6dffc2e2cad9351f286d8da15036c6f4d7168f2c7033885b1c8461cff7927764

Sharing

Copy URL Twitter E-mail

General

Target
6dffc2e2cad9351f286d8da15036c6f4d7168f2c7033885b1c8461cff7927764
Size 2.3MB
Sample260916-v6vajstbpg
SHA256 6dffc2e2cad9351f286d8da15036c6f4d7168f2c7033885b1c8461cff7927764
MD5 65e1213bc1be6773a2214a6fed71496b
SHA1 363bfec3de1e97552192e719c645d06cd7826cc1
SHA512 16a9bf46dada5cedbaac5ce0c4185de3f383d395f30074b0429148f0bb8fce41d391ecfc5b67daa1e5eb36834e14f4fcded254ee0666ec9c9685596ec232daed
SSDEEP 49152:UhUJksT0Ac2dO5Rcx62BFkZaMWB+ICuwUH54kNfw:U5Jrc3BuwMU+IRXtNI
TLSH
T12BB58E20BA06C235E9A742709D7D9BAF806CE7751F7185CB73C80E2E1E246D31A35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6dffc2e2cad9351f286d8da15036c6f4d7168f2c7033885b1c8461cff7927764

File Explorer

6dffc2e2cad9351f286d8da15036c6f4d7168f2c7033885b1c8461cff7927764

.exe 2.3MB

6dffc2e2cad9351f286d8da15036c6f4d7168f2c7033885b1c8461cff7927764

IMPHASH 8f03e9d79c48e96d034f8a7fd16b05e2
SHA256 6dffc2e2cad9351f286d8da15036c6f4d7168f2c7033885b1c8461cff7927764
MD5 65e1213bc1be6773a2214a6fed71496b
SHA1 363bfec3de1e97552192e719c645d06cd7826cc1
SHA512 16a9bf46dada5cedbaac5ce0c4185de3f383d395f30074b0429148f0bb8fce41d391ecfc5b67daa1e5eb36834e14f4fcded254ee0666ec9c9685596ec232daed
SSDEEP 49152:UhUJksT0Ac2dO5Rcx62BFkZaMWB+ICuwUH54kNfw:U5Jrc3BuwMU+IRXtNI
TLSH
T12BB58E20BA06C235E9A742709D7D9BAF806CE7751F7185CB73C80E2E1E246D31A35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1453978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\952572\out\Release\Player.pdb

kernel32

GetWindowsDirectoryW RemoveDirectoryW FindFirstFileW FindNextFileW GetFileAttributesExW GetCurrentProcess OpenThread lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToFileTime GetVersionExW GetSystemTime InterlockedIncrement InterlockedDecrement LocalAlloc GetBinaryTypeW GetCommandLineW MulDiv GlobalFree GlobalAlloc Process32NextW Process32FirstW CreateToolhelp32Snapshot MapViewOfFile GetExitCodeThread LoadLibraryW CreateFileMappingW lstrlenA UnmapViewOfFile InterlockedCompareExchange MoveFileExW SetFileAttributesW lstrlenW ReadFile GetFileSizeEx DeleteFileW WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetStdHandle GetFileType ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore FreeLibraryAndExitThread UnregisterWait FindClose GetProcessAffinityMask DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP CreateDirectoryW GetCurrentDirectoryW SetFileTime GetFileAttributesW VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock GetPrivateProfileStringW SetFilePointerEx GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW SetFilePointer WriteFile SizeofResource LoadResource GetCurrentThreadId GetProcessHeap HeapSize HeapDestroy LockResource GetModuleFileNameW DeleteCriticalSection InitializeCriticalSection GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapLock CreateFileA LocalFileTimeToFileTime LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo FormatMessageW QueryPerformanceFrequency QueryPerformanceCounter GetCurrentThread SwitchToThread DuplicateHandle TryEnterCriticalSection GetStringTypeW LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent SetEndOfFile RegisterWaitForSingleObject DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle GetModuleHandleA SetThreadPriority LocalFree CreateFileW

