e265c29f20cefe307c59ea3c5d190f5af05657107d094b7c942bf9dffca0407a

Sharing

Copy URL Twitter E-mail

General

Target
e265c29f20cefe307c59ea3c5d190f5af05657107d094b7c942bf9dffca0407a
Size 2.3MB
Sample260916-knahbaac49
SHA256 e265c29f20cefe307c59ea3c5d190f5af05657107d094b7c942bf9dffca0407a
MD5 4356d11ca85913e6141127237b6a35b9
SHA1 dd43587380aa880c419cabc5699b0b81c94ea3ab
SHA512 21a5058decd9d78a5c20ed4ec3486237361adcb7f43cbbe3d1b13dbcac12efbc8446acf85a73e22603b7a916636344a203b81aff79bd79d55d38064b09f4ae8e
SSDEEP 49152:UhUJksT0Ac2dO5Rcx62BFkZaMWB+ICuwUH54kNfQ:U5Jrc3BuwMU+IRXtN4
TLSH
T1AAB58E20BA06C235E9A742709D7D9BAF806CE7751F7185CB73C80E2E1E246D31A35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e265c29f20cefe307c59ea3c5d190f5af05657107d094b7c942bf9dffca0407a

File Explorer

e265c29f20cefe307c59ea3c5d190f5af05657107d094b7c942bf9dffca0407a

.exe 2.3MB

e265c29f20cefe307c59ea3c5d190f5af05657107d094b7c942bf9dffca0407a

IMPHASH 8f03e9d79c48e96d034f8a7fd16b05e2
SHA256 e265c29f20cefe307c59ea3c5d190f5af05657107d094b7c942bf9dffca0407a
MD5 4356d11ca85913e6141127237b6a35b9
SHA1 dd43587380aa880c419cabc5699b0b81c94ea3ab
SHA512 21a5058decd9d78a5c20ed4ec3486237361adcb7f43cbbe3d1b13dbcac12efbc8446acf85a73e22603b7a916636344a203b81aff79bd79d55d38064b09f4ae8e
SSDEEP 49152:UhUJksT0Ac2dO5Rcx62BFkZaMWB+ICuwUH54kNfQ:U5Jrc3BuwMU+IRXtN4
TLSH
T1AAB58E20BA06C235E9A742709D7D9BAF806CE7751F7185CB73C80E2E1E246D31A35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1453978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\952572\out\Release\Player.pdb

kernel32

GetWindowsDirectoryW RemoveDirectoryW FindFirstFileW FindNextFileW GetFileAttributesExW GetCurrentProcess OpenThread lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToFileTime GetVersionExW GetSystemTime InterlockedIncrement InterlockedDecrement LocalAlloc GetBinaryTypeW GetCommandLineW MulDiv GlobalFree GlobalAlloc Process32NextW Process32FirstW CreateToolhelp32Snapshot MapViewOfFile GetExitCodeThread LoadLibraryW CreateFileMappingW lstrlenA UnmapViewOfFile InterlockedCompareExchange MoveFileExW SetFileAttributesW lstrlenW ReadFile GetFileSizeEx DeleteFileW WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetStdHandle GetFileType ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore FreeLibraryAndExitThread UnregisterWait FindClose GetProcessAffinityMask DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP CreateDirectoryW GetCurrentDirectoryW SetFileTime GetFileAttributesW VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock GetPrivateProfileStringW SetFilePointerEx GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW SetFilePointer WriteFile SizeofResource LoadResource GetCurrentThreadId GetProcessHeap HeapSize HeapDestroy LockResource GetModuleFileNameW DeleteCriticalSection InitializeCriticalSection GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapLock CreateFileA LocalFileTimeToFileTime LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo FormatMessageW QueryPerformanceFrequency QueryPerformanceCounter GetCurrentThread SwitchToThread DuplicateHandle TryEnterCriticalSection GetStringTypeW LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent SetEndOfFile RegisterWaitForSingleObject DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle GetModuleHandleA SetThreadPriority LocalFree CreateFileW

