9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b

Sharing

Copy URL Twitter E-mail

General

Target
9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b
Size 2.0MB
Sample260930-gp615ayva1
SHA256 9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b
MD5 ae4bf61b353bf368c35f4c8f0c88d4a9
SHA1 93cc0b4e092b7fdc3be095a580a5cc0593d44bf5
SHA512 64d897601fe93209c4e0b8a6d99919e5031083b9119248223ff716f639cfc4d81ad6c101c3d6682ad7e577e1ce33f664548543e7051b1e1d0c2dc0a58c1f65d4
SSDEEP 49152:aaWecIr1wdryNtegltLyvH88YzRp5/NJwfJ4klKXn0:a1ecIr1wdCtzrGvwb5/rwfJ4k
TLSH
T1C5A501117692D036D6B251B05A2C9B36547EBE700F6248DBB7C05E696EA02E33B34F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b

File Explorer

9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b

.exe 2.0MB

9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b

IMPHASH bb8a0094b21a05c0ccb2baadab13b012
SHA256 9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b
MD5 ae4bf61b353bf368c35f4c8f0c88d4a9
SHA1 93cc0b4e092b7fdc3be095a580a5cc0593d44bf5
SHA512 64d897601fe93209c4e0b8a6d99919e5031083b9119248223ff716f639cfc4d81ad6c101c3d6682ad7e577e1ce33f664548543e7051b1e1d0c2dc0a58c1f65d4
SSDEEP 49152:aaWecIr1wdryNtegltLyvH88YzRp5/NJwfJ4klKXn0:a1ecIr1wdCtzrGvwb5/rwfJ4k
TLSH
T1C5A501117692D036D6B251B05A2C9B36547EBE700F6248DBB7C05E696EA02E33B34F37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

271824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\927131\out\Release\360SpeedldHealth.pdb

kernel32

WaitForMultipleObjects ResetEvent WideCharToMultiByte InitializeCriticalSection GetTempPathW GetTickCount TerminateProcess GetCurrentProcess SetLastError CreateFileW GetFileSize ReadFile SetFilePointer FileTimeToLocalFileTime GetBinaryTypeW ProcessIdToSessionId OpenProcess LocalFree CreateProcessW FreeResource GetEnvironmentVariableW GetStartupInfoW GetWindowsDirectoryW GetSystemWindowsDirectoryW GetVersionExW ExpandEnvironmentStringsW CreateToolhelp32Snapshot Process32NextW Process32FirstW GetSystemInfo FindClose GetFullPathNameW FindFirstFileW lstrlenW GetPrivateProfileStringW GlobalMemoryStatusEx GetSystemTimeAsFileTime DeleteFileW GetPrivateProfileStructW SetCurrentDirectoryW GetFileAttributesExW DeviceIoControl GetProcessHeap SetEvent GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW HeapAlloc IsValidCodePage FindNextFileW FindFirstFileExW GetTimeZoneInformation GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread GetCommandLineA RtlUnwind GetModuleHandleExW QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx SetFilePointerEx WriteFile GetFileSizeEx CreateFileA LocalFileTimeToFileTime SystemTimeToFileTime GetCPInfo WaitForSingleObject CloseHandle CreateEventW InterlockedCompareExchange InterlockedExchange GetCurrentProcessId Sleep DecodePointer GetCurrentThreadId SetErrorMode WriteConsoleW HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW LockResource LoadLibraryW GetSystemDirectoryW InterlockedIncrement InterlockedDecrement DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar EnterCriticalSection RaiseException GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent GetCommandLineW LeaveCriticalSection lstrcmpiW GetLastError CreateMutexW GetModuleHandleW FreeLibrary GetProcAddress GetOEMCP

user32

LockSetForegroundWindow SetTimer LoadImageW GetSystemMetrics SendMessageW SetClassLongW ShowWindow UnregisterClassW DestroyWindow CharNextW PostMessageW FindWindowExW DisableProcessWindowsGhosting SetWindowTextW EnumWindows IsWindowVisible FindWindowW CallWindowProcW CreateWindowExW GetWindowLongW SetWindowLongW LoadCursorW GetClassInfoExW RegisterClassExW DefWindowProcW PostQuitMessage SystemParametersInfoW SetForegroundWindow GetWindowThreadProcessId GetForegroundWindow GetWindowRect KillTimer SetWindowPos GetMessagePos GetAsyncKeyState GetKeyState IsWindow GetLastInputInfo

advapi32

RegCreateKeyExW RegDeleteKeyW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegDeleteValueW RegQueryValueExW SaferCloseLevel CreateProcessAsUserW SaferComputeTokenFromLevel SaferCreateLevel AdjustTokenPrivileges LookupPrivilegeValueW ConvertSidToStringSidW GetTokenInformation OpenProcessToken GetUserNameW RegQueryValueExA

shell32

ShellExecuteW SHGetSpecialFolderPathW ord165 ShellExecuteExW

ole32

CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

SysAllocString VarUI4FromStr VariantTimeToSystemTime SystemTimeToVariantTime SysFreeString

shlwapi

StrStrIA PathRemoveFileSpecW StrStrIW PathFileExistsW StrStrW SHGetValueW PathCombineW PathAppendW PathFindFileNameW StrCmpNIW PathRemoveBackslashW SHSetValueW PathAddBackslashW PathCanonicalizeW PathIsRelativeW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

Sharing

General

Malware Config

Signatures

File Explorer

9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

psapi

generic