1ca0ab1a2f3f77c188f80dc48504499297353f9a3eb476d3d143e0163f34175a

Sharing

Copy URL Twitter E-mail

General

Target
1ca0ab1a2f3f77c188f80dc48504499297353f9a3eb476d3d143e0163f34175a
Size 3.7MB
Sample261011-khej3sf14m
SHA256 1ca0ab1a2f3f77c188f80dc48504499297353f9a3eb476d3d143e0163f34175a
MD5 38da2552ca19bd369538f9472160c01e
SHA1 ec59ef4c070fc4b7ec7e1ee4214ee11fc62f5a8d
SHA512 694a310c1d5d730457d719da3aa467ede387c93fcaefb12fb991ca0f34ca8e8226f427cc58b3b75983d68a31ef3ba8cf68700fa869e604809607dacf5d77a62b
SSDEEP 98304:gjFGqQ/3Y7MTbCGF/AsedZL0pB2sTuQXUvW82lUm+O9o:6FTvMT1//WQXUvr2lp
TLSH
T13A06DF113682C07BD9A30131497DE7FA193D6E351F3081E7A3D43A2D6E789E21A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ca0ab1a2f3f77c188f80dc48504499297353f9a3eb476d3d143e0163f34175a

File Explorer

1ca0ab1a2f3f77c188f80dc48504499297353f9a3eb476d3d143e0163f34175a

.exe 3.7MB

1ca0ab1a2f3f77c188f80dc48504499297353f9a3eb476d3d143e0163f34175a

IMPHASH a81994a8e54b90ebc57ddfe905d7f15e
SHA256 1ca0ab1a2f3f77c188f80dc48504499297353f9a3eb476d3d143e0163f34175a
MD5 38da2552ca19bd369538f9472160c01e
SHA1 ec59ef4c070fc4b7ec7e1ee4214ee11fc62f5a8d
SHA512 694a310c1d5d730457d719da3aa467ede387c93fcaefb12fb991ca0f34ca8e8226f427cc58b3b75983d68a31ef3ba8cf68700fa869e604809607dacf5d77a62b
SSDEEP 98304:gjFGqQ/3Y7MTbCGF/AsedZL0pB2sTuQXUvW82lUm+O9o:6FTvMT1//WQXUvr2lp
TLSH
T13A06DF113682C07BD9A30131497DE7FA193D6E351F3081E7A3D43A2D6E789E21A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1388387

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\873524\out\Release\360AblumViewer.pdb

gdiplus

GdipGetImageWidth GdipGetImageHeight GdipCloneImage GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreateFromHDC GdipFree GdipDisposeImage GdipCreateBitmapFromGdiDib GdipDeleteGraphics GdipCreateHBITMAPFromBitmap GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipDrawImageRectI GdipFillRectangleI GdipCreateBitmapFromScan0 GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImagePixelFormat GdipGetImageRawFormat GdipGetImageGraphicsContext GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipGetPropertyItem GdipGetPropertyItemSize GdipDrawImageRectRect GdipReleaseDC GdipAlloc

