69b165d686caff50c820006ebeb6faa2d9a5dfaaa69b0d3629f26049e210138f

Sharing

Copy URL Twitter E-mail

General

Target
69b165d686caff50c820006ebeb6faa2d9a5dfaaa69b0d3629f26049e210138f
Size 4.8MB
Sample260802-eslhgsvamd
SHA256 69b165d686caff50c820006ebeb6faa2d9a5dfaaa69b0d3629f26049e210138f
MD5 ee8c111ef543361024fbd7697c1abd08
SHA1 298dbc0307b6b9b1c81545dfbb715589a84b9e43
SHA512 e26e40aeca6f4ba3f5835524819130804377a09a425860abdd95081ea9fe651e830435748b5af42c383d52eebb4911b2a4f92e5e827b143e6c0c881b91600721
SSDEEP 98304:U27DOlNUcF5IOgqUXVBXNPL2Wf5N8er4XuN5oxqpCgbHyodq:UhF5dqRLB5N8S4XuN56qlyodq
TLSH
T13E3612213D82C035E6962132C97CFA6B466DAF201B3656EB639C1B3D1F705D32E32667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69b165d686caff50c820006ebeb6faa2d9a5dfaaa69b0d3629f26049e210138f

File Explorer

69b165d686caff50c820006ebeb6faa2d9a5dfaaa69b0d3629f26049e210138f

.exe 4.8MB

69b165d686caff50c820006ebeb6faa2d9a5dfaaa69b0d3629f26049e210138f

IMPHASH 8cf418129bdc8bc7d6f254bdf2bb92cc
SHA256 69b165d686caff50c820006ebeb6faa2d9a5dfaaa69b0d3629f26049e210138f
MD5 ee8c111ef543361024fbd7697c1abd08
SHA1 298dbc0307b6b9b1c81545dfbb715589a84b9e43
SHA512 e26e40aeca6f4ba3f5835524819130804377a09a425860abdd95081ea9fe651e830435748b5af42c383d52eebb4911b2a4f92e5e827b143e6c0c881b91600721
SSDEEP 98304:U27DOlNUcF5IOgqUXVBXNPL2Wf5N8er4XuN5oxqpCgbHyodq:UhF5dqRLB5N8S4XuN56qlyodq
TLSH
T13E3612213D82C035E6962132C97CFA6B466DAF201B3656EB639C1B3D1F705D32E32667
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

499047

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\977679\out\Release\CadCompSetup.pdb

kernel32

FindResourceW FindResourceExW GetComputerNameW GetLocalTime FormatMessageW LocalFree GetExitCodeProcess GetCurrentThreadId WriteFile SetFilePointer GetFileSize CreateFileMappingW MapViewOfFileEx UnmapViewOfFile InterlockedCompareExchange LoadLibraryW lstrlenA OutputDebugStringW GetPrivateProfileStringW GetPrivateProfileIntW PostQueuedCompletionStatus GetExitCodeThread TerminateThread CreateIoCompletionPort GetQueuedCompletionStatus MapViewOfFile CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileSizeEx ReadFile SetFilePointerEx FlushViewOfFile SetEndOfFile GlobalAlloc GlobalFree FindFirstFileW DeleteFileW FindNextFileW FindClose RemoveDirectoryW MoveFileExW SetFileAttributesW GetLongPathNameW IsBadReadPtr GetWindowsDirectoryW GetDriveTypeW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetVolumeInformationW OpenProcess lstrlenW lstrcpynA GetFileAttributesExW Thread32First Thread32Next GetCurrentProcess lstrcmpiW VirtualAllocEx WriteProcessMemory VirtualFreeEx CreateRemoteThread ReadProcessMemory lstrcpyW Module32FirstW Module32NextW lstrcmpA OpenThread GetModuleHandleExW OutputDebugStringA OpenEventW ResumeThread ExpandEnvironmentStringsW GetThreadLocale SetThreadLocale GlobalLock GlobalSize GlobalUnlock GetVersionExW GetWindowsDirectoryA GetTempPathW SystemTimeToFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleHandleA GlobalMemoryStatusEx GetCommandLineW GetSystemDefaultLCID ReadConsoleW WriteConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetFileType GetACP LockResource ExitProcess ExitThread VirtualQuery RtlUnwind WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle SetProcessAffinityMask FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority SizeofResource GetProcessHeap HeapSize HeapDestroy InterlockedExchange CreateProcessW InitializeCriticalSection DeleteCriticalSection EnumDateFormatsExW EnumCalendarInfoExW GetCurrencyFormatW GetNumberFormatW GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess GetProcessTimes CreateWaitableTimerW CreateSemaphoreW Sleep CreateEventW CreateEventA CreateMutexW CreateMutexA WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CancelIo DeviceIoControl HeapFree HeapReAlloc HeapAlloc CreateThread SignalObjectAndWait CreateTimerQueue RtlCaptureStackBackTrace ReleaseSemaphore GetProcessAffinityMask GlobalMemoryStatus DosDateTimeToFileTime FileTimeToDosDateTime FileTimeToLocalFileTime MoveFileW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW CompareFileTime FindCloseChangeNotification FindFirstChangeNotificationW GetFileAttributesW GetStdHandle GetFileInformationByHandle SetFileTime InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime IsDebuggerPresent LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo TryEnterCriticalSection GetStringTypeW LoadResource GetCurrentProcessId GetModuleFileNameW GetModuleFileNameA SetErrorMode SetLastError GetLastError RaiseException CloseHandle AreFileApisANSI GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GetFullPathNameW GetUserDefaultLCID CreateFileW

