a0592029540c7dfe7a9b3220af230fff3ecbd87b310551133c055b2cfa258e07

Sharing

Copy URL Twitter E-mail

General

Target
a0592029540c7dfe7a9b3220af230fff3ecbd87b310551133c055b2cfa258e07
Size 6.3MB
Sample260930-kcrmfsag72
SHA256 a0592029540c7dfe7a9b3220af230fff3ecbd87b310551133c055b2cfa258e07
MD5 aff62c3011af64cdba3beb2eddb3232d
SHA1 515080a1a68a1d3b8abf96dac02f8a8f3229597d
SHA512 5024409683ebec06d2c2b61f671212a3352878c86633d7e63a14a8605667b818fff2de8094179544fc2f3e13d5e3928cf7403cbebd07567c4e2852f6a2d7d7f4
SSDEEP 98304:FfzkeyLgJ/giDVUnsbeYKUFZqpOjucoKC2VE7kIqYy6Bucl4+lF/cqlbrGvwb5/V:hggJgiDjqY1Zqp9nkVEoIqRXi/VpH
TLSH
T16866E01127EA1029F0F256309AF452B35A75BD522B3CCD9F50A60F4D8A63AC17923FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0592029540c7dfe7a9b3220af230fff3ecbd87b310551133c055b2cfa258e07

File Explorer

a0592029540c7dfe7a9b3220af230fff3ecbd87b310551133c055b2cfa258e07

.exe 6.3MB

a0592029540c7dfe7a9b3220af230fff3ecbd87b310551133c055b2cfa258e07

IMPHASH 9b28bbf02ec96de434c6a8edc3df779e
SHA256 a0592029540c7dfe7a9b3220af230fff3ecbd87b310551133c055b2cfa258e07
MD5 aff62c3011af64cdba3beb2eddb3232d
SHA1 515080a1a68a1d3b8abf96dac02f8a8f3229597d
SHA512 5024409683ebec06d2c2b61f671212a3352878c86633d7e63a14a8605667b818fff2de8094179544fc2f3e13d5e3928cf7403cbebd07567c4e2852f6a2d7d7f4
SSDEEP 98304:FfzkeyLgJ/giDVUnsbeYKUFZqpOjucoKC2VE7kIqYy6Bucl4+lF/cqlbrGvwb5/V:hggJgiDjqY1Zqp9nkVEoIqRXi/VpH
TLSH
T16866E01127EA1029F0F256309AF452B35A75BD522B3CCD9F50A60F4D8A63AC17923FE7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

286480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\805612\out\Release\DesktopRest.pdb

kernel32

InterlockedCompareExchange GetFileSize ReadFile InitializeCriticalSection lstrlenA MapViewOfFileEx InterlockedExchange TerminateThread GetExitCodeThread CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus GetVersion GlobalAlloc GetFileSizeEx FindClose GetModuleHandleA FindFirstFileW FindNextFileW WritePrivateProfileStringW GlobalFree SetCurrentDirectoryW GetACP CreateThread ReleaseSemaphore SetFilePointerEx RemoveDirectoryW OpenThread GetModuleHandleExW GetThreadLocale SetThreadLocale LocalFree SystemTimeToFileTime GetLocalTime InterlockedIncrement GetFileAttributesW SetFileTime LocalFileTimeToFileTime GetCurrentDirectoryW CreateDirectoryW WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers OpenMutexW GetFileType GetStdHandle ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject GetProcessAffinityMask DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SignalObjectAndWait CreateTimerQueue SetUnhandledExceptionFilter UnhandledExceptionFilter ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA GetCPInfo LCMapStringW CompareStringW QueryPerformanceFrequency TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread TryEnterCriticalSection GetStringTypeW LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent FreeResource DuplicateHandle GetVersionExW lstrlenW GetCurrentProcess QueryPerformanceCounter OpenFileMappingW CreateFileMappingW UnmapViewOfFile MapViewOfFile GetCurrentThread ResumeThread SetThreadPriority GetStartupInfoW CreateProcessW CopyFileW DeleteFileW GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW GetCommandLineW GetModuleFileNameW LoadLibraryW lstrcmpiW MulDiv SetFilePointer WriteFile SizeofResource LoadResource DeleteCriticalSection WideCharToMultiByte MultiByteToWideChar SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess CreateFileW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle GetCurrentThreadId GetCurrentProcessId OpenProcess GetProcessHeap HeapSize HeapDestroy GetTempPathW LockResource GetTimeZoneInformation InterlockedDecrement

user32

CharLowerW DispatchMessageW TranslateMessage GetMessageW PeekMessageW SendMessageTimeoutW DefWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow CharNextW GetSystemMetrics GetDC ReleaseDC SetWindowLongW FindWindowW GetWindowThreadProcessId LoadCursorW PostMessageW MsgWaitForMultipleObjects RegisterWindowMessageW SendMessageW PostQuitMessage CallWindowProcW DestroyWindow GetWindowLongW WaitForInputIdle ShowWindow MoveWindow IsWindowVisible GetWindowRect CopyRect GetParent wsprintfW KillTimer OffsetRect EnumDisplayMonitors GetMonitorInfoW SetSysColors SetWindowPos

gdi32

DeleteObject CreateDCW DeleteDC CreateCompatibleDC GetDeviceCaps

advapi32

RegCloseKey RegCreateKeyExW GetTokenInformation OpenProcessToken RegQueryInfoKeyW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegDeleteValueW RegDeleteKeyW

shell32

ord165 ShellExecuteW SHGetSpecialFolderPathW SHGetFolderPathW ord680

ole32

CoTaskMemRealloc CoUninitialize CoCreateInstance CoInitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

DispCallFunc VariantClear VariantInit SysAllocStringLen SysFreeString SysAllocString VarUI4FromStr

shlwapi

SHDeleteKeyW StrCpyNW PathAppendW PathFileExistsW PathFindFileNameW SHDeleteValueW PathIsRootW PathCombineW SHSetValueW SHGetValueW PathRemoveFileSpecW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

comctl32

InitCommonControlsEx

gdiplus

GdiplusShutdown GdiplusStartup

crypt32

CryptStringToBinaryA

winmm

timeSetEvent timeKillEvent

msi

ord173 ord217

generic

count=20, id=241, version=40116,

count=174, id=243, version=40116,

count=31, id=242, version=40116,

count=2, id=199, version=41118,

count=26, id=259, version=26706,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=36, id=260, version=26706,

count=135, id=261, version=26706,

count=5, id=264, version=27048,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=603, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=9, id=260, version=27048,

count=91, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,