kernel32

VirtualFree FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW SetThreadAffinityMask GetDateFormatW GetTimeFormatW CompareStringW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetNumberFormatW GetCurrencyFormatW EnumCalendarInfoExW EnumDateFormatsExW GetSystemDefaultLCID GetUserDefaultLCID GetModuleHandleW LockResource HeapDestroy HeapSize GetProcessHeap GetCurrentProcessId DeleteCriticalSection LoadResource SizeofResource FindResourceW FindResourceExW GetPrivateProfileIntW GlobalAlloc GlobalLock GlobalUnlock FileTimeToSystemTime InitializeCriticalSection WaitForMultipleObjects GetFileTime FindFirstChangeNotificationW FindNextChangeNotification FindCloseChangeNotification FreeResource FindClose SetFileTime TzSpecificLocalTimeToSystemTime GetTimeZoneInformation SystemTimeToFileTime lstrlenW FindFirstFileW FindNextFileW GetVersion GetShortPathNameW GetLongPathNameW GetFileSizeEx GetTempPathW RemoveDirectoryW GetFileAttributesExW DeleteFileW QueryPerformanceCounter QueryPerformanceFrequency GetVersionExW InterlockedExchange InterlockedCompareExchange LocalFree GetCurrentProcess GetCurrentThreadId GetSystemTime GetWindowsDirectoryW VirtualAlloc GlobalFree GetFileSize ReadFile GetFileAttributesA DeleteFileA MulDiv WriteFile MoveFileW OutputDebugStringW InterlockedDecrement lstrcmpiW GetSystemWindowsDirectoryW lstrcmpA lstrcmpiA SetEndOfFile SetFilePointer GetLocalTime GetThreadLocale FormatMessageW CreateDirectoryW CopyFileW GetCommandLineW ExpandEnvironmentStringsW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW CreateProcessW SystemTimeToTzSpecificLocalTime MoveFileExW TlsAlloc SwitchToThread IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent VirtualQuery GetNativeSystemInfo GetSystemDirectoryW TlsSetValue TlsFree LCMapStringW GetTickCount GetSystemTimeAsFileTime GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW LocalFileTimeToFileTime CreateFileA SetFilePointerEx HeapLock HeapUnlock HeapWalk OpenThread ReleaseMutex RtlUnwind InterlockedFlushSList ExitProcess GetModuleHandleExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetACP GetCommandLineA GetSystemInfo GetThreadTimes TerminateProcess GetProcessTimes CreateWaitableTimerW CreateSemaphoreW Sleep CreateEventW CreateEventA CreateMutexW CreateMutexA WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CancelIo DeviceIoControl TlsGetValue HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle AreFileApisANSI GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GetFullPathNameW GetFileAttributesW CreateFileW GetStdHandle GetCurrentThread GetConsoleCP GetConsoleMode VirtualProtect GetFileType IsValidLocale EnumSystemLocalesW ReadConsoleW FlushFileBuffers IsValidCodePage GetOEMCP SetStdHandle WriteConsoleW SetConsoleCtrlHandler FindFirstFileExA FindFirstFileExW FindNextFileA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW OutputDebugStringA ReleaseSemaphore SignalObjectAndWait CreateSemaphoreA GetModuleFileNameA TryEnterCriticalSection HeapQueryInformation SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetProcessAffinityMask RegisterWaitForSingleObject UnregisterWait GetModuleHandleA SetProcessAffinityMask DuplicateHandle QueryDepthSList UnregisterWaitEx CreateTimerQueue WaitForMultipleObjectsEx InterlockedIncrement RtlCaptureStackBackTrace

user32

MapWindowPoints GetWindowRect SetWindowTextW TrackPopupMenu GetParent SetWindowPos LoadCursorW SetWindowLongW GetWindowLongW PtInRect CopyRect FillRect GetWindow LoadImageW MonitorFromWindow GetMonitorInfoW InflateRect GetMenuStringW GetSubMenu GetMenuItemID GetMenuItemCount AppendMenuW DeleteMenu SetMenuItemInfoW OffsetRect CharLowerBuffW EqualRect SendMessageTimeoutW UnregisterClassW DestroyWindow CharNextW ShowCursor EnumWindows SetFocus EnableWindow EnumDisplayMonitors SetCapture ScreenToClient GetCursorPos SetCursor GetClientRect GetWindowTextW InvalidateRect ReleaseDC GetDC DrawTextW GetSystemMetrics GetDlgItem CallWindowProcW ReleaseCapture BeginPaint EndPaint IsWindowVisible CreateWindowExW ShowWindow SetPropW GetPropW RemovePropW GetSysColor MonitorFromPoint SetTimer KillTimer SetCursorPos ClientToScreen UpdateWindow LoadMenuW DestroyMenu CheckMenuItem MoveWindow PeekMessageW AttachThreadInput GetWindowPlacement SetWindowPlacement IsZoomed IsClipboardFormatAvailable IsWindowEnabled DefWindowProcW TrackMouseEvent GetForegroundWindow SetForegroundWindow EndDialog EnableMenuItem SetClassLongW GetKeyState PostMessageW SystemParametersInfoW EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsWindow SendMessageW MessageBoxW GetActiveWindow IsRectEmpty IntersectRect GetWindowThreadProcessId DialogBoxParamW

