ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa

Sharing

Copy URL Twitter E-mail

General

Target
ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa
Size 1.1MB
Sample260823-hfhslseq51
SHA256 ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa
MD5 706e2920d2304ce992f1267d3ee5b234
SHA1 eeab876f809382a31ff56fb057756737d60d770e
SHA512 d08d553d1b354d2d4f2417b0664f40a1e434f9ced528a4852c972c150271363e0cc874c5e86d5111a7c118d8503a74fc3f3a1477553f548c48b267c0f037edef
SSDEEP 24576:KHeWZZFFeUHFmlNIW4ZV8vBcGXhGfZZNVv6EbWDbDcbr:DIFF/HF/V8zROZ/DbWDkbr
TLSH
T1EA35F1C5BF5181B2F456133AC5666B327EBABA323B2392C363400E796E317C25D35B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa

File Explorer

ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa

.exe 1.1MB

ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa

IMPHASH 45575f470449b095482f6026dfd0df7a
SHA256 ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa
MD5 706e2920d2304ce992f1267d3ee5b234
SHA1 eeab876f809382a31ff56fb057756737d60d770e
SHA512 d08d553d1b354d2d4f2417b0664f40a1e434f9ced528a4852c972c150271363e0cc874c5e86d5111a7c118d8503a74fc3f3a1477553f548c48b267c0f037edef
SSDEEP 24576:KHeWZZFFeUHFmlNIW4ZV8vBcGXhGfZZNVv6EbWDbDcbr:DIFF/HF/V8zROZ/DbWDkbr
TLSH
T1EA35F1C5BF5181B2F456133AC5666B327EBABA323B2392C363400E796E317C25D35B19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

191879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\545556\out\Release\360ZipMgrTray.pdb

kernel32

Sleep InterlockedCompareExchange InterlockedExchange LoadLibraryExW FreeResource CreateProcessW InitializeCriticalSection CreateFileW DeviceIoControl DeleteCriticalSection GetCurrentProcessId GetLogicalDriveStringsW WideCharToMultiByte lstrlenW FindFirstFileW GetFullPathNameW SetLastError FindNextFileW FindClose ReadFile WriteFile GetFileSize DeleteFileW GetSystemWindowsDirectoryW GetVersionExW WaitForSingleObject GetExitCodeProcess LocalFree SetFileAttributesW GetDriveTypeW QueryDosDeviceW OutputDebugStringW GetWindowsDirectoryW GetDiskFreeSpaceExW CreateEventW SetEvent LoadLibraryW FlushFileBuffers SetFilePointer WaitForMultipleObjects GetCurrentThread GetThreadContext VirtualQuery SetThreadPriority FlushInstructionCache VirtualAlloc OpenThread GetSystemInfo GetThreadPriority VirtualProtect GetCurrentThreadId SuspendThread ResumeThread GetFileSizeEx LocalAlloc CloseHandle OpenProcess GetModuleHandleExW FindResourceExW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA LoadLibraryA InitializeCriticalSectionAndSpinCount GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP SetHandleCount LCMapStringW LCMapStringA GetModuleFileNameA IsValidCodePage GetOEMCP GetACP GetCPInfo ExitProcess InterlockedDecrement FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar lstrlenA GetLastError CreateMutexW GetSystemDirectoryW EnterCriticalSection FreeLibrary LeaveCriticalSection GetModuleFileNameW GetFileAttributesW GetCurrentProcess GetModuleHandleW GetProcAddress InterlockedIncrement VirtualFree HeapCreate RtlUnwind GetStartupInfoA GetCommandLineA GetStdHandle GetFileType WriteConsoleW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess CreateThread ExitThread TlsFree TlsAlloc ReleaseMutex HeapWalk HeapLock HeapUnlock TlsSetValue TlsGetValue SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime GetSystemTimeAsFileTime SystemTimeToFileTime CreateFileA RaiseException GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy lstrcpyW GetModuleHandleA

user32

PostQuitMessage TrackPopupMenu SetForegroundWindow GetCursorPos PostMessageW KillTimer SetTimer RegisterWindowMessageW DefWindowProcW AppendMenuW CreatePopupMenu LoadIconW wsprintfW RegisterClassW GetClassNameW FindWindowExW SendMessageTimeoutW GetAncestor WindowFromPoint GetShellWindow GetWindowInfo GetWindowThreadProcessId GetWindowRect GetDesktopWindow GetSystemMetrics GetWindow IsWindowVisible IsWindow GetForegroundWindow MonitorFromWindow DispatchMessageW TranslateMessage GetMessageW UpdateWindow ShowWindow CreateWindowExW

advapi32

GetUserNameW RegQueryValueExA SetNamedSecurityInfoW SetEntriesInAclW BuildExplicitAccessWithNameW GetNamedSecurityInfoW RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExW

shell32

ord165 ShellExecuteW Shell_NotifyIconW

ole32

CoCreateGuid

shlwapi

PathAppendW PathRemoveFileSpecW PathFindFileNameW StrCmpIW PathIsRelativeW StrStrIA UrlUnescapeW StrCpyW StrStrIW PathStripToRootW PathFileExistsW PathCombineW PathCanonicalizeW

wininet

HttpQueryInfoW InternetCanonicalizeUrlW InternetReadFile InternetSetFilePointer InternetCrackUrlW InternetOpenW InternetOpenUrlW InternetCloseHandle InternetSetOptionW

psapi

GetModuleFileNameExW GetProcessImageFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa

kernel32

user32

advapi32

shell32

ole32

shlwapi

wininet

psapi

generic