bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923

Sharing

Copy URL Twitter E-mail

General

Target
bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923
Size 3.6MB
Sample261011-hb4vaaxtav
SHA256 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923
MD5 654e0a58a33d8a3b39389bf35132145b
SHA1 9322fe4107f49a8ab804b6795088f0e6ea8feb98
SHA512 932270775dcf5e543eb3f38811c04189d72606e084ee4a9f3c43d7b5202b4fa6030afa9cc0e0a0397dc30470430dd3e5d7426beedafbf6ce9d6a5e31500b2ed9
SSDEEP 49152:ck90UFr4T6SqQ/3du7MAOqgjbzOGxb/AsrWLs/uwSdZHj0pBOH2pB2+65GzIarSM:JjFGqQ/3Y7MTbCGF/AsedZD0pB2ukJTy
TLSH
T18F06DF113AC2807BD9A30131497DE7FA197D7E351F3081E7A3C42A2D6E749E21A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923

File Explorer

bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923

.exe 3.6MB

bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923

IMPHASH a81994a8e54b90ebc57ddfe905d7f15e
SHA256 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923
MD5 654e0a58a33d8a3b39389bf35132145b
SHA1 9322fe4107f49a8ab804b6795088f0e6ea8feb98
SHA512 932270775dcf5e543eb3f38811c04189d72606e084ee4a9f3c43d7b5202b4fa6030afa9cc0e0a0397dc30470430dd3e5d7426beedafbf6ce9d6a5e31500b2ed9
SSDEEP 49152:ck90UFr4T6SqQ/3du7MAOqgjbzOGxb/AsrWLs/uwSdZHj0pBOH2pB2+65GzIarSM:JjFGqQ/3Y7MTbCGF/AsedZD0pB2ukJTy
TLSH
T18F06DF113AC2807BD9A30131497DE7FA197D7E351F3081E7A3C42A2D6E749E21A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1388387

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\873524\out\Release\360AblumViewer.pdb

gdiplus

GdipGetImageWidth GdipGetImageHeight GdipCloneImage GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreateFromHDC GdipFree GdipDisposeImage GdipCreateBitmapFromGdiDib GdipDeleteGraphics GdipCreateHBITMAPFromBitmap GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipDrawImageRectI GdipFillRectangleI GdipCreateBitmapFromScan0 GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImagePixelFormat GdipGetImageRawFormat GdipGetImageGraphicsContext GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipGetPropertyItem GdipGetPropertyItemSize GdipDrawImageRectRect GdipReleaseDC GdipAlloc

kernel32

VirtualFree FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW SetThreadAffinityMask GetDateFormatW GetTimeFormatW CompareStringW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetNumberFormatW GetCurrencyFormatW EnumCalendarInfoExW EnumDateFormatsExW GetSystemDefaultLCID GetUserDefaultLCID GetModuleHandleW LockResource HeapDestroy HeapSize GetProcessHeap GetCurrentProcessId DeleteCriticalSection LoadResource SizeofResource FindResourceW FindResourceExW GetPrivateProfileIntW GlobalAlloc GlobalLock GlobalUnlock FileTimeToSystemTime InitializeCriticalSection WaitForMultipleObjects GetFileTime FindFirstChangeNotificationW FindNextChangeNotification FindCloseChangeNotification FreeResource FindClose SetFileTime TzSpecificLocalTimeToSystemTime GetTimeZoneInformation SystemTimeToFileTime lstrlenW FindFirstFileW FindNextFileW GetVersion GetShortPathNameW GetLongPathNameW GetFileSizeEx GetTempPathW RemoveDirectoryW GetFileAttributesExW DeleteFileW QueryPerformanceCounter QueryPerformanceFrequency GetVersionExW InterlockedExchange InterlockedCompareExchange LocalFree GetCurrentProcess GetCurrentThreadId GetSystemTime GetWindowsDirectoryW VirtualAlloc GlobalFree GetFileSize ReadFile GetFileAttributesA DeleteFileA MulDiv WriteFile MoveFileW OutputDebugStringW InterlockedDecrement lstrcmpiW GetSystemWindowsDirectoryW lstrcmpA lstrcmpiA SetEndOfFile SetFilePointer GetLocalTime GetThreadLocale FormatMessageW CreateDirectoryW CopyFileW GetCommandLineW ExpandEnvironmentStringsW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW CreateProcessW SystemTimeToTzSpecificLocalTime MoveFileExW TlsAlloc SwitchToThread IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent VirtualQuery GetNativeSystemInfo GetSystemDirectoryW TlsSetValue TlsFree LCMapStringW GetTickCount GetSystemTimeAsFileTime GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW LocalFileTimeToFileTime CreateFileA SetFilePointerEx HeapLock HeapUnlock HeapWalk OpenThread ReleaseMutex RtlUnwind InterlockedFlushSList ExitProcess GetModuleHandleExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetACP GetCommandLineA GetSystemInfo GetThreadTimes TerminateProcess GetProcessTimes CreateWaitableTimerW CreateSemaphoreW Sleep CreateEventW CreateEventA CreateMutexW CreateMutexA WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CancelIo DeviceIoControl TlsGetValue HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle AreFileApisANSI GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GetFullPathNameW GetFileAttributesW CreateFileW GetStdHandle GetCurrentThread GetConsoleCP GetConsoleMode VirtualProtect GetFileType IsValidLocale EnumSystemLocalesW ReadConsoleW FlushFileBuffers IsValidCodePage GetOEMCP SetStdHandle WriteConsoleW SetConsoleCtrlHandler FindFirstFileExA FindFirstFileExW FindNextFileA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW OutputDebugStringA ReleaseSemaphore SignalObjectAndWait CreateSemaphoreA GetModuleFileNameA TryEnterCriticalSection HeapQueryInformation SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetProcessAffinityMask RegisterWaitForSingleObject UnregisterWait GetModuleHandleA SetProcessAffinityMask DuplicateHandle QueryDepthSList UnregisterWaitEx CreateTimerQueue WaitForMultipleObjectsEx InterlockedIncrement RtlCaptureStackBackTrace

