27fe1c4aa72b24bb14f5b1817159447ab355313d74a599148f3a4dba5bb03b28

Sharing

Copy URL Twitter E-mail

General

Target
27fe1c4aa72b24bb14f5b1817159447ab355313d74a599148f3a4dba5bb03b28
Size 228KB
Sample260710-ty4nksft21
SHA256 27fe1c4aa72b24bb14f5b1817159447ab355313d74a599148f3a4dba5bb03b28
MD5 aae37ce907d2ff569653487eeb078809
SHA1 235854f838a62c1a622ac0c1157d6f2bfb013479
SHA512 a03bf178116c443cad321316f1cd928f08e0e1074c4adc7ba8ba3cc2332bb3e1f62a37b8610c3e0345cd552faaba811df5d8ec8803238a8cf80f1fc3ff14076a
SSDEEP 6144:9de/XTSzla473WQcvrGpqlU44kOSAKvcf:OXwla47WQ6rkqlU
TLSH
T112348C517BD1C97BE99B26344537C73A867AB6320720C1CBE3290E3A5E316C19D3636B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27fe1c4aa72b24bb14f5b1817159447ab355313d74a599148f3a4dba5bb03b28

File Explorer

27fe1c4aa72b24bb14f5b1817159447ab355313d74a599148f3a4dba5bb03b28

.dll 228KB

27fe1c4aa72b24bb14f5b1817159447ab355313d74a599148f3a4dba5bb03b28

IMPHASH 758d2c472afa4550d4546edde7fc0aeb
SHA256 27fe1c4aa72b24bb14f5b1817159447ab355313d74a599148f3a4dba5bb03b28
MD5 aae37ce907d2ff569653487eeb078809
SHA1 235854f838a62c1a622ac0c1157d6f2bfb013479
SHA512 a03bf178116c443cad321316f1cd928f08e0e1074c4adc7ba8ba3cc2332bb3e1f62a37b8610c3e0345cd552faaba811df5d8ec8803238a8cf80f1fc3ff14076a
SSDEEP 6144:9de/XTSzla473WQcvrGpqlU44kOSAKvcf:OXwla47WQ6rkqlU
TLSH
T112348C517BD1C97BE99B26344537C73A867AB6320720C1CBE3290E3A5E316C19D3636B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

104887

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\vmagent_new\bin\joblist\879641\out\Release\Release\PDown.pdb

kernel32

GetFileAttributesW WideCharToMultiByte FindClose FindFirstFileW CreateEventW CloseHandle GetFileSizeEx Sleep CreateFileW GetLastError SetEvent MoveFileW DeleteFileW WriteFile GetPrivateProfileIntW MultiByteToWideChar MoveFileExW ReadFile GetTickCount GetSystemInfo GlobalMemoryStatusEx GetModuleHandleExW FreeLibraryAndExitThread WaitForSingleObject LoadLibraryW GetCurrentProcessId GetProcAddress FreeLibrary CreateProcessW GetStartupInfoW TerminateProcess GetCurrentProcess OpenProcess InterlockedDecrement InterlockedIncrement ReleaseMutex SetFilePointer SetEndOfFile CreateMutexW GetCurrentThreadId GetLocalTime CopyFileW DeviceIoControl LoadLibraryExW GetModuleHandleW FindResourceExW FindResourceW FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount LoadResource LockResource SizeofResource LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetStringTypeW GetStringTypeA GetLocaleInfoA LoadLibraryA GetConsoleMode GetConsoleCP VirtualAlloc QueryPerformanceCounter VirtualFree HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetModuleFileNameW GetFileType SetHandleCount LCMapStringA ExitProcess LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleHandleA GetModuleFileNameA GetStdHandle GetCommandLineA CreateThread ExitThread RtlUnwind InitializeCriticalSection RaiseException HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap CreateFileA SystemTimeToFileTime GetSystemTimeAsFileTime LocalFileTimeToFileTime SetFilePointerEx SetLastError TlsGetValue OutputDebugStringW TlsSetValue HeapUnlock OpenThread HeapLock HeapWalk TlsAlloc TlsFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent

user32

DestroyWindow DispatchMessageW TranslateMessage PostThreadMessageW SendMessageTimeoutW GetWindowThreadProcessId MessageBoxW WaitForInputIdle FindWindowW IsWindow RegisterClassW UnregisterClassW DefWindowProcW CreateWindowExW GetMessageW

advapi32

RegEnumKeyExW RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegQueryValueExA

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize CoUninitialize CLSIDFromProgID CoCreateInstance

oleaut32

SysAllocString SysFreeString

shlwapi

PathFileExistsW StrStrIW StrCmpIW PathFindFileNameW PathAppendW PathCombineW PathRemoveFileSpecW wvnsprintfW

ws2_32

closesocket ntohs WSAStartup WSACleanup WSAGetLastError recvfrom WSAWaitForMultipleEvents gethostbyname WSAEventSelect sendto

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

27fe1c4aa72b24bb14f5b1817159447ab355313d74a599148f3a4dba5bb03b28

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

version

generic