426365490fadb6df3e29dfbc72fd39ebd9f6f0f83ecfaa9061ecfe95ebf63131

Sharing

Copy URL Twitter E-mail

General

Target
426365490fadb6df3e29dfbc72fd39ebd9f6f0f83ecfaa9061ecfe95ebf63131
Size 2.7MB
Sample260930-e83fyatt2r
SHA256 426365490fadb6df3e29dfbc72fd39ebd9f6f0f83ecfaa9061ecfe95ebf63131
MD5 5409a453c3214a6c60065d4f6848484c
SHA1 607fa201c1d1603db934ee750822625cf8d787f9
SHA512 e44a3a3ac3b58db2d0b9e914c36033b65a5464e90025cbd17990bb957d6395ef477d215b7c10c2b5b8c01d2e7733674e9bda6ef4b2a49b6cfd8963b49fe81c69
SSDEEP 49152:BNR65EDQm/vPEw1xAltLyvH88YzRp5/NJvtWtGVLrTnNEYv:BHSgXvsrGvwb5/rn/NEY
TLSH
T1ACD5E02179428072D5A14130DDFCEBAB957CBE642F7409DBA3C43F6D9930AD22D3662B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
426365490fadb6df3e29dfbc72fd39ebd9f6f0f83ecfaa9061ecfe95ebf63131

File Explorer

426365490fadb6df3e29dfbc72fd39ebd9f6f0f83ecfaa9061ecfe95ebf63131

.exe 2.7MB

426365490fadb6df3e29dfbc72fd39ebd9f6f0f83ecfaa9061ecfe95ebf63131

IMPHASH af53ed54cf01cb89ba7ba797c62ddd63
SHA256 426365490fadb6df3e29dfbc72fd39ebd9f6f0f83ecfaa9061ecfe95ebf63131
MD5 5409a453c3214a6c60065d4f6848484c
SHA1 607fa201c1d1603db934ee750822625cf8d787f9
SHA512 e44a3a3ac3b58db2d0b9e914c36033b65a5464e90025cbd17990bb957d6395ef477d215b7c10c2b5b8c01d2e7733674e9bda6ef4b2a49b6cfd8963b49fe81c69
SSDEEP 49152:BNR65EDQm/vPEw1xAltLyvH88YzRp5/NJvtWtGVLrTnNEYv:BHSgXvsrGvwb5/rn/NEY
TLSH
T1ACD5E02179428072D5A14130DDFCEBAB957CBE642F7409DBA3C43F6D9930AD22D3662B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

713003

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\801169\out\Release\SodaDownloader.pdb

kernel32

SizeofResource WriteFile SetFilePointer OutputDebugStringW FindResourceW FindResourceExW GetPrivateProfileIntW GetPrivateProfileStringW InterlockedCompareExchange GetFileSize lstrlenA InterlockedExchange TerminateThread GetExitCodeThread CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateToolhelp32Snapshot Process32FirstW Process32NextW FindClose ExpandEnvironmentStringsW FindNextFileW GetFileSizeEx ReadFile SetFilePointerEx GlobalAlloc GlobalFree SetEndOfFile SetFileAttributesW DeleteFileW MoveFileExW lstrlenW GetCurrentProcess OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetTempPathW MapViewOfFileEx InterlockedDecrement GetCommandLineW MapViewOfFile EnumSystemLocalesW GetUserDefaultLCID GetThreadLocale GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation UnregisterWait RegisterWaitForSingleObject UnmapViewOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetProcessHeap FindFirstFileExW GetConsoleCP FlushFileBuffers ReadConsoleW HeapDestroy IsValidLocale GetFileType GetStdHandle ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle FreeLibraryAndExitThread GetCurrentThread GetProcessAffinityMask LockResource CreateFileMappingW VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetVersionExW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes GetCurrentThreadId TerminateProcess Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP VerSetConditionMask VerifyVersionInfoW GetCurrentDirectoryW HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo FormatMessageW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent LoadResource IsValidCodePage HeapSize MulDiv SetThreadAffinityMask LocalFree LoadLibraryW GetProcAddress GetModuleFileNameW FreeLibrary DeleteTimerQueueTimer CreateTimerQueueTimer GetModuleHandleW DeviceIoControl DeleteCriticalSection InitializeCriticalSection GetConsoleMode GetFileAttributesW GetCurrentProcessId InterlockedIncrement CreateFileW

