cffe3fdf0de7316d7c55ef9e92c36277740a4cbb5527903524bcae7f53fd7cd1

Sharing

Copy URL Twitter E-mail

General

Target
cffe3fdf0de7316d7c55ef9e92c36277740a4cbb5527903524bcae7f53fd7cd1
Size 4.8MB
Sample260722-ramn2sfe57
SHA256 cffe3fdf0de7316d7c55ef9e92c36277740a4cbb5527903524bcae7f53fd7cd1
MD5 72ad11e0c6427d5b57a0cdfaa7381b36
SHA1 276d6e68f26d81dc5a63790f28775fd6f8939313
SHA512 932678a1950c0f7b3e756c095de6a5f4f2d10c1012a4cb698ef165dc997854f6f6295a209390cf0097f17a2c5c7a28b9eefd8a150d09af4966cc01aadc0a33df
SSDEEP 98304:U27DOlNUcF5IOgqUXVBXNPL2Wf5N8er4XuN5oxqpCgbHyod0:UhF5dqRLB5N8S4XuN56qlyod0
TLSH
T15A3612213D82C035E6962132C97CFA6B466DAF201B3656EB639C1B3D1F705D32E32667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cffe3fdf0de7316d7c55ef9e92c36277740a4cbb5527903524bcae7f53fd7cd1

File Explorer

cffe3fdf0de7316d7c55ef9e92c36277740a4cbb5527903524bcae7f53fd7cd1

.exe 4.8MB

cffe3fdf0de7316d7c55ef9e92c36277740a4cbb5527903524bcae7f53fd7cd1

IMPHASH 8cf418129bdc8bc7d6f254bdf2bb92cc
SHA256 cffe3fdf0de7316d7c55ef9e92c36277740a4cbb5527903524bcae7f53fd7cd1
MD5 72ad11e0c6427d5b57a0cdfaa7381b36
SHA1 276d6e68f26d81dc5a63790f28775fd6f8939313
SHA512 932678a1950c0f7b3e756c095de6a5f4f2d10c1012a4cb698ef165dc997854f6f6295a209390cf0097f17a2c5c7a28b9eefd8a150d09af4966cc01aadc0a33df
SSDEEP 98304:U27DOlNUcF5IOgqUXVBXNPL2Wf5N8er4XuN5oxqpCgbHyod0:UhF5dqRLB5N8S4XuN56qlyod0
TLSH
T15A3612213D82C035E6962132C97CFA6B466DAF201B3656EB639C1B3D1F705D32E32667
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

499047

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\977679\out\Release\CadCompSetup.pdb

kernel32

FindResourceW FindResourceExW GetComputerNameW GetLocalTime FormatMessageW LocalFree GetExitCodeProcess GetCurrentThreadId WriteFile SetFilePointer GetFileSize CreateFileMappingW MapViewOfFileEx UnmapViewOfFile InterlockedCompareExchange LoadLibraryW lstrlenA OutputDebugStringW GetPrivateProfileStringW GetPrivateProfileIntW PostQueuedCompletionStatus GetExitCodeThread TerminateThread CreateIoCompletionPort GetQueuedCompletionStatus MapViewOfFile CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileSizeEx ReadFile SetFilePointerEx FlushViewOfFile SetEndOfFile GlobalAlloc GlobalFree FindFirstFileW DeleteFileW FindNextFileW FindClose RemoveDirectoryW MoveFileExW SetFileAttributesW GetLongPathNameW IsBadReadPtr GetWindowsDirectoryW GetDriveTypeW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetVolumeInformationW OpenProcess lstrlenW lstrcpynA GetFileAttributesExW Thread32First Thread32Next GetCurrentProcess lstrcmpiW VirtualAllocEx WriteProcessMemory VirtualFreeEx CreateRemoteThread ReadProcessMemory lstrcpyW Module32FirstW Module32NextW lstrcmpA OpenThread GetModuleHandleExW OutputDebugStringA OpenEventW ResumeThread ExpandEnvironmentStringsW GetThreadLocale SetThreadLocale GlobalLock GlobalSize GlobalUnlock GetVersionExW GetWindowsDirectoryA GetTempPathW SystemTimeToFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleHandleA GlobalMemoryStatusEx GetCommandLineW GetSystemDefaultLCID ReadConsoleW WriteConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetFileType GetACP LockResource ExitProcess ExitThread VirtualQuery RtlUnwind WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle SetProcessAffinityMask FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority SizeofResource GetProcessHeap HeapSize HeapDestroy InterlockedExchange CreateProcessW InitializeCriticalSection DeleteCriticalSection EnumDateFormatsExW EnumCalendarInfoExW GetCurrencyFormatW GetNumberFormatW GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess GetProcessTimes CreateWaitableTimerW CreateSemaphoreW Sleep CreateEventW CreateEventA CreateMutexW CreateMutexA WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CancelIo DeviceIoControl HeapFree HeapReAlloc HeapAlloc CreateThread SignalObjectAndWait CreateTimerQueue RtlCaptureStackBackTrace ReleaseSemaphore GetProcessAffinityMask GlobalMemoryStatus DosDateTimeToFileTime FileTimeToDosDateTime FileTimeToLocalFileTime MoveFileW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW CompareFileTime FindCloseChangeNotification FindFirstChangeNotificationW GetFileAttributesW GetStdHandle GetFileInformationByHandle SetFileTime InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime IsDebuggerPresent LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo TryEnterCriticalSection GetStringTypeW LoadResource GetCurrentProcessId GetModuleFileNameW GetModuleFileNameA SetErrorMode SetLastError GetLastError RaiseException CloseHandle AreFileApisANSI GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GetFullPathNameW GetUserDefaultLCID CreateFileW