user32

MapWindowPoints GetWindowRect SetWindowTextW TrackPopupMenu GetParent SetWindowPos LoadCursorW SetWindowLongW GetWindowLongW PtInRect CopyRect FillRect GetWindow LoadImageW MonitorFromWindow GetMonitorInfoW InflateRect GetMenuStringW GetSubMenu GetMenuItemID GetMenuItemCount AppendMenuW DeleteMenu SetMenuItemInfoW OffsetRect CharLowerBuffW EqualRect SendMessageTimeoutW UnregisterClassW DestroyWindow CharNextW ShowCursor EnumWindows SetFocus EnableWindow EnumDisplayMonitors SetCapture ScreenToClient GetCursorPos SetCursor GetClientRect GetWindowTextW InvalidateRect ReleaseDC GetDC DrawTextW GetSystemMetrics GetDlgItem CallWindowProcW ReleaseCapture BeginPaint EndPaint IsWindowVisible CreateWindowExW ShowWindow SetPropW GetPropW RemovePropW GetSysColor MonitorFromPoint SetTimer KillTimer SetCursorPos ClientToScreen UpdateWindow LoadMenuW DestroyMenu CheckMenuItem MoveWindow PeekMessageW AttachThreadInput GetWindowPlacement SetWindowPlacement IsZoomed IsClipboardFormatAvailable IsWindowEnabled DefWindowProcW TrackMouseEvent GetForegroundWindow SetForegroundWindow EndDialog EnableMenuItem SetClassLongW GetKeyState PostMessageW SystemParametersInfoW EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsWindow SendMessageW MessageBoxW GetActiveWindow IsRectEmpty IntersectRect GetWindowThreadProcessId DialogBoxParamW

gdi32

SelectClipRgn ExtCreatePen SetROP2 ExtSelectClipRgn ExcludeClipRect CreateRectRgn BitBlt TextOutW GetTextExtentPoint32W CreateCompatibleDC CreateCompatibleBitmap MoveToEx LineTo GetObjectW EndPage StartPage EndDoc StartDocW StretchDIBits ExtTextOutW SetMapMode CreateSolidBrush DeleteDC DeleteObject SelectObject SetBkMode SetTextColor GetTextMetricsW CreateFontW CreateFontIndirectW GetDeviceCaps GetStockObject Rectangle SetDIBitsToDevice GetTextFaceW DPtoLP CreateDCW CreatePen SetBkColor IntersectClipRect

winspool.drv

DeviceCapabilitiesW

comdlg32

PrintDlgExW GetOpenFileNameW GetSaveFileNameW

advapi32

FreeSid RevertToSelf RegCloseKey RegCreateKeyExA RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW ConvertSidToStringSidW LookupAccountNameW RegSetKeySecurity RegGetKeySecurity GetSecurityDescriptorDacl SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce GetAce AddAce GetAclInformation InitializeAcl RegDeleteKeyA AllocateAndInitializeSid RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteValueA RegDeleteKeyW ImpersonateSelf

shell32

ShellExecuteW ord102 SHCreateDirectoryExW SHGetDesktopFolder ord232 SHFileOperationW SHGetFolderPathW ord17 ord16 ord155 ord18 DragQueryFileW ord165 SHChangeNotify SHGetSpecialFolderPathW DragFinish SHGetFolderLocation DragAcceptFiles

ole32

CoTaskMemFree CreateStreamOnHGlobal CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

VariantInit VariantClear VarUI4FromStr SysAllocString SysFreeString

shlwapi

SHQueryValueExA SHDeleteKeyW SHDeleteKeyA SHQueryValueExW SHCopyKeyA SHCopyKeyW PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW SHGetValueW StrCmpLogicalW PathAddBackslashW PathFindExtensionW StrToIntExW SHGetValueA PathIsDirectoryW PathFindFileNameW

ws2_32

WSASetLastError select htonl ntohs __WSAFDIsSet

version

GetFileVersionInfoSizeA GetFileVersionInfoSizeW GetFileVersionInfoA VerQueryValueW GetFileVersionInfoW

psapi

EnumProcessModules EnumPageFilesA EnumPageFilesW GetPerformanceInfo GetDeviceDriverFileNameW GetDeviceDriverFileNameA GetDeviceDriverBaseNameW GetDeviceDriverBaseNameA EnumDeviceDrivers GetMappedFileNameA GetMappedFileNameW InitializeProcessForWsWatch QueryWorkingSet EmptyWorkingSet GetModuleBaseNameW GetModuleBaseNameA GetProcessImageFileNameW GetProcessImageFileNameA GetWsChanges GetModuleFileNameExW GetModuleFileNameExA

setupapi

SetupDiSetDeviceRegistryPropertyW SetupDiGetClassRegistryPropertyW SetupDiGetDeviceRegistryPropertyW SetupDiSetClassRegistryPropertyW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

secur32

GetUserNameExW

netapi32

Netbios

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CertGetNameStringW

generic

count=35, id=241, version=40116,

count=188, id=243, version=40116,

count=34, id=242, version=40116,

count=6, id=199, version=41118,

count=29, id=259, version=26706,

count=38, id=260, version=26706,

count=11, id=260, version=27045,

count=47, id=261, version=27045,

count=33, productName=Unmarked objects (old),

count=58, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=136, id=261, version=26706,

count=531, id=1, productName=Unmarked objects,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=102, id=261, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,