db3edc880e4c90390cbd323babf86433364bdcdd1a9fef402679132bbf414a70

Sharing

Copy URL Twitter E-mail

General

Target
db3edc880e4c90390cbd323babf86433364bdcdd1a9fef402679132bbf414a70
Size 4.8MB
Sample260711-3gc9qsds8x
SHA256 db3edc880e4c90390cbd323babf86433364bdcdd1a9fef402679132bbf414a70
MD5 b5bc30108b44c9c376e82a924b351a11
SHA1 3e7242d3325c481ebe01dfdc932b6c4a778246b9
SHA512 f2f2b35ba6fe698e9c0fc735bd0b753f2fd349c4a9975487f0839080528bc98e8af0569815092248c75ca107580fbf94cd80ad6cda4c8ec512964bf45e71876d
SSDEEP 98304:cLjfmTlHanM9fyBAF2jIwdWkJXLyvAzJZC:c/eAcuvdVJuKTC
TLSH
T16D36F131BA43C036E5B641B19E7D9AAF816DB7340B3459CB73C80F2E1E605C35E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db3edc880e4c90390cbd323babf86433364bdcdd1a9fef402679132bbf414a70

File Explorer

db3edc880e4c90390cbd323babf86433364bdcdd1a9fef402679132bbf414a70

.exe 4.8MB

db3edc880e4c90390cbd323babf86433364bdcdd1a9fef402679132bbf414a70

IMPHASH 6e7da919ef5e6a478ed32c4f8945856d
SHA256 db3edc880e4c90390cbd323babf86433364bdcdd1a9fef402679132bbf414a70
MD5 b5bc30108b44c9c376e82a924b351a11
SHA1 3e7242d3325c481ebe01dfdc932b6c4a778246b9
SHA512 f2f2b35ba6fe698e9c0fc735bd0b753f2fd349c4a9975487f0839080528bc98e8af0569815092248c75ca107580fbf94cd80ad6cda4c8ec512964bf45e71876d
SSDEEP 98304:cLjfmTlHanM9fyBAF2jIwdWkJXLyvAzJZC:c/eAcuvdVJuKTC
TLSH
T16D36F131BA43C036E5B641B19E7D9AAF816DB7340B3459CB73C80F2E1E605C35E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1037542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\836521\out\Release\SudaSetup.pdb

kernel32

InterlockedDecrement GetFileSizeEx ReadFile SetFilePointerEx GlobalAlloc GlobalFree GetLongPathNameW OpenProcess SetEndOfFile GetDiskFreeSpaceExW SetFileAttributesW DeleteFileW MoveFileExW GetVolumeInformationW GetFileAttributesExW GetCurrentProcess OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetVersionExW InterlockedIncrement GetCommandLineW GetFileInformationByHandle GetStdHandle SetFileTime GetCurrentDirectoryW CreateDirectoryW GetFileAttributesW GlobalMemoryStatus GetProcessAffinityMask IsProcessorFeaturePresent ReleaseSemaphore MapViewOfFile GetCurrentThreadId LoadLibraryW CreateFileMappingW UnmapViewOfFile InterlockedCompareExchange GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW SetFilePointer WriteFile SizeofResource LoadResource GetProcessHeap HeapSize HeapDestroy WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode FindFirstFileW FlushFileBuffers GetTimeZoneInformation FindClose IsValidLocale GetFileType ExitProcess ExitThread RtlUnwind LockResource GetModuleFileNameW DeleteCriticalSection InitializeCriticalSection GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP MulDiv VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo FormatMessageW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent FindNextFileW GetConsoleCP GetLastError RaiseException CloseHandle GetLocalTime LocalFree Process32NextW Process32FirstW EnumSystemLocalesW CreateToolhelp32Snapshot CreateFileW

user32

BringWindowToTop PostMessageW DefWindowProcW RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow GetWindowLongW SetWindowLongW AttachThreadInput IsIconic CloseClipboard SetActiveWindow GetForegroundWindow SetForegroundWindow FindWindowW GetWindowThreadProcessId wsprintfW SetWindowPos IsWindowVisible GetDesktopWindow DrawTextW GetSysColor ClientToScreen GetAsyncKeyState EmptyClipboard SetClipboardData UnionRect IntersectRect SetCursor EqualRect MonitorFromPoint SetWindowTextW EnableWindow SetFocus GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect GetSystemMetrics KillTimer SetTimer PostQuitMessage SendMessageW CharUpperW PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW IsClipboardFormatAvailable GetClipboardData LoadCursorW OpenClipboard CallWindowProcW RegisterClassW UpdateLayeredWindow MoveWindow IsZoomed GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect SetWindowRgn InvalidateRect GetCursorPos ScreenToClient OffsetRect IsRectEmpty PtInRect

advapi32

EnumServicesStatusW RegDeleteKeyW RegEnumKeyExA RegCloseKey RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken OpenSCManagerW RegDeleteValueW CloseServiceHandle RegOpenKeyW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA

shell32

ShellExecuteExW ShellExecuteW SHBrowseForFolderW SHGetSpecialFolderPathW SHGetPathFromIDListW SHFileOperationW CommandLineToArgvW ord165 SHGetFolderPathW

ole32

OleUninitialize OleInitialize CoTaskMemRealloc CreateStreamOnHGlobal CoCreateGuid CoCreateInstance CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

SysFreeString VarUI4FromStr VariantClear SysStringLen SysAllocString SysAllocStringLen

shlwapi

PathAddBackslashW StrStrIW StrCmpNIW StrCmpIW PathFindFileNameW PathCombineW PathAppendW SHDeleteValueW StrTrimA PathCanonicalizeW PathIsDirectoryW PathRemoveFileSpecW SHSetValueA SHGetValueA PathIsPrefixW SHGetValueW StrStrIA PathRemoveExtensionW SHSetValueW StrCpyNW PathFileExistsW PathIsRelativeW PathRemoveBackslashW

version

VerQueryValueW

psapi

GetModuleFileNameExW

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

crypt32

CryptBinaryToStringA

iphlpapi

GetAdaptersInfo

wininet

InternetConnectW HttpQueryInfoW HttpOpenRequestW InternetSetOptionW InternetCloseHandle InternetCrackUrlW InternetOpenW HttpSendRequestW

msi

ord217 ord173

gdi32

CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC DeleteObject CreateCompatibleDC DeleteDC SelectObject SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection GetObjectA SetWindowOrgEx BitBlt CreateRoundRectRgn ExtSelectClipRgn

gdiplus

GdipMeasureString GdipStringFormatGetGenericTypographic GdipResetClip GdipSetClipPath GdipCreateFontFromDC GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipDrawString GdipCreateFontFromLogfontA GdipDrawImageRectRectI GdipDeleteFont GdipSetStringFormatAlign GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCloneBrush GdipDeleteBrush GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipFillRegion GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath

msimg32

AlphaBlend

generic

count=31, id=241, version=40116,

count=192, id=243, version=40116,

count=39, id=242, version=40116,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=3, id=199, version=41118,

count=29, id=259, version=26706,

count=67, id=261, version=27051,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=12, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=134, id=261, version=26706,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=662, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=32, id=260, version=27048,

count=112, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,