50e39aaa99dececdeadc86d5ff5ce3819fb6c910f222887aa4c249d93decd089

Sharing

Copy URL Twitter E-mail

General

Target
50e39aaa99dececdeadc86d5ff5ce3819fb6c910f222887aa4c249d93decd089
Size 1.4MB
Sample261011-lwt3csff79
SHA256 50e39aaa99dececdeadc86d5ff5ce3819fb6c910f222887aa4c249d93decd089
MD5 edda45aaf495e4cda934f21434cc77ca
SHA1 4f5d80657fd77fb434580737c3c419ab616ae2a4
SHA512 69c7b9b196a3068dec4ef5b5e984d6fe3db8ded365b8ebf4a2e8cffe6a8adc50dc1d3bea227a7b0c1afe16b1baca8e404b12130ebbb50b2d781dc84ed2b3c7c7
SSDEEP 24576:r1RqlekYEPoYbYDwNtZkPbtYNUretAKx7E4GPsJtYoUhQkNER6xyfQHigwMqz:rLElkPbkUre+Kx7RtZUhQkNEwxyfQHO
TLSH
T1E065F151B7C1C1BAD76231364127B3275A3BE6221724ABC7E3D01EA95E202F1BD3935E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50e39aaa99dececdeadc86d5ff5ce3819fb6c910f222887aa4c249d93decd089

File Explorer

50e39aaa99dececdeadc86d5ff5ce3819fb6c910f222887aa4c249d93decd089

.exe 1.4MB

50e39aaa99dececdeadc86d5ff5ce3819fb6c910f222887aa4c249d93decd089

IMPHASH 0bc190562417867a1efe3ffd0787ac7d
SHA256 50e39aaa99dececdeadc86d5ff5ce3819fb6c910f222887aa4c249d93decd089
MD5 edda45aaf495e4cda934f21434cc77ca
SHA1 4f5d80657fd77fb434580737c3c419ab616ae2a4
SHA512 69c7b9b196a3068dec4ef5b5e984d6fe3db8ded365b8ebf4a2e8cffe6a8adc50dc1d3bea227a7b0c1afe16b1baca8e404b12130ebbb50b2d781dc84ed2b3c7c7
SSDEEP 24576:r1RqlekYEPoYbYDwNtZkPbtYNUretAKx7E4GPsJtYoUhQkNER6xyfQHigwMqz:rLElkPbkUre+Kx7RtZUhQkNEwxyfQHO
TLSH
T1E065F151B7C1C1BAD76231364127B3275A3BE6221724ABC7E3D01EA95E202F1BD3935E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

382501

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\910076\out\Release\Release\LiveUpdate360.pdb

kernel32

GetFileAttributesW GetModuleFileNameW GetCurrentThreadId InterlockedDecrement GetLastError TerminateProcess CloseHandle ReleaseMutex SetLastError OpenProcess CreateMutexW SetCurrentDirectoryW RemoveDirectoryW SetErrorMode DeleteFileA lstrlenW GetVersionExW GetCommandLineW ReadFile SetFilePointer GetFileType CreateFileW InitializeCriticalSection GetTickCount MultiByteToWideChar WritePrivateProfileStringW WriteFile GetPrivateProfileIntW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetPrivateProfileStringW GetFileSize Sleep GetTempPathW MoveFileW WideCharToMultiByte SystemTimeToFileTime GetSystemTime GetFileAttributesExW CreateThread lstrlenA DeviceIoControl InterlockedIncrement lstrcmpiW SetEndOfFile GetFileSizeEx WaitForSingleObject GetLocalTime CreateDirectoryW LoadLibraryExW InterlockedCompareExchange HeapFree GetProcessHeap GetCurrentProcess FlushInstructionCache FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetTimeZoneInformation SetEnvironmentVariableA DeleteCriticalSection CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA FlushFileBuffers LCMapStringA GetCurrentDirectoryA PeekNamedPipe GetFileInformationByHandle GetFullPathNameA GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo QueryPerformanceCounter HeapCreate GetStartupInfoA SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ExitProcess RtlUnwind GetStartupInfoW lstrcmpiA lstrcmpA SleepEx LeaveCriticalSection EnterCriticalSection RaiseException InterlockedExchange GetModuleHandleW GetSystemDirectoryW FindFirstFileW DeleteFileW FindNextFileW FindClose GetCurrentProcessId LoadLibraryW GetVersionExA ExpandEnvironmentStringsA FormatMessageA GetSystemDirectoryA GetModuleHandleA SetEvent TlsFree TlsAlloc HeapWalk HeapLock OpenThread HeapAlloc LoadLibraryA IsProcessorFeaturePresent VirtualFree VirtualAlloc HeapDestroy GetProcAddress CompareStringW HeapReAlloc HeapSize HeapUnlock TlsSetValue OutputDebugStringW TlsGetValue SetFilePointerEx LocalFileTimeToFileTime GetSystemTimeAsFileTime CreateFileA FreeLibrary

user32

GetWindowThreadProcessId PostMessageW CreateWindowExW FindWindowW ShowWindow UnregisterClassA GetActiveWindow MessageBoxW RegisterClassExW DestroyWindow PeekMessageW SendMessageTimeoutW SetForegroundWindow LockSetForegroundWindow DefWindowProcW DestroyIcon CreatePopupMenu DestroyMenu AppendMenuW GetMessageW TranslateMessage DispatchMessageW LoadCursorW GetClassInfoExW SetWindowLongW IsHungAppWindow OffsetRect InvalidateRect UpdateWindow EnableWindow CopyRect PtInRect GetAsyncKeyState DialogBoxParamW GetParent GetWindow GetