LocalOffice_Agent[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
LocalOffice_Agent.exe
Size 36.0MB
Sample260827-plhhcstscx
SHA256 bf525b66522ac13aa81d5390f1cc35f26252bd79b4e8d52828a0ba27ecd67818
MD5 ae25d3d228d7af39b45bcb316df56284
SHA1 72dd6519123ec884a21d5cf8edf80d158770c4b6
SHA512 636418fbcd19d4bf095244afb2e855721ded2b91d6cfa91eb3e9d4a5c6373be21cc48d34be0ce30910491738de1cfd086194b2c82125153639a478f6dc176d9c
SSDEEP 786432:XqNhQrv6aD8Bv2Kvt3mVB+/stLVX5r6nIGoJXZQB2rI:XghQj668BvBV3mVBIsNFzGZoU
TLSH
T1348723237691803EE5AA45308C6FAE60D1A97C738A314157F6A4FF1D2EF15C2B623B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LocalOffice_Agent.exe

File Explorer

LocalOffice_Agent.exe

.exe 36.0MB

LocalOffice_Agent.exe

IMPHASH 42669f99775f2f541a042cacf40fa06b
SHA256 bf525b66522ac13aa81d5390f1cc35f26252bd79b4e8d52828a0ba27ecd67818
MD5 ae25d3d228d7af39b45bcb316df56284
SHA1 72dd6519123ec884a21d5cf8edf80d158770c4b6
SHA512 636418fbcd19d4bf095244afb2e855721ded2b91d6cfa91eb3e9d4a5c6373be21cc48d34be0ce30910491738de1cfd086194b2c82125153639a478f6dc176d9c
SSDEEP 786432:XqNhQrv6aD8Bv2Kvt3mVB+/stLVX5r6nIGoJXZQB2rI:XghQj668BvBV3mVBIsNFzGZoU
TLSH
T1348723237691803EE5AA45308C6FAE60D1A97C738A314157F6A4FF1D2EF15C2B623B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

269591

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\CodeBases\isdev\redist\Language Independent\i386\ISP\setup.pdb

comctl32

ord17

kernel32

CompareStringW CompareStringA GetSystemDefaultLangID GetUserDefaultLangID ExpandEnvironmentStringsW GetCurrentDirectoryW FileTimeToLocalFileTime GetFileTime SetFileAttributesW HeapAlloc HeapFree GetProcessHeap CopyFileW GetSystemDefaultUILanguage GlobalAlloc LocalFree MulDiv GetVersionExW InterlockedDecrement InterlockedIncrement GetTempPathW CreateFileW LoadLibraryA GetSystemDirectoryA FindResourceW GlobalUnlock GlobalLock IsBadReadPtr LockResource LoadResource MultiByteToWideChar MoveFileExW WriteProcessMemory VirtualProtectEx GetWindowsDirectoryW GetSystemDirectoryW FlushInstructionCache SetThreadContext GetThreadContext ResumeThread TerminateProcess ExitProcess MoveFileW GetPrivateProfileIntW LoadLibraryW lstrcatW lstrcpynW lstrcmpiW LoadLibraryExW FreeLibrary FindResourceExW UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery GetSystemInfo GetSystemTimeAsFileTime CreateEventW CreateMutexW ReleaseMutex DeleteCriticalSection InitializeCriticalSectionAndSpinCount QueryPerformanceFrequency FreeResource GetPrivateProfileSectionNamesA GetPrivateProfileStringA GetPrivateProfileIntA lstrcatA lstrcmpiA FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW SetFilePointerEx GetConsoleMode GetConsoleCP SetErrorMode RaiseException WriteFile SetFilePointer GetFileSize GetFileAttributesW GetDiskFreeSpaceExW GetDiskFreeSpaceW FindFirstFileW FindClose CreateDirectoryW VerLanguageNameW IsValidLocale GetLocaleInfoW WideCharToMultiByte lstrcpyA GetTickCount ExitThread CreateThread GetExitCodeProcess ReadFile GetCommandLineW SizeofResource FormatMessageW GetCurrentProcess WaitForSingleObject SetLastError GetLastError DuplicateHandle RemoveDirectoryW DeleteFileW SetCurrentDirectoryW lstrlenW lstrcpyW GetProcAddress GetModuleHandleW GetModuleFileNameW CreateProcessW Sleep CloseHandle GlobalFree ReadConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetFileType HeapReAlloc GetStdHandle HeapSize GetModuleHandleExW GetStringTypeW GetCurrentThreadId GetCPInfo GetOEMCP IsValidCodePage GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetACP IsProcessorFeaturePresent IsDebuggerPresent RtlUnwind FindNextFileW lstrcmpW GetCurrentThread QueryPerformanceCounter lstrcmpA SystemTimeToFileTime ResetEvent SetEvent GetDateFormatW GetTimeFormatW GetTempFileNameW CompareFileTime SetFileTime OpenProcess GetProcessTimes InterlockedExchange LoadLibraryExA EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer LCMapStringW GetVersion GetCurrentProcessId GetLocalTime lstrlenA