gdi32

SelectClipRgn ExtCreatePen SetROP2 ExtSelectClipRgn ExcludeClipRect CreateRectRgn BitBlt TextOutW GetTextExtentPoint32W CreateCompatibleDC CreateCompatibleBitmap MoveToEx LineTo GetObjectW EndPage StartPage EndDoc StartDocW StretchDIBits ExtTextOutW SetMapMode CreateSolidBrush DeleteDC DeleteObject SelectObject SetBkMode SetTextColor GetTextMetricsW CreateFontW CreateFontIndirectW GetDeviceCaps GetStockObject Rectangle SetDIBitsToDevice GetTextFaceW DPtoLP CreateDCW CreatePen SetBkColor IntersectClipRect

winspool.drv

DeviceCapabilitiesW

comdlg32

PrintDlgExW GetOpenFileNameW GetSaveFileNameW

advapi32

FreeSid RevertToSelf RegCloseKey RegCreateKeyExA RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW ConvertSidToStringSidW LookupAccountNameW RegSetKeySecurity RegGetKeySecurity GetSecurityDescriptorDacl SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce GetAce AddAce GetAclInformation InitializeAcl RegDeleteKeyA AllocateAndInitializeSid RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteValueA RegDeleteKeyW ImpersonateSelf

shell32

ShellExecuteW ord102 SHCreateDirectoryExW SHGetDesktopFolder ord232 SHFileOperationW SHGetFolderPathW ord17 ord16 ord155 ord18 DragQueryFileW ord165 SHChangeNotify SHGetSpecialFolderPathW DragFinish SHGetFolderLocation DragAcceptFiles

ole32

CoTaskMemFree CreateStreamOnHGlobal CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

VariantInit VariantClear VarUI4FromStr SysAllocString SysFreeString

shlwapi

SHQueryValueExA SHDeleteKeyW SHDeleteKeyA SHQueryValueExW SHCopyKeyA SHCopyKeyW PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW SHGetValueW StrCmpLogicalW PathAddBackslashW PathFindExtensionW StrToIntExW SHGetValueA PathIsDirectoryW PathFindFileNameW

ws2_32

WSASetLastError select htonl ntohs __WSAFDIsSet

version

GetFileVersionInfoSizeA GetFileVersionInfoSizeW GetFileVersionInfoA VerQueryValueW GetFileVersionInfoW

psapi

EnumProcessModules EnumPageFilesA EnumPageFilesW GetPerformanceInfo GetDeviceDriverFileNameW GetDeviceDriverFileNameA GetDeviceDriverBaseNameW GetDeviceDriverBaseNameA EnumDeviceDrivers GetMappedFileNameA GetMappedFileNameW InitializeProcessForWsWatch QueryWorkingSet EmptyWorkingSet GetModuleBaseNameW GetModuleBaseNameA GetProcessImageFileNameW GetProcessImageFileNameA GetWsChanges GetModuleFileNameExW GetModuleFileNameExA

setupapi

SetupDiSetDeviceRegistryPropertyW SetupDiGetClassRegistryPropertyW SetupDiGetDeviceRegistryPropertyW SetupDiSetClassRegistryPropertyW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

secur32

GetUserNameExW

netapi32

Netbios

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CertGetNameStringW

generic

count=35, id=241, version=40116,

count=188, id=243, version=40116,

count=34, id=242, version=40116,

count=6, id=199, version=41118,

count=29, id=259, version=26706,

count=38, id=260, version=26706,

count=11, id=260, version=27045,

count=47, id=261, version=27045,

count=33, productName=Unmarked objects (old),

count=58, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=136, id=261, version=26706,

count=531, id=1, productName=Unmarked objects,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=102, id=261, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,