9c008d93bdf08970f4fb7f6e73567e7e17adecf35192549291386b3433d5905b

Sharing

Copy URL Twitter E-mail

General

Target
9c008d93bdf08970f4fb7f6e73567e7e17adecf35192549291386b3433d5905b
Size 2.2MB
Sample261002-hlggqstemb
SHA256 9c008d93bdf08970f4fb7f6e73567e7e17adecf35192549291386b3433d5905b
MD5 4838afd7c0cdb557b8e5cd73c66f9188
SHA1 f813c59f08f39f31386666a17d648cb3783e9935
SHA512 5bd5ab666c7ed4447abda1c248cfc60a4c8fee0e92ecf2457195006fb6987429c1b2c16447b2440045cb245793cb94e989f7033ad23da62e3ce5649042404e58
SSDEEP 24576:T+i8vDNRVEroC5o5tuWXUAymWR6tAiPd2nI8zFIgf1xK7/sF2YNyzbGx1zY1CBuO:eNR65ED2m/vPDs1xRF5NyzbGX6CmTAV
TLSH
T1D5A5CF217A438032D5A10170DDFCEB6B957DBE642B7409DB63C43F6D9A709D22D32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c008d93bdf08970f4fb7f6e73567e7e17adecf35192549291386b3433d5905b

File Explorer

9c008d93bdf08970f4fb7f6e73567e7e17adecf35192549291386b3433d5905b

.exe 2.2MB

9c008d93bdf08970f4fb7f6e73567e7e17adecf35192549291386b3433d5905b

IMPHASH af53ed54cf01cb89ba7ba797c62ddd63
SHA256 9c008d93bdf08970f4fb7f6e73567e7e17adecf35192549291386b3433d5905b
MD5 4838afd7c0cdb557b8e5cd73c66f9188
SHA1 f813c59f08f39f31386666a17d648cb3783e9935
SHA512 5bd5ab666c7ed4447abda1c248cfc60a4c8fee0e92ecf2457195006fb6987429c1b2c16447b2440045cb245793cb94e989f7033ad23da62e3ce5649042404e58
SSDEEP 24576:T+i8vDNRVEroC5o5tuWXUAymWR6tAiPd2nI8zFIgf1xK7/sF2YNyzbGx1zY1CBuO:eNR65ED2m/vPDs1xRF5NyzbGX6CmTAV
TLSH
T1D5A5CF217A438032D5A10170DDFCEB6B957DBE642B7409DB63C43F6D9A709D22D32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

713003

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\801169\out\Release\SodaDownloader.pdb

kernel32

SizeofResource WriteFile SetFilePointer OutputDebugStringW FindResourceW FindResourceExW GetPrivateProfileIntW GetPrivateProfileStringW InterlockedCompareExchange GetFileSize lstrlenA InterlockedExchange TerminateThread GetExitCodeThread CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateToolhelp32Snapshot Process32FirstW Process32NextW FindClose ExpandEnvironmentStringsW FindNextFileW GetFileSizeEx ReadFile SetFilePointerEx GlobalAlloc GlobalFree SetEndOfFile SetFileAttributesW DeleteFileW MoveFileExW lstrlenW GetCurrentProcess OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetTempPathW MapViewOfFileEx InterlockedDecrement GetCommandLineW MapViewOfFile EnumSystemLocalesW GetUserDefaultLCID GetThreadLocale GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation UnregisterWait RegisterWaitForSingleObject UnmapViewOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetProcessHeap FindFirstFileExW GetConsoleCP FlushFileBuffers ReadConsoleW HeapDestroy IsValidLocale GetFileType GetStdHandle ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle FreeLibraryAndExitThread GetCurrentThread GetProcessAffinityMask LockResource CreateFileMappingW VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetVersionExW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes GetCurrentThreadId TerminateProcess Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP VerSetConditionMask VerifyVersionInfoW GetCurrentDirectoryW HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo FormatMessageW TryEnterCriticalSection GetStringTypeW IsDebuggerPresent LoadResource IsValidCodePage HeapSize MulDiv SetThreadAffinityMask LocalFree LoadLibraryW GetProcAddress GetModuleFileNameW FreeLibrary DeleteTimerQueueTimer CreateTimerQueueTimer GetModuleHandleW DeviceIoControl DeleteCriticalSection InitializeCriticalSection GetConsoleMode GetFileAttributesW GetCurrentProcessId InterlockedIncrement CreateFileW