user32

BringWindowToTop SetActiveWindow PostMessageW DispatchMessageW UnhookWinEvent PostThreadMessageW UnregisterClassW GetMessageW SetWinEventHook UpdateWindow InvalidateRect AttachThreadInput GetForegroundWindow GetWindowThreadProcessId IsWindow RegisterClassExW CreateWindowExW SetForegroundWindow SetWindowLongW ShowWindow IsIconic GetClassLongW DestroyWindow GetWindowLongW DefWindowProcW wsprintfW GetActiveWindow MessageBoxW EnumWindows EnumDesktopWindows IsWindowVisible SetWindowPos WaitForInputIdle OpenClipboard IsClipboardFormatAvailable GetClipboardData CloseClipboard FindWindowW GetClassNameW GetWindowTextW SetLayeredWindowAttributes CharUpperW SendMessageW TranslateMessage

gdi32

SelectObject CreateCompatibleDC GetObjectW SetDIBColorTable DeleteDC DeleteObject CreateDIBSection

advapi32

RegEnumKeyExW RevertToSelf RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteKeyA RegDeleteKeyW RegDeleteValueA RegDeleteValueW RegOpenKeyExA RegOpenKeyExW ConvertSidToStringSidW LookupAccountNameW GetUserNameW GetUserNameA LookupAccountNameA GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid LookupAccountSidW GetTokenInformation FreeSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW EnumServicesStatusExW CreateProcessAsUserW DuplicateTokenEx AccessCheck MapGenericMask DuplicateToken OpenProcessToken GetFileSecurityW CloseServiceHandle EnumServicesStatusW OpenSCManagerW RegOpenKeyW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA ImpersonateSelf

shell32

SHGetFolderPathW ord16 SHGetFolderLocation ord102 ShellExecuteExW ord165 ord232 ShellExecuteW SHGetSpecialFolderPathW ord680 SHGetFileInfoW ord178 ord155 ord18 CommandLineToArgvW SHGetDesktopFolder ord17

ole32

CLSIDFromString CoCreateGuid CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoCreateInstance StringFromCLSID CoTaskMemAlloc

oleaut32

VariantClear VariantInit VariantCopy SysAllocStringByteLen SysStringLen SysAllocStringLen SysFreeString SysAllocString

shlwapi

StrCmpNIW PathRelativePathToW PathCommonPrefixW PathIsPrefixW StrFormatByteSizeW PathCanonicalizeW PathIsDirectoryW PathIsRootW StrCmpIW PathRemoveBackslashW StrCpyNW ord176 SHSetValueW SHDeleteValueW StrStrIW UrlGetPartW SHDeleteKeyA SHDeleteKeyW SHQueryValueExA SHQueryValueExW SHCopyKeyA SHCopyKeyW PathFileExistsW PathRemoveFileSpecW PathAppendW PathCombineW PathFindFileNameW PathFindExtensionW PathAppendA SHGetValueW

ws2_32

select WSASetLastError __WSAFDIsSet

version

GetFileVersionInfoW GetFileVersionInfoA GetFileVersionInfoSizeW GetFileVersionInfoSizeA VerQueryValueW

psapi

EnumPageFilesA EnumPageFilesW GetPerformanceInfo GetDeviceDriverFileNameW GetDeviceDriverFileNameA EnumProcessModules GetModuleFileNameExA GetModuleFileNameExW GetWsChanges GetProcessImageFileNameA GetProcessImageFileNameW GetModuleBaseNameA GetModuleBaseNameW EmptyWorkingSet QueryWorkingSet InitializeProcessForWsWatch GetMappedFileNameW GetMappedFileNameA EnumDeviceDrivers GetDeviceDriverBaseNameA GetDeviceDriverBaseNameW

wintrust

CryptCATAdminEnumCatalogFromHash CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminAcquireContext CryptCATAdminReleaseCatalogContext CryptCATCatalogInfoFromContext WinVerifyTrust WTHelperProvDataFromStateData

crypt32

CertCloseStore CertFreeCertificateContext CertFindCertificateInStore CryptMsgClose CryptQueryObject CryptStringToBinaryW CryptBinaryToStringW CryptBinaryToStringA CryptMsgGetParam CertGetNameStringW CryptStringToBinaryA

iphlpapi

GetAdaptersInfo GetIpAddrTable

gdiplus

GdipDeleteGraphics GdipDrawImageI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipFree GdipGetImagePalette GdipGetImageGraphicsContext GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipDisposeImage GdipBitmapUnlockBits GdiplusStartup GdiplusShutdown GdipCreateBitmapFromFileICM GdipAlloc GdipGetImagePaletteSize

dbghelp

ImageNtHeader ImageDirectoryEntryToData

wininet

InternetCrackUrlW InternetConnectW InternetOpenW HttpOpenRequestW HttpSendRequestW InternetCloseHandle InternetSetOptionW HttpQueryInfoW InternetReadFile InternetSetFilePointer

setupapi

SetupIterateCabinetW

msi

ord173 ord217

winmm

timeKillEvent timeSetEvent

generic

count=18, id=241, version=40116,

count=163, id=243, version=40116,

count=31, id=242, version=40116,

count=12, id=260, version=27051,

count=36, id=261, version=27051,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=129, id=261, version=26706,

count=36, id=260, version=26706,

count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=491, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=49, id=265, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,