user32

SetWindowLongW GetWindowLongW ShowWindow AttachThreadInput IsIconic BringWindowToTop SetActiveWindow GetForegroundWindow SetForegroundWindow DrawTextW GetDesktopWindow SetClipboardData EmptyClipboard GetAsyncKeyState GetSysColor ClientToScreen SetCursor UnionRect EqualRect IntersectRect PtInRect OffsetRect IsZoomed GetCursorPos GetKeyState ScreenToClient SetWindowRgn UpdateLayeredWindow IsRectEmpty GetUpdateRect MoveWindow EndPaint BeginPaint InvalidateRect ReleaseCapture SetCapture GetFocus CallWindowProcW RegisterClassW LoadCursorW MonitorFromPoint FindWindowW GetWindowThreadProcessId SetWindowPos IsWindowVisible OpenClipboard CloseClipboard GetClipboardData IsClipboardFormatAvailable CharNextW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostQuitMessage SetFocus SetWindowTextW GetClientRect GetWindowRect MapWindowPoints GetParent GetWindow GetMonitorInfoW PeekMessageW SetTimer KillTimer LoadImageW IsWindow CreateWindowExW RegisterClassExW DefWindowProcW PostMessageW MonitorFromWindow ReleaseDC GetDC GetSystemMetrics DestroyWindow

gdi32

GetObjectW GetDeviceCaps GetStockObject CreateFontIndirectW DeleteObject BitBlt CreateRoundRectRgn GetWindowOrgEx CreateRectRgnIndirect SaveDC ExtSelectClipRgn RestoreDC CreateDIBSection CreateCompatibleDC SelectObject DeleteDC SetWindowOrgEx SetStretchBltMode StretchBlt SetTextColor SetBkColor SetBkMode GetObjectA

advapi32

GetTokenInformation RegCloseKey RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW RegEnumKeyExA OpenProcessToken OpenSCManagerW EnumServicesStatusW CloseServiceHandle RegOpenKeyW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteKeyW

shell32

SHGetFolderPathW ShellExecuteExW ShellExecuteW ord165 CommandLineToArgvW

ole32

CoInitialize CoTaskMemRealloc CoTaskMemFree OleUninitialize CoTaskMemAlloc CreateStreamOnHGlobal CoCreateGuid CoCreateInstance CoInitializeEx OleInitialize CoUninitialize

oleaut32

VarUI4FromStr LoadRegTypeLi LoadTypeLi SysStringLen SysAllocString VariantInit SysFreeString

shlwapi

SHGetValueA SHSetValueA StrTrimA StrStrIA PathIsRelativeW ord176 SHGetValueW PathRemoveFileSpecW PathCanonicalizeW PathFileExistsW PathAppendW PathCombineW PathFindFileNameW StrCmpIW StrCmpNIW StrStrIW

version

VerQueryValueW

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmDisableIME

gdiplus

GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipCreateBitmapFromStream GdipImageGetFrameCount GdiplusShutdown GdipGetImageWidth GdipImageGetFrameDimensionsList GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipCreatePen1 GdipDeletePen GdipDrawArc GdipCreateLineBrushFromRect GdipDeleteBrush GdipCloneBrush GdipSetLineBlend GdipCreatePen2 GdipCreateMatrix GdipTranslateMatrix GdipFree GdipAlloc GdiplusStartup GdipCloneImage GdipDisposeImage GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipBitmapLockBits GdipRotateMatrix GdipMeasureString GdipFillEllipse GdipDrawEllipse GdipDrawString GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawPath GdipDrawRectangleI GdipDrawLineI GdipCreateLineBrushFromRectI GdipFillPath GdipCreateSolidFill GdipDrawImageRectRectI GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipSetWorldTransform GdipClosePathFigure ord1 GdipAddPathLine GdipAddPathEllipse GdipAddPathRectangle GdipRotateWorldTransform GdipTranslateWorldTransform GdipGetWorldTransform GdipFillRegion GdipSetPathGradientFocusScales GdipDeleteRegion GdipCreateRegionPath GdipSetPathGradientWrapMode GdipSetPathGradientPresetBlend GdipCreatePathGradientFromPath GdipAddPathPath GdipDeletePath GdipCreatePath GdipSetPixelOffsetMode GdipLoadImageFromFile GdipImageRotateFlip GdipDeleteMatrix GdipDrawImageRect

msimg32

AlphaBlend

crypt32

CryptStringToBinaryA CryptBinaryToStringA

iphlpapi

GetAdaptersInfo

wininet

InternetCrackUrlW InternetOpenW InternetCloseHandle HttpQueryInfoW HttpSendRequestW HttpOpenRequestW InternetSetOptionW InternetConnectW

generic

count=37, id=241, version=40116,

count=177, id=243, version=40116,

count=36, id=242, version=40116,

count=2, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=3, id=199, version=41118,

count=26, id=259, version=26706,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=38, id=265, version=27048,

count=3, id=261, version=27045,

count=10, id=260, version=27045,

count=36, id=260, version=26706,

count=129, id=261, version=26706,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=654, id=1, productName=Unmarked objects,

count=1, id=261, productName=VS2019 v16.11.5 build 30136, version=30136,

count=1, id=260, version=27048,

count=31, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,