user32

SetWindowLongW GetWindowLongW ShowWindow AttachThreadInput IsIconic BringWindowToTop SetActiveWindow GetForegroundWindow SetForegroundWindow DrawTextW GetDesktopWindow SetClipboardData EmptyClipboard GetAsyncKeyState GetSysColor ClientToScreen SetCursor UnionRect EqualRect IntersectRect PtInRect OffsetRect IsZoomed GetCursorPos GetKeyState ScreenToClient SetWindowRgn UpdateLayeredWindow IsRectEmpty GetUpdateRect MoveWindow EndPaint BeginPaint InvalidateRect ReleaseCapture SetCapture GetFocus CallWindowProcW RegisterClassW LoadCursorW MonitorFromPoint FindWindowW GetWindowThreadProcessId SetWindowPos IsWindowVisible OpenClipboard CloseClipboard GetClipboardData IsClipboardFormatAvailable CharNextW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostQuitMessage SetFocus SetWindowTextW GetClientRect GetWindowRect MapWindowPoints GetParent GetWindow GetMonitorInfoW PeekMessageW SetTimer KillTimer LoadImageW IsWindow CreateWindowExW RegisterClassExW DefWindowProcW PostMessageW MonitorFromWindow ReleaseDC GetDC GetSystemMetrics DestroyWindow

gdi32

GetObjectW GetDeviceCaps GetStockObject CreateFontIndirectW DeleteObject BitBlt CreateRoundRectRgn GetWindowOrgEx CreateRectRgnIndirect SaveDC ExtSelectClipRgn RestoreDC CreateDIBSection CreateCompatibleDC SelectObject DeleteDC SetWindowOrgEx SetStretchBltMode StretchBlt SetTextColor SetBkColor SetBkMode GetObjectA

advapi32

GetTokenInformation RegCloseKey RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW RegEnumKeyExA OpenProcessToken OpenSCManagerW EnumServicesStatusW CloseServiceHandle RegOpenKeyW RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteKeyW

shell32

SHGetFolderPathW ShellExecuteExW ShellExecuteW ord165 CommandLineToArgvW

ole32

CoInitialize CoTaskMemRealloc CoTaskMemFree OleUninitialize CoTaskMemAlloc CreateStreamOnHGlobal CoCreateGuid CoCreateInstance CoInitializeEx OleInitialize CoUninitialize

oleaut32

VarUI4FromStr LoadRegTypeLi LoadTypeLi SysStringLen SysAllocString VariantInit SysFreeString

shlwapi

SHGetValueA SHSetValueA StrTrimA StrStrIA PathIsRelativeW ord176 SHGetValueW PathRemoveFileSpecW PathCanonicalizeW PathFileExistsW PathAppendW PathCombineW PathFindFileNameW StrCmpIW StrCmpNIW StrStrIW

version

VerQueryValueW

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmDisableIME

gdiplus

GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipCreateBitmapFromStream GdipImageGetFrameCount GdiplusShutdown GdipGetImageWidth GdipImageGetFrameDimensionsList GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipCreatePen1 GdipDeletePen GdipDrawArc GdipCreateLineBrushFromRect GdipDeleteBrush GdipCloneBrush GdipSetLineBlend GdipCreatePen2 GdipCreateMatrix GdipTranslateMatrix GdipFree GdipAlloc GdiplusStartup GdipCloneImage GdipDisposeImage GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipBitmapLockBits GdipRotateMatrix GdipMeasureString GdipFillEllipse GdipDrawEllipse GdipDrawString GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawPath GdipDrawRectangleI GdipDrawLineI GdipCreateLineBrushFromRectI GdipFillPath GdipCreateSolidFill GdipDrawImageRectRectI GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipSetWorldTransform GdipClosePathFigure ord1 GdipAddPathLine GdipAddPathEllipse GdipAddPathRectangle GdipRotateWorldTransform GdipTranslateWorldTransform GdipGetWorldTransform GdipFillRegion GdipSetPathGradientFocusScales GdipDeleteRegion GdipCreateRegionPath GdipSetPathGradientWrapMode GdipSetPathGradientPresetBlend GdipCreatePathGradientFromPath GdipAddPathPath GdipDeletePath GdipCreatePath GdipSetPixelOffsetMode GdipLoadImageFromFile GdipImageRotateFlip GdipDeleteMatrix GdipDrawImageRect

msimg32

AlphaBlend

crypt32

CryptStringToBinaryA CryptBinaryToStringA

iphlpapi

GetAdaptersInfo

wininet

InternetCrackUrlW InternetOpenW InternetCloseHandle HttpQueryInfoW HttpSendRequestW HttpOpenRequestW InternetSetOptionW InternetConnectW

generic

count=37, id=241, version=40116,

count=177, id=243, version=40116,

count=36, id=242, version=40116,

count=2, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=3, id=199, version=41118,

count=26, id=259, version=26706,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=38, id=265, version=27048,

count=3, id=261, version=27045,

count=10, id=260, version=27045,

count=36, id=260, version=26706,

count=129, id=261, version=26706,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=654, id=1, productName=Unmarked objects,

count=1, id=261, productName=VS2019 v16.11.5 build 30136, version=30136,

count=1, id=260, version=27048,

count=31, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,