Agent[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Agent.exe
Size 36.0MB
Sample260827-ppntjsvbra
SHA256 4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99
MD5 7bb2b32739152e9a8768e1da2844b0bb
SHA1 3d40dc5eec31c87418de2c963d9ba8e07d55aa63
SHA512 bcde492b78070c4e456871749d8d5b798926c740ca35e82bc4c36742b37a785517ecd920bf165e7484220b36edbe1144f7d14ab2f362e2015ac5b1138faeb4f3
SSDEEP 786432:XqNhQrv6aD8Bv2Kvt3mVB+/stLVX5r6nIGoJXZQB2rR:XghQj668BvBV3mVBIsNFzGZoN
TLSH
T14B8723237691803EE5AA45308C6FAE60D1A97C738A314157F6A4FF1D2EF15C2B623B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Agent.exe

File Explorer

Agent.exe

.exe 36.0MB

Agent.exe

IMPHASH 42669f99775f2f541a042cacf40fa06b
SHA256 4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99
MD5 7bb2b32739152e9a8768e1da2844b0bb
SHA1 3d40dc5eec31c87418de2c963d9ba8e07d55aa63
SHA512 bcde492b78070c4e456871749d8d5b798926c740ca35e82bc4c36742b37a785517ecd920bf165e7484220b36edbe1144f7d14ab2f362e2015ac5b1138faeb4f3
SSDEEP 786432:XqNhQrv6aD8Bv2Kvt3mVB+/stLVX5r6nIGoJXZQB2rR:XghQj668BvBV3mVBIsNFzGZoN
TLSH
T14B8723237691803EE5AA45308C6FAE60D1A97C738A314157F6A4FF1D2EF15C2B623B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

269591

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\CodeBases\isdev\redist\Language Independent\i386\ISP\setup.pdb

comctl32

ord17

kernel32

CompareStringW CompareStringA GetSystemDefaultLangID GetUserDefaultLangID ExpandEnvironmentStringsW GetCurrentDirectoryW FileTimeToLocalFileTime GetFileTime SetFileAttributesW HeapAlloc HeapFree GetProcessHeap CopyFileW GetSystemDefaultUILanguage GlobalAlloc LocalFree MulDiv GetVersionExW InterlockedDecrement InterlockedIncrement GetTempPathW CreateFileW LoadLibraryA GetSystemDirectoryA FindResourceW GlobalUnlock GlobalLock IsBadReadPtr LockResource LoadResource MultiByteToWideChar MoveFileExW WriteProcessMemory VirtualProtectEx GetWindowsDirectoryW GetSystemDirectoryW FlushInstructionCache SetThreadContext GetThreadContext ResumeThread TerminateProcess ExitProcess MoveFileW GetPrivateProfileIntW LoadLibraryW lstrcatW lstrcpynW lstrcmpiW LoadLibraryExW FreeLibrary FindResourceExW UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery GetSystemInfo GetSystemTimeAsFileTime CreateEventW CreateMutexW ReleaseMutex DeleteCriticalSection InitializeCriticalSectionAndSpinCount QueryPerformanceFrequency FreeResource GetPrivateProfileSectionNamesA GetPrivateProfileStringA GetPrivateProfileIntA lstrcatA lstrcmpiA FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW SetFilePointerEx GetConsoleMode GetConsoleCP SetErrorMode RaiseException WriteFile SetFilePointer GetFileSize GetFileAttributesW GetDiskFreeSpaceExW GetDiskFreeSpaceW FindFirstFileW FindClose CreateDirectoryW VerLanguageNameW IsValidLocale GetLocaleInfoW WideCharToMultiByte lstrcpyA GetTickCount ExitThread CreateThread GetExitCodeProcess ReadFile GetCommandLineW SizeofResource FormatMessageW GetCurrentProcess WaitForSingleObject SetLastError GetLastError DuplicateHandle RemoveDirectoryW DeleteFileW SetCurrentDirectoryW lstrlenW lstrcpyW GetProcAddress GetModuleHandleW GetModuleFileNameW CreateProcessW Sleep CloseHandle GlobalFree ReadConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetFileType HeapReAlloc GetStdHandle HeapSize GetModuleHandleExW GetStringTypeW GetCurrentThreadId GetCPInfo GetOEMCP IsValidCodePage GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetACP IsProcessorFeaturePresent IsDebuggerPresent RtlUnwind FindNextFileW lstrcmpW GetCurrentThread QueryPerformanceCounter lstrcmpA SystemTimeToFileTime ResetEvent SetEvent GetDateFormatW GetTimeFormatW GetTempFileNameW CompareFileTime SetFileTime OpenProcess GetProcessTimes InterlockedExchange LoadLibraryExA EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer LCMapStringW GetVersion GetCurrentProcessId GetLocalTime lstrlenA

