindowProcW PostMessageW SetWindowRgn GetUpdateRect EndPaint BeginPaint ReleaseDC GetDC ReleaseCapture SetCapture GetKeyState GetFocus IsZoomed MoveWindow UpdateLayeredWindow RegisterClassW CreateWindowExW GetWindowThreadProcessId SetForegroundWindow GetForegroundWindow SetActiveWindow BringWindowToTop IsIconic ShowWindow IsWindow AttachThreadInput GetAsyncKeyState ClientToScreen GetSysColor DrawTextW GetDesktopWindow SetWindowLongW IntersectRect CallWindowProcW LoadImageW GetSystemMetrics KillTimer SetTimer GetMonitorInfoW MonitorFromWindow GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect SetWindowTextW EnableWindow SetFocus PostQuitMessage SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW FindWindowW IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard IsWindowVisible SetWindowPos MessageBoxW

gdi32

SetTextColor GetObjectA SelectObject SetStretchBltMode StretchBlt GetObjectW CreateDIBSection SetWindowOrgEx DeleteObject DeleteDC CreateCompatibleDC SetBkMode BitBlt CreateRoundRectRgn CreateFontIndirectW GetStockObject GetDeviceCaps CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC ExtSelectClipRgn SetBkColor

advapi32

RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegEnumKeyExA

shell32

SHGetSpecialFolderPathW ord165 SHGetPathFromIDListW SHGetFolderPathW ShellExecuteW CommandLineToArgvW SHBrowseForFolderW

ole32

CreateStreamOnHGlobal CoTaskMemFree CoUninitialize CoInitializeEx CoCreateInstance CoCreateGuid CoInitialize CoTaskMemRealloc OleInitialize OleUninitialize CoTaskMemAlloc

oleaut32

SysStringLen SysAllocStringLen SysFreeString VariantClear VarUI4FromStr SysAllocString

shlwapi

SHSetValueA SHGetValueA PathIsRelativeW StrTrimA PathFileExistsW StrStrIA SHSetValueW PathRemoveBackslashW StrCmpNIW StrStrIW PathAppendW PathCombineW PathFindFileNameW PathRemoveFileSpecW SHGetValueW PathIsPrefixW PathIsDirectoryW PathCanonicalizeW StrCmpIW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

gdiplus

GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipMeasureString GdipDrawString GdipDeleteFont GdipDeleteGraphics GdipBitmapUnlockBits GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipResetClip GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipSetClipPath GdipGetPropertyItemSize GdipGetPropertyItem GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCloneBrush GdipDeleteBrush GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipCreateFromHDC GdipSetSmoothingMode GdipSetPixelOffsetMode GdipFillRegion GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath GdipDrawImageRectRectI GdipImageSelectActiveFrame

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeSetEvent timeKillEvent

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

crypt32

CryptStringToBinaryA

iphlpapi

GetAdaptersInfo

wininet

InternetCrackUrlW InternetOpenW InternetCloseHandle InternetConnectW HttpSendRequestW InternetSetOptionW HttpOpenRequestW HttpQueryInfoW

msimg32

AlphaBlend

generic

count=31, id=241, version=40116,

count=192, id=243, version=40116,

count=39, id=242, version=40116,

count=12, id=260, version=27051,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=4, id=199, version=41118,

count=28, id=259, version=26706,

count=103, id=261, version=27051,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=12, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=136, id=261, version=26706,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=674, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=1, id=260, version=27048,

count=25, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,