458454286ed825809a1d4e60430e67a923d4030eb341353da3a6be49c1ce793e

Sharing

Copy URL Twitter E-mail

General

Target
458454286ed825809a1d4e60430e67a923d4030eb341353da3a6be49c1ce793e
Size 4.8MB
Sample260720-fe4mkse16l
SHA256 458454286ed825809a1d4e60430e67a923d4030eb341353da3a6be49c1ce793e
MD5 bfb99ba6e1cab718d85ca8d679e78648
SHA1 d9f54fd822b47a12ed6ccf0ed787998c8828506e
SHA512 ca9b79572d3dbd22ace9a0bcb3fe3754fa3e1e0cf2516b73aeafbf71f10df5dd90678fb4c2545a8affae69248a39ea2765047940ae7a71a1e5845889e21f388a
SSDEEP 98304:cLjfmTlHanM9fyBAF2jIwdWkJXLyvAzJZu:c/eAcuvdVJuKTu
TLSH
T11536F131BA43C036E5B641B19E7D9AAF816DB7340B3459CB73C80F2E1E605C35E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
458454286ed825809a1d4e60430e67a923d4030eb341353da3a6be49c1ce793e

File Explorer

458454286ed825809a1d4e60430e67a923d4030eb341353da3a6be49c1ce793e

.exe 4.8MB

458454286ed825809a1d4e60430e67a923d4030eb341353da3a6be49c1ce793e

IMPHASH 6e7da919ef5e6a478ed32c4f8945856d
SHA256 458454286ed825809a1d4e60430e67a923d4030eb341353da3a6be49c1ce793e
MD5 bfb99ba6e1cab718d85ca8d679e78648
SHA1 d9f54fd822b47a12ed6ccf0ed787998c8828506e
SHA512 ca9b79572d3dbd22ace9a0bcb3fe3754fa3e1e0cf2516b73aeafbf71f10df5dd90678fb4c2545a8affae69248a39ea2765047940ae7a71a1e5845889e21f388a
SSDEEP 98304:cLjfmTlHanM9fyBAF2jIwdWkJXLyvAzJZu:c/eAcuvdVJuKTu
TLSH
T11536F131BA43C036E5B641B19E7D9AAF816DB7340B3459CB73C80F2E1E605C35E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1037542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\836521\out\Release\SudaSetup.pdb

kernel32

InterlockedDecrement GetFileSizeEx ReadFile SetFilePointerEx GlobalAlloc GlobalFree GetLongPathNameW OpenProcess SetEndOfFile GetDiskFreeSpaceExW SetFileAttributesW DeleteFileW MoveFileExW GetVolumeInformationW GetFileAttributesExW GetCurrentProcess OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetVersionExW InterlockedIncrement GetCommandLineW GetFileInformationByHandle GetStdHandle SetFileTime GetCurrentDirectoryW CreateDirectoryW GetFileAttributesW GlobalMemoryStatus GetProcessAffinityMask IsProcessorFeaturePresent ReleaseSemaphore MapViewOfFile GetCurrentThreadId LoadLibraryW CreateFileMappingW UnmapViewOfFile InterlockedCompareExchange GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW SetFilePointer WriteFile SizeofResource LoadResource GetProcessHeap HeapSize HeapDestroy WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode FindFirstFileW FlushFileBuffers GetTimeZoneInformation FindClose IsValidLocale GetFileType ExitProcess ExitThread RtlUnwind LockResource GetModuleFileNameW DeleteCriticalSection InitializeCriticalSection GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP MulDiv VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo FormatMessageW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent FindNextFileW GetConsoleCP GetLastError RaiseException CloseHandle GetLocalTime LocalFree Process32NextW Process32FirstW EnumSystemLocalesW CreateToolhelp32Snapshot CreateFileW

user32

BringWindowToTop PostMessageW DefWindowProcW RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow GetWindowLongW SetWindowLongW AttachThreadInput IsIconic CloseClipboard SetActiveWindow GetForegroundWindow SetForegroundWindow FindWindowW GetWindowThreadProcessId wsprintfW SetWindowPos IsWindowVisible GetDesktopWindow DrawTextW GetSysColor ClientToScreen GetAsyncKeyState EmptyClipboard SetClipboardData UnionRect IntersectRect SetCursor EqualRect MonitorFromPoint SetWindowTextW EnableWindow SetFocus GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect GetSystemMetrics KillTimer SetTimer PostQuitMessage SendMessageW CharUpperW PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW IsClipboardFormatAvailable GetClipboardData LoadCursorW OpenClipboard CallWindowProcW RegisterClassW UpdateLayeredWindow MoveWindow IsZoomed GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect SetWindowRgn InvalidateRect GetCursorPos ScreenToClient OffsetRect IsRectEmpty PtInRect

advapi32

EnumServicesStatusW RegDeleteKeyW RegEnumKeyExA RegCloseKey RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken OpenSCManagerW RegDeleteValueW CloseServiceHandle RegOpenKeyW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA

shell32

ShellExecuteExW ShellExecuteW SHBrowseForFolderW SHGetSpecialFolderPathW SHGetPathFromIDListW SHFileOperationW CommandLineToArgvW ord165 SHGetFolderPathW

ole32

OleUninitialize OleInitialize CoTaskMemRealloc CreateStreamOnHGlobal CoCreateGuid CoCreateInstance CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

SysFreeString VarUI4FromStr VariantClear SysStringLen SysAllocString SysAllocStringLen

shlwapi

PathAddBackslashW StrStrIW StrCmpNIW StrCmpIW PathFindFileNameW PathCombineW PathAppendW SHDeleteValueW StrTrimA PathCanonicalizeW PathIsDirectoryW PathRemoveFileSpecW SHSetValueA SHGetValueA PathIsPrefixW SHGetValueW StrStrIA PathRemoveExtensionW SHSetValueW StrCpyNW PathFileExistsW PathIsRelativeW PathRemoveBackslashW

version

VerQueryValueW

psapi

GetModuleFileNameExW

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

crypt32

CryptBinaryToStringA

iphlpapi

GetAdaptersInfo

wininet

InternetConnectW HttpQueryInfoW HttpOpenRequestW InternetSetOptionW InternetCloseHandle InternetCrackUrlW InternetOpenW HttpSendRequestW

msi

ord217 ord173

gdi32

CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC DeleteObject CreateCompatibleDC DeleteDC SelectObject SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection GetObjectA SetWindowOrgEx BitBlt CreateRoundRectRgn ExtSelectClipRgn

gdiplus

GdipMeasureString GdipStringFormatGetGenericTypographic GdipResetClip GdipSetClipPath GdipCreateFontFromDC GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipDrawString GdipCreateFontFromLogfontA GdipDrawImageRectRectI GdipDeleteFont GdipSetStringFormatAlign GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCloneBrush GdipDeleteBrush GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipFillRegion GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath

msimg32

AlphaBlend

generic

count=31, id=241, version=40116,

count=192, id=243, version=40116,

count=39, id=242, version=40116,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=3, id=199, version=41118,

count=29, id=259, version=26706,

count=67, id=261, version=27051,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=12, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=134, id=261, version=26706,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=662, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=32, id=260, version=27048,

count=112, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,