user32

DestroyCursor GetCursor SetCursor SetWindowRgn GetUpdateRect EndPaint BeginPaint ReleaseCapture SetCapture GetFocus GetSysColor MapVirtualKeyW IsZoomed UpdateLayeredWindow RegisterClassW UnionRect PtInRect GetMonitorInfoW wsprintfW GetActiveWindow DrawTextW GetDesktopWindow SetWindowPos SetClipboardData MonitorFromPoint EqualRect OffsetRect IntersectRect GetSystemMetrics SetWindowLongW GetWindowLongW DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW PostMessageW GetWindowThreadProcessId FindWindowW SetForegroundWindow GetForegroundWindow SetActiveWindow BringWindowToTop IsIconic ShowWindow IsWindow AttachThreadInput SendMessageTimeoutW EmptyClipboard IsWindowVisible IsRectEmpty MapWindowPoints AdjustWindowRect InvalidateRect UpdateWindow GetKeyState SetRectEmpty ScreenToClient ShowCursor GetDoubleClickTime LoadImageW SetWindowTextW MoveWindow GetParent GetClientRect GetAsyncKeyState GetMessagePos ReleaseDC GetKeyNameTextW MonitorFromWindow SystemParametersInfoW GetWindow CopyRect GetWindowRect SetFocus PostQuitMessage ClientToScreen GetCursorPos EnableWindow LoadCursorW KillTimer SetTimer GetClassInfoExW UnregisterClassW CallWindowProcW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW CharNextW CharLowerBuffW IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard GetDC

gdi32

DeleteObject GetStockObject GetObjectW CreateFontIndirectW BitBlt CreateRoundRectRgn CreateCompatibleDC DeleteDC GetWindowOrgEx RestoreDC SaveDC SelectObject SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection GetObjectA SetWindowOrgEx CreateRectRgnIndirect ExtSelectClipRgn EnumFontFamiliesExW GetDeviceCaps

comdlg32

GetOpenFileNameW ChooseColorW

advapi32

RegSetValueExW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegOpenKeyW RegOpenCurrentUser RegEnumKeyExW RegSetValueW RegQueryInfoKeyW RegCreateKeyW ConvertSidToStringSidW LookupAccountNameW GetTokenInformation OpenProcessToken CloseServiceHandle OpenSCManagerW EnumServicesStatusW

shell32

ord190 ord165 SHOpenFolderAndSelectItems ord155 SHGetSpecialFolderPathW SHGetFolderPathW SHBrowseForFolderW ShellExecuteW CommandLineToArgvW SHFileOperationW ord680 DragFinish SHChangeNotify DragAcceptFiles ExtractAssociatedIconW DragQueryFileW SHGetPathFromIDListW

ole32

RevokeDragDrop RegisterDragDrop OleUninitialize OleInitialize CoTaskMemRealloc CoInitialize ReleaseStgMedium CreateStreamOnHGlobal CoCreateInstance CoUninitialize PropVariantClear CoTaskMemFree CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathIsRelativeW SHDeleteKeyW SHSetValueW SHDeleteValueW PathIsRootW SHStrDupW PathFindExtensionW PathFileExistsW StrCmpIW PathRemoveFileSpecW SHGetValueW PathFindFileNameW PathCombineW PathAppendW PathAddBackslashW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCreateFontFromDC GdipResetClip GdipSetClipPath GdipStringFormatGetGenericTypographic GdipSetStringFormatFlags GdipCreateFontFromLogfontA GdipDrawImageRectRectI GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdipCloneStringFormat GdipMeasureString GdipDeleteStringFormat GdipDrawString GdipDeleteFont GdipGetPropertyItemSize GdiplusStartup GdiplusShutdown GdipCreatePen1 GdipDeletePen GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipDrawArc GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipDrawImageRectI GdipImageSelectActiveFrame GdipGetPropertyItem GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCloneBrush GdipDeleteBrush GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipSetPixelOffsetMode GdipFillRegion GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen2 GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawImageRect GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipGetImageGraphicsContext GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmSetCompositionWindow ImmAssociateContext ImmGetContext ImmReleaseContext

crypt32

CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptQueryObject CryptBinaryToStringA CertGetNameStringW CertFreeCertificateContext CryptMsgClose

wininet

InternetSetOptionW InternetConnectW InternetCloseHandle InternetOpenW InternetCrackUrlW HttpSendRequestW HttpQueryInfoW HttpOpenRequestW

secur32

GetUserNameExW

msimg32

AlphaBlend

generic

count=33, id=241, version=40116,

count=194, id=243, version=40116,

count=41, id=242, version=40116,

count=4, id=199, version=41118,

count=28, id=259, version=26706,

count=69, id=261, version=27051,

count=3, id=261, version=27045,

count=8, id=260, version=27045,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=132, id=261, version=26706,

count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=685, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=64, id=261, version=27048,

count=16, id=260, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,