0580597a150719428958c7dd143342828d6288cf716c99d0e160f974105d3fa4

Sharing

Copy URL Twitter E-mail

General

Target
0580597a150719428958c7dd143342828d6288cf716c99d0e160f974105d3fa4
Size 4.8MB
Sample260722-bc12fstvbw
SHA256 0580597a150719428958c7dd143342828d6288cf716c99d0e160f974105d3fa4
MD5 dccbfd8ea1c18529a72a92149fd59550
SHA1 098fa4e478669c965ed73cd29b3fffb6b563f01c
SHA512 8444328b703257be71895fdb3f047dadb27586ac1dd7ca1b698f2f68ea01def03d4fe21128fb5eda248ece121e59888a5f2bae2531aa3d99d2cded8e9531fbd9
SSDEEP 98304:cLjfmTlHanM9fyBAF2jIwdWkJXLyvAzJZi:c/eAcuvdVJuKTi
TLSH
T18036F131BA43C036E5B641B19E7D9AAF816DB7340B3459CB73C80F2E1E605C35E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0580597a150719428958c7dd143342828d6288cf716c99d0e160f974105d3fa4

File Explorer

0580597a150719428958c7dd143342828d6288cf716c99d0e160f974105d3fa4

.exe 4.8MB

0580597a150719428958c7dd143342828d6288cf716c99d0e160f974105d3fa4

IMPHASH 6e7da919ef5e6a478ed32c4f8945856d
SHA256 0580597a150719428958c7dd143342828d6288cf716c99d0e160f974105d3fa4
MD5 dccbfd8ea1c18529a72a92149fd59550
SHA1 098fa4e478669c965ed73cd29b3fffb6b563f01c
SHA512 8444328b703257be71895fdb3f047dadb27586ac1dd7ca1b698f2f68ea01def03d4fe21128fb5eda248ece121e59888a5f2bae2531aa3d99d2cded8e9531fbd9
SSDEEP 98304:cLjfmTlHanM9fyBAF2jIwdWkJXLyvAzJZi:c/eAcuvdVJuKTi
TLSH
T18036F131BA43C036E5B641B19E7D9AAF816DB7340B3459CB73C80F2E1E605C35E36A66
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1037542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\836521\out\Release\SudaSetup.pdb

kernel32

InterlockedDecrement GetFileSizeEx ReadFile SetFilePointerEx GlobalAlloc GlobalFree GetLongPathNameW OpenProcess SetEndOfFile GetDiskFreeSpaceExW SetFileAttributesW DeleteFileW MoveFileExW GetVolumeInformationW GetFileAttributesExW GetCurrentProcess OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetVersionExW InterlockedIncrement GetCommandLineW GetFileInformationByHandle GetStdHandle SetFileTime GetCurrentDirectoryW CreateDirectoryW GetFileAttributesW GlobalMemoryStatus GetProcessAffinityMask IsProcessorFeaturePresent ReleaseSemaphore MapViewOfFile GetCurrentThreadId LoadLibraryW CreateFileMappingW UnmapViewOfFile InterlockedCompareExchange GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW SetFilePointer WriteFile SizeofResource LoadResource GetProcessHeap HeapSize HeapDestroy WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode FindFirstFileW FlushFileBuffers GetTimeZoneInformation FindClose IsValidLocale GetFileType ExitProcess ExitThread RtlUnwind LockResource GetModuleFileNameW DeleteCriticalSection InitializeCriticalSection GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP MulDiv VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo FormatMessageW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent FindNextFileW GetConsoleCP GetLastError RaiseException CloseHandle GetLocalTime LocalFree Process32NextW Process32FirstW EnumSystemLocalesW CreateToolhelp32Snapshot CreateFileW

user32

BringWindowToTop PostMessageW DefWindowProcW RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow GetWindowLongW SetWindowLongW AttachThreadInput IsIconic CloseClipboard SetActiveWindow GetForegroundWindow SetForegroundWindow FindWindowW GetWindowThreadProcessId wsprintfW SetWindowPos IsWindowVisible GetDesktopWindow DrawTextW GetSysColor ClientToScreen GetAsyncKeyState EmptyClipboard SetClipboardData UnionRect IntersectRect SetCursor EqualRect MonitorFromPoint SetWindowTextW EnableWindow SetFocus GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect GetSystemMetrics KillTimer SetTimer PostQuitMessage SendMessageW CharUpperW PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW IsClipboardFormatAvailable GetClipboardData LoadCursorW OpenClipboard CallWindowProcW RegisterClassW UpdateLayeredWindow MoveWindow IsZoomed GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect SetWindowRgn InvalidateRect GetCursorPos ScreenToClient OffsetRect IsRectEmpty PtInRect

advapi32

EnumServicesStatusW RegDeleteKeyW RegEnumKeyExA RegCloseKey RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken OpenSCManagerW RegDeleteValueW CloseServiceHandle RegOpenKeyW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA

shell32

ShellExecuteExW ShellExecuteW SHBrowseForFolderW SHGetSpecialFolderPathW SHGetPathFromIDListW SHFileOperationW CommandLineToArgvW ord165 SHGetFolderPathW

ole32

OleUninitialize OleInitialize CoTaskMemRealloc CreateStreamOnHGlobal CoCreateGuid CoCreateInstance CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

SysFreeString VarUI4FromStr VariantClear SysStringLen SysAllocString SysAllocStringLen

shlwapi

PathAddBackslashW StrStrIW StrCmpNIW StrCmpIW PathFindFileNameW PathCombineW PathAppendW SHDeleteValueW StrTrimA PathCanonicalizeW PathIsDirectoryW PathRemoveFileSpecW SHSetValueA SHGetValueA PathIsPrefixW SHGetValueW StrStrIA PathRemoveExtensionW SHSetValueW StrCpyNW PathFileExistsW PathIsRelativeW PathRemoveBackslashW

version

VerQueryValueW

psapi

GetModuleFileNameExW

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

crypt32

CryptBinaryToStringA

iphlpapi

GetAdaptersInfo

wininet

InternetConnectW HttpQueryInfoW HttpOpenRequestW InternetSetOptionW InternetCloseHandle InternetCrackUrlW InternetOpenW HttpSendRequestW

msi

ord217 ord173

gdi32

CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC DeleteObject CreateCompatibleDC DeleteDC SelectObject SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection GetObjectA SetWindowOrgEx BitBlt CreateRoundRectRgn ExtSelectClipRgn

gdiplus

GdipMeasureString GdipStringFormatGetGenericTypographic GdipResetClip GdipSetClipPath GdipCreateFontFromDC GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipDrawString GdipCreateFontFromLogfontA GdipDrawImageRectRectI GdipDeleteFont GdipSetStringFormatAlign GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCloneBrush GdipDeleteBrush GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipFillRegion GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath

msimg32

AlphaBlend

generic

count=31, id=241, version=40116,

count=192, id=243, version=40116,

count=39, id=242, version=40116,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=3, id=199, version=41118,

count=29, id=259, version=26706,

count=67, id=261, version=27051,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=12, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=134, id=261, version=26706,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=662, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=32, id=260, version=27048,

count=112, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,