user32

DialogBoxIndirectParamW MoveWindow SendMessageW WaitForInputIdle wsprintfW GetDlgItem SetDlgItemTextW EndDialog SetForegroundWindow SetWindowTextW GetWindowRect MessageBoxW GetWindowLongW SetWindowLongW LoadIconW TranslateMessage DispatchMessageW PeekMessageW SetActiveWindow SystemParametersInfoW GetWindow FillRect GetSysColor MapWindowPoints RemovePropW GetPropW SetPropW EndPaint BeginPaint EnableMenuItem GetSystemMetrics SetFocus ExitWindowsEx CharUpperW wsprintfA CallWindowProcW CreateWindowExW DrawIcon DrawTextW UpdateWindow GetWindowDC InvalidateRect DrawFocusRect CopyRect InflateRect EnumChildWindows GetClassNameW MapDialogRect RegisterClassExW GetDlgItemTextW IntersectRect MonitorFromPoint DefWindowProcW GetMessageW LoadStringW LoadImageW ReleaseDC GetDC CreateDialogParamW GetParent GetWindowTextW CharNextW GetDesktopWindow GetClientRect IsWindowEnabled CreateDialogIndirectParamW IsWindowVisible IsDialogMessageW FindWindowExW ScreenToClient EnableWindow MsgWaitForMultipleObjects SendDlgItemMessageW SetWindowPos ShowWindow DestroyWindow IsWindow PostMessageW

gdi32

SetTextColor SetBkMode SetBkColor SaveDC RestoreDC CreateSolidBrush UnrealizeObject CreateHalftonePalette GetDIBColorTable SelectPalette SelectObject RealizePalette GetSystemPaletteEntries GetDeviceCaps DeleteDC CreatePalette CreateCompatibleDC BitBlt GetObjectW TranslateCharsetInfo DeleteObject CreateFontIndirectW CreateCompatibleBitmap CreateDCW CreatePatternBrush GetStockObject GetTextExtentPoint32W DeleteMetaFile CreateDIBitmap CreateBitmap CreateRectRgn PatBlt PlayMetaFile SelectClipRgn SetMapMode SetMetaFileBitsEx SetPixel StretchBlt SetStretchBltMode SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx TextOutW

advapi32

RegEnumValueW RegQueryValueExW SetEntriesInAclW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateWellKnownSid RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegOpenKeyW OpenProcessToken AdjustTokenPrivileges AllocateAndInitializeSid FreeSid LookupPrivilegeValueW RegEnumKeyW OpenThreadToken GetTokenInformation EqualSid

shell32

ShellExecuteExW SHGetSpecialFolderLocation SHGetMalloc SHGetPathFromIDListW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitializeSecurity CreateStreamOnHGlobal CoInitializeEx CoUninitialize

oleaut32

VarUI4FromStr VarBstrCmp VariantChangeType VarBstrCat SysAllocString SysFreeString SysStringLen SysAllocStringLen SysReAllocStringLen GetErrorInfo SysStringByteLen VariantInit SysAllocStringByteLen VariantClear

shlwapi

PathFileExistsW

rpcrt4

UuidCreate RpcStringFreeW UuidToStringW

gdiplus

GdipFree GdipDrawImageRectI GdipSetInterpolationMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromResource GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdiplusStartup GdipGetImageWidth GdipGetImageHeight GdipAlloc