user32

DialogBoxIndirectParamW MoveWindow SendMessageW WaitForInputIdle wsprintfW GetDlgItem SetDlgItemTextW EndDialog SetForegroundWindow SetWindowTextW GetWindowRect MessageBoxW GetWindowLongW SetWindowLongW LoadIconW TranslateMessage DispatchMessageW PeekMessageW SetActiveWindow SystemParametersInfoW GetWindow FillRect GetSysColor MapWindowPoints RemovePropW GetPropW SetPropW EndPaint BeginPaint EnableMenuItem GetSystemMetrics SetFocus ExitWindowsEx CharUpperW wsprintfA CallWindowProcW CreateWindowExW DrawIcon DrawTextW UpdateWindow GetWindowDC InvalidateRect DrawFocusRect CopyRect InflateRect EnumChildWindows GetClassNameW MapDialogRect RegisterClassExW GetDlgItemTextW IntersectRect MonitorFromPoint DefWindowProcW GetMessageW LoadStringW LoadImageW ReleaseDC GetDC CreateDialogParamW GetParent GetWindowTextW CharNextW GetDesktopWindow GetClientRect IsWindowEnabled CreateDialogIndirectParamW IsWindowVisible IsDialogMessageW FindWindowExW ScreenToClient EnableWindow MsgWaitForMultipleObjects SendDlgItemMessageW SetWindowPos ShowWindow DestroyWindow IsWindow PostMessageW

gdi32

SetTextColor SetBkMode SetBkColor SaveDC RestoreDC CreateSolidBrush UnrealizeObject CreateHalftonePalette GetDIBColorTable SelectPalette SelectObject RealizePalette GetSystemPaletteEntries GetDeviceCaps DeleteDC CreatePalette CreateCompatibleDC BitBlt GetObjectW TranslateCharsetInfo DeleteObject CreateFontIndirectW CreateCompatibleBitmap CreateDCW CreatePatternBrush GetStockObject GetTextExtentPoint32W DeleteMetaFile CreateDIBitmap CreateBitmap CreateRectRgn PatBlt PlayMetaFile SelectClipRgn SetMapMode SetMetaFileBitsEx SetPixel StretchBlt SetStretchBltMode SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx TextOutW

advapi32

RegEnumValueW RegQueryValueExW SetEntriesInAclW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateWellKnownSid RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegOpenKeyW OpenProcessToken AdjustTokenPrivileges AllocateAndInitializeSid FreeSid LookupPrivilegeValueW RegEnumKeyW OpenThreadToken GetTokenInformation EqualSid

shell32

ShellExecuteExW SHGetSpecialFolderLocation SHGetMalloc SHGetPathFromIDListW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitializeSecurity CreateStreamOnHGlobal CoInitializeEx CoUninitialize

oleaut32

VarUI4FromStr VarBstrCmp VariantChangeType VarBstrCat SysAllocString SysFreeString SysStringLen SysAllocStringLen SysReAllocStringLen GetErrorInfo SysStringByteLen VariantInit SysAllocStringByteLen VariantClear

shlwapi

PathFileExistsW

rpcrt4

UuidCreate RpcStringFreeW UuidToStringW

gdiplus

GdipFree GdipDrawImageRectI GdipSetInterpolationMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromResource GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdiplusStartup GdipGetImageWidth GdipGetImageHeight GdipAlloc