user32

BringWindowToTop SetActiveWindow PostMessageW DispatchMessageW UnhookWinEvent PostThreadMessageW UnregisterClassW GetMessageW SetWinEventHook UpdateWindow InvalidateRect AttachThreadInput GetForegroundWindow GetWindowThreadProcessId IsWindow RegisterClassExW CreateWindowExW SetForegroundWindow SetWindowLongW ShowWindow IsIconic GetClassLongW DestroyWindow GetWindowLongW DefWindowProcW wsprintfW GetActiveWindow MessageBoxW EnumWindows EnumDesktopWindows IsWindowVisible SetWindowPos WaitForInputIdle OpenClipboard IsClipboardFormatAvailable GetClipboardData CloseClipboard FindWindowW GetClassNameW GetWindowTextW SetLayeredWindowAttributes CharUpperW SendMessageW TranslateMessage

gdi32

SelectObject CreateCompatibleDC GetObjectW SetDIBColorTable DeleteDC DeleteObject CreateDIBSection

advapi32

RegEnumKeyExW RevertToSelf RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteKeyA RegDeleteKeyW RegDeleteValueA RegDeleteValueW RegOpenKeyExA RegOpenKeyExW ConvertSidToStringSidW LookupAccountNameW GetUserNameW GetUserNameA LookupAccountNameA GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid LookupAccountSidW GetTokenInformation FreeSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW EnumServicesStatusExW CreateProcessAsUserW DuplicateTokenEx AccessCheck MapGenericMask DuplicateToken OpenProcessToken GetFileSecurityW CloseServiceHandle EnumServicesStatusW OpenSCManagerW RegOpenKeyW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA ImpersonateSelf

shell32

SHGetFolderPathW ord16 SHGetFolderLocation ord102 ShellExecuteExW ord165 ord232 ShellExecuteW SHGetSpecialFolderPathW ord680 SHGetFileInfoW ord178 ord155 ord18 CommandLineToArgvW SHGetDesktopFolder ord17

ole32

CLSIDFromString CoCreateGuid CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoCreateInstance StringFromCLSID CoTaskMemAlloc

oleaut32

VariantClear VariantInit VariantCopy SysAllocStringByteLen SysStringLen SysAllocStringLen SysFreeString SysAllocString

shlwapi

StrCmpNIW PathRelativePathToW PathCommonPrefixW PathIsPrefixW StrFormatByteSizeW PathCanonicalizeW PathIsDirectoryW PathIsRootW StrCmpIW PathRemoveBackslashW StrCpyNW ord176 SHSetValueW SHDeleteValueW StrStrIW UrlGetPartW SHDeleteKeyA SHDeleteKeyW SHQueryValueExA SHQueryValueExW SHCopyKeyA SHCopyKeyW PathFileExistsW PathRemoveFileSpecW PathAppendW PathCombineW PathFindFileNameW PathFindExtensionW PathAppendA SHGetValueW

ws2_32

select WSASetLastError __WSAFDIsSet

version

GetFileVersionInfoW GetFileVersionInfoA GetFileVersionInfoSizeW GetFileVersionInfoSizeA VerQueryValueW

psapi

EnumPageFilesA EnumPageFilesW GetPerformanceInfo GetDeviceDriverFileNameW GetDeviceDriverFileNameA EnumProcessModules GetModuleFileNameExA GetModuleFileNameExW GetWsChanges GetProcessImageFileNameA GetProcessImageFileNameW GetModuleBaseNameA GetModuleBaseNameW EmptyWorkingSet QueryWorkingSet InitializeProcessForWsWatch GetMappedFileNameW GetMappedFileNameA EnumDeviceDrivers GetDeviceDriverBaseNameA GetDeviceDriverBaseNameW

wintrust

CryptCATAdminEnumCatalogFromHash CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminAcquireContext CryptCATAdminReleaseCatalogContext CryptCATCatalogInfoFromContext WinVerifyTrust WTHelperProvDataFromStateData

crypt32

CertCloseStore CertFreeCertificateContext CertFindCertificateInStore CryptMsgClose CryptQueryObject CryptStringToBinaryW CryptBinaryToStringW CryptBinaryToStringA CryptMsgGetParam CertGetNameStringW CryptStringToBinaryA

iphlpapi

GetAdaptersInfo GetIpAddrTable

gdiplus

GdipDeleteGraphics GdipDrawImageI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipFree GdipGetImagePalette GdipGetImageGraphicsContext GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipDisposeImage GdipBitmapUnlockBits GdiplusStartup GdiplusShutdown GdipCreateBitmapFromFileICM GdipAlloc GdipGetImagePaletteSize

dbghelp

ImageNtHeader ImageDirectoryEntryToData

wininet

InternetCrackUrlW InternetConnectW InternetOpenW HttpOpenRequestW HttpSendRequestW InternetCloseHandle InternetSetOptionW HttpQueryInfoW InternetReadFile InternetSetFilePointer

setupapi

SetupIterateCabinetW

msi

ord173 ord217

winmm

timeKillEvent timeSetEvent

generic

count=18, id=241, version=40116,

count=163, id=243, version=40116,

count=31, id=242, version=40116,

count=12, id=260, version=27051,

count=36, id=261, version=27051,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=129, id=261, version=26706,

count=36, id=260, version=26706,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=491, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=49, id=265, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,