0a8a0c41c41a389c65225f3891543262531a85f3eb5dd7d6a8203c65b865a31e

Sharing

Copy URL Twitter E-mail

General

Target
0a8a0c41c41a389c65225f3891543262531a85f3eb5dd7d6a8203c65b865a31e
Size 1.3MB
Sample260930-e81mcasxd1
SHA256 0a8a0c41c41a389c65225f3891543262531a85f3eb5dd7d6a8203c65b865a31e
MD5 bb46d9685d99691d631c94ec05f092ef
SHA1 e3496a0802f9036400a48964e9d8163ec92294f2
SHA512 f9c20304e8b06c89fcd60f48de4c899680de27b6bb3d27e63260b7f7bbc6c4134ef4c73c802017cd4ec5d18a4133fd65b1228be4fc74091ef6046d8ba3b8fcff
SSDEEP 24576:k1oQ77V904YykEUtLZZnD8cFNTNjTS4yDF6GY3iVakGkJNmT:huV99Y1EUtLZBDXNTNj2BDA6aui
TLSH
T15155F1856BA481B2E8D7223BC4565B327A7AAE323B33C2C363650E695D307C5DD31F09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a8a0c41c41a389c65225f3891543262531a85f3eb5dd7d6a8203c65b865a31e

File Explorer

0a8a0c41c41a389c65225f3891543262531a85f3eb5dd7d6a8203c65b865a31e

.exe 1.3MB

0a8a0c41c41a389c65225f3891543262531a85f3eb5dd7d6a8203c65b865a31e

IMPHASH 45575f470449b095482f6026dfd0df7a
SHA256 0a8a0c41c41a389c65225f3891543262531a85f3eb5dd7d6a8203c65b865a31e
MD5 bb46d9685d99691d631c94ec05f092ef
SHA1 e3496a0802f9036400a48964e9d8163ec92294f2
SHA512 f9c20304e8b06c89fcd60f48de4c899680de27b6bb3d27e63260b7f7bbc6c4134ef4c73c802017cd4ec5d18a4133fd65b1228be4fc74091ef6046d8ba3b8fcff
SSDEEP 24576:k1oQ77V904YykEUtLZZnD8cFNTNjTS4yDF6GY3iVakGkJNmT:huV99Y1EUtLZBDXNTNj2BDA6aui
TLSH
T15155F1856BA481B2E8D7223BC4565B327A7AAE323B33C2C363650E695D307C5DD31F09
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

191879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\545556\out\Release\360ZipMgrTray.pdb

kernel32

Sleep InterlockedCompareExchange InterlockedExchange LoadLibraryExW FreeResource CreateProcessW InitializeCriticalSection CreateFileW DeviceIoControl DeleteCriticalSection GetCurrentProcessId GetLogicalDriveStringsW WideCharToMultiByte lstrlenW FindFirstFileW GetFullPathNameW SetLastError FindNextFileW FindClose ReadFile WriteFile GetFileSize DeleteFileW GetSystemWindowsDirectoryW GetVersionExW WaitForSingleObject GetExitCodeProcess LocalFree SetFileAttributesW GetDriveTypeW QueryDosDeviceW OutputDebugStringW GetWindowsDirectoryW GetDiskFreeSpaceExW CreateEventW SetEvent LoadLibraryW FlushFileBuffers SetFilePointer WaitForMultipleObjects GetCurrentThread GetThreadContext VirtualQuery SetThreadPriority FlushInstructionCache VirtualAlloc OpenThread GetSystemInfo GetThreadPriority VirtualProtect GetCurrentThreadId SuspendThread ResumeThread GetFileSizeEx LocalAlloc CloseHandle OpenProcess GetModuleHandleExW FindResourceExW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA LoadLibraryA InitializeCriticalSectionAndSpinCount GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP SetHandleCount LCMapStringW LCMapStringA GetModuleFileNameA IsValidCodePage GetOEMCP GetACP GetCPInfo ExitProcess InterlockedDecrement FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar lstrlenA GetLastError CreateMutexW GetSystemDirectoryW EnterCriticalSection FreeLibrary LeaveCriticalSection GetModuleFileNameW GetFileAttributesW GetCurrentProcess GetModuleHandleW GetProcAddress InterlockedIncrement VirtualFree HeapCreate RtlUnwind GetStartupInfoA GetCommandLineA GetStdHandle GetFileType WriteConsoleW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess CreateThread ExitThread TlsFree TlsAlloc ReleaseMutex HeapWalk HeapLock HeapUnlock TlsSetValue TlsGetValue SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime GetSystemTimeAsFileTime SystemTimeToFileTime CreateFileA RaiseException GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy lstrcpyW GetModuleHandleA

user32

PostQuitMessage TrackPopupMenu SetForegroundWindow GetCursorPos PostMessageW KillTimer SetTimer RegisterWindowMessageW DefWindowProcW AppendMenuW CreatePopupMenu LoadIconW wsprintfW RegisterClassW GetClassNameW FindWindowExW SendMessageTimeoutW GetAncestor WindowFromPoint GetShellWindow GetWindowInfo GetWindowThreadProcessId GetWindowRect GetDesktopWindow GetSystemMetrics GetWindow IsWindowVisible IsWindow GetForegroundWindow MonitorFromWindow DispatchMessageW TranslateMessage GetMessageW UpdateWindow ShowWindow CreateWindowExW

advapi32

GetUserNameW RegQueryValueExA SetNamedSecurityInfoW SetEntriesInAclW BuildExplicitAccessWithNameW GetNamedSecurityInfoW RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExW

shell32

ord165 ShellExecuteW Shell_NotifyIconW

ole32

CoCreateGuid

shlwapi

PathAppendW PathRemoveFileSpecW PathFindFileNameW StrCmpIW PathIsRelativeW StrStrIA UrlUnescapeW StrCpyW StrStrIW PathStripToRootW PathFileExistsW PathCombineW PathCanonicalizeW

wininet

HttpQueryInfoW InternetCanonicalizeUrlW InternetReadFile InternetSetFilePointer InternetCrackUrlW InternetOpenW InternetOpenUrlW InternetCloseHandle InternetSetOptionW

psapi

GetModuleFileNameExW GetProcessImageFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

0a8a0c41c41a389c65225f3891543262531a85f3eb5dd7d6a8203c65b865a31e

kernel32

user32

advapi32

shell32

ole32

shlwapi

wininet

psapi

generic