f6b4df8522386039ac478ac29892b001e0927732a39eb6d94d9b2c90e9eaccdd

Sharing

Copy URL Twitter E-mail

General

Target
f6b4df8522386039ac478ac29892b001e0927732a39eb6d94d9b2c90e9eaccdd
Size 753KB
Sample260710-hjmwqsf14s
SHA256 f6b4df8522386039ac478ac29892b001e0927732a39eb6d94d9b2c90e9eaccdd
MD5 c670b397cae8eee83cacee76810005fb
SHA1 39f22a5ffed92919cb9592bd9aee5c14ab14736f
SHA512 0eabeabed877f8e21653e53199d7de0db021d75c776953412feeecf5cfb1361319276c1fb3f9bd3b40c9249843eb5866f9925c118d6c0bbfa1ae1cd827d12993
SSDEEP 12288:vPf/1xH9idmvf7tLc1hXKheTVHX/5AlkAzL5i3t4hQOmPhToaIg5:H1fWmUh6eTHAlk+i94ZIlIS
TLSH
T14DF49E207782C036EA7110715A7DABBA147EFA360B2619CBA3D44A3D1D345E26F35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6b4df8522386039ac478ac29892b001e0927732a39eb6d94d9b2c90e9eaccdd

File Explorer

f6b4df8522386039ac478ac29892b001e0927732a39eb6d94d9b2c90e9eaccdd

.exe 753KB

f6b4df8522386039ac478ac29892b001e0927732a39eb6d94d9b2c90e9eaccdd

IMPHASH 47b25137d8aad9a8343e084d26077378
SHA256 f6b4df8522386039ac478ac29892b001e0927732a39eb6d94d9b2c90e9eaccdd
MD5 c670b397cae8eee83cacee76810005fb
SHA1 39f22a5ffed92919cb9592bd9aee5c14ab14736f
SHA512 0eabeabed877f8e21653e53199d7de0db021d75c776953412feeecf5cfb1361319276c1fb3f9bd3b40c9249843eb5866f9925c118d6c0bbfa1ae1cd827d12993
SSDEEP 12288:vPf/1xH9idmvf7tLc1hXKheTVHX/5AlkAzL5i3t4hQOmPhToaIg5:H1fWmUh6eTHAlk+i94ZIlIS
TLSH
T14DF49E207782C036EA7110715A7DABBA147EFA360B2619CBA3D44A3D1D345E26F35B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

324787

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\923430\out\Release\WebView.pdb

kernel32

EnumSystemLocalesW GetTempPathW HeapDestroy GetProcessHeap FindResourceExW LoadResource LockResource SizeofResource FindResourceW GetModuleHandleA FormatMessageW SetFilePointer WriteFile OutputDebugStringW QueryPerformanceFrequency DeleteCriticalSection GetBinaryTypeW GetPrivateProfileIntW GetPrivateProfileStringW GetFileSize SetEndOfFile DeleteFileW SetThreadPriority lstrcmpiW GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW GetVersion FlushFileBuffers GetLocalTime DeviceIoControl InitializeCriticalSection CreateIoCompletionPort PostQueuedCompletionStatus TerminateThread GetConsoleMode GetConsoleOutputCP SetStdHandle GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindClose IsValidLocale GetFileType GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind SetUnhandledExceptionFilter UnhandledExceptionFilter HeapWalk HeapUnlock HeapLock SetFilePointerEx ReadFile GetFileSizeEx CreateFileA LocalFileTimeToFileTime SystemTimeToFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetTimeFormatW GetDateFormatW GetTimeZoneInformation LocalFree LocalAlloc GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary UnmapViewOfFile MapViewOfFileEx GetUserDefaultLCID WriteConsoleW GetStartupInfoW OpenFileMappingW CreateFileMappingW VirtualQuery VirtualFree VirtualAlloc GetNativeSystemInfo GetVersionExW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo IsProcessorFeaturePresent GetExitCodeThread GetCurrentThreadId CreateThread SwitchToThread TerminateProcess GetCurrentProcessId GetCurrentProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetQueuedCompletionStatus HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError RaiseException AreFileApisANSI GetFileAttributesW FindFirstFileW FreeEnvironmentStringsW CreateFileW

user32

GetMessageW TranslateMessage DispatchMessageW PostMessageW DefWindowProcW PostQuitMessage CreateWindowExW DestroyWindow SetTimer SendMessageTimeoutW IsWindow ShowWindow CallWindowProcW UnregisterClassW RegisterClassExW FindWindowW GetClassInfoExW GetWindowLongW KillTimer LoadCursorW PeekMessageW CharNextW SetWindowLongW

advapi32

RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW RegOpenCurrentUser RegEnumKeyExW RegQueryInfoKeyW

shell32

SHGetFolderPathW CommandLineToArgvW ord165 ShellExecuteW

ole32

CoTaskMemAlloc CoInitialize CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemFree CoTaskMemRealloc

oleaut32

SysAllocString VarUI4FromStr LoadRegTypeLi LoadTypeLi SysStringLen VariantInit SysFreeString

shlwapi

SHGetValueW PathAddBackslashW PathAppendW PathFileExistsW PathRemoveFileSpecW ord176 PathCombineW PathFindFileNameW wvnsprintfW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

comctl32

InitCommonControlsEx

winmm

timeKillEvent timeSetEvent

crypt32

CertFindCertificateInStore CryptQueryObject CryptMsgGetParam CryptMsgClose CertFreeCertificateContext CertCloseStore CertGetNameStringW

Sharing

General

Malware Config

Signatures

File Explorer

f6b4df8522386039ac478ac29892b001e0927732a39eb6d94d9b2c90e9eaccdd

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

comctl32

winmm

crypt32

generic