user32

DestroyCursor GetCursor SetCursor SetWindowRgn GetUpdateRect EndPaint BeginPaint ReleaseCapture SetCapture GetFocus GetSysColor MapVirtualKeyW IsZoomed UpdateLayeredWindow RegisterClassW UnionRect PtInRect GetMonitorInfoW wsprintfW GetActiveWindow DrawTextW GetDesktopWindow SetWindowPos SetClipboardData MonitorFromPoint EqualRect OffsetRect IntersectRect GetSystemMetrics SetWindowLongW GetWindowLongW DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW PostMessageW GetWindowThreadProcessId FindWindowW SetForegroundWindow GetForegroundWindow SetActiveWindow BringWindowToTop IsIconic ShowWindow IsWindow AttachThreadInput SendMessageTimeoutW EmptyClipboard IsWindowVisible IsRectEmpty MapWindowPoints AdjustWindowRect InvalidateRect UpdateWindow GetKeyState SetRectEmpty ScreenToClient ShowCursor GetDoubleClickTime LoadImageW SetWindowTextW MoveWindow GetParent GetClientRect GetAsyncKeyState GetMessagePos ReleaseDC GetKeyNameTextW MonitorFromWindow SystemParametersInfoW GetWindow CopyRect GetWindowRect SetFocus PostQuitMessage ClientToScreen GetCursorPos EnableWindow LoadCursorW KillTimer SetTimer GetClassInfoExW UnregisterClassW CallWindowProcW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW CharNextW CharLowerBuffW IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard GetDC

gdi32

DeleteObject GetStockObject GetObjectW CreateFontIndirectW BitBlt CreateRoundRectRgn CreateCompatibleDC DeleteDC GetWindowOrgEx RestoreDC SaveDC SelectObject SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection GetObjectA SetWindowOrgEx CreateRectRgnIndirect ExtSelectClipRgn EnumFontFamiliesExW GetDeviceCaps

comdlg32

GetOpenFileNameW ChooseColorW

advapi32

RegSetValueExW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegOpenKeyW RegOpenCurrentUser RegEnumKeyExW RegSetValueW RegQueryInfoKeyW RegCreateKeyW ConvertSidToStringSidW LookupAccountNameW GetTokenInformation OpenProcessToken CloseServiceHandle OpenSCManagerW EnumServicesStatusW

shell32

ord190 ord165 SHOpenFolderAndSelectItems ord155 SHGetSpecialFolderPathW SHGetFolderPathW SHBrowseForFolderW ShellExecuteW CommandLineToArgvW SHFileOperationW ord680 DragFinish SHChangeNotify DragAcceptFiles ExtractAssociatedIconW DragQueryFileW SHGetPathFromIDListW

ole32

RevokeDragDrop RegisterDragDrop OleUninitialize OleInitialize CoTaskMemRealloc CoInitialize ReleaseStgMedium CreateStreamOnHGlobal CoCreateInstance CoUninitialize PropVariantClear CoTaskMemFree CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathIsRelativeW SHDeleteKeyW SHSetValueW SHDeleteValueW PathIsRootW SHStrDupW PathFindExtensionW PathFileExistsW StrCmpIW PathRemoveFileSpecW SHGetValueW PathFindFileNameW PathCombineW PathAppendW PathAddBackslashW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCreateFontFromDC GdipResetClip GdipSetClipPath GdipStringFormatGetGenericTypographic GdipSetStringFormatFlags GdipCreateFontFromLogfontA GdipDrawImageRectRectI GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdipCloneStringFormat GdipMeasureString GdipDeleteStringFormat GdipDrawString GdipDeleteFont GdipGetPropertyItemSize GdiplusStartup GdiplusShutdown GdipCreatePen1 GdipDeletePen GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipDrawArc GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipDrawImageRectI GdipImageSelectActiveFrame GdipGetPropertyItem GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCloneBrush GdipDeleteBrush GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipSetPixelOffsetMode GdipFillRegion GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen2 GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawImageRect GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipGetImageGraphicsContext GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmSetCompositionWindow ImmAssociateContext ImmGetContext ImmReleaseContext

crypt32

CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptQueryObject CryptBinaryToStringA CertGetNameStringW CertFreeCertificateContext CryptMsgClose

wininet

InternetSetOptionW InternetConnectW InternetCloseHandle InternetOpenW InternetCrackUrlW HttpSendRequestW HttpQueryInfoW HttpOpenRequestW

secur32

GetUserNameExW

msimg32

AlphaBlend

generic

count=33, id=241, version=40116,

count=194, id=243, version=40116,

count=41, id=242, version=40116,

count=4, id=199, version=41118,

count=28, id=259, version=26706,

count=69, id=261, version=27051,

count=3, id=261, version=27045,

count=8, id=260, version=27045,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=132, id=261, version=26706,

count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=685, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=64, id=261, version=27048,

count=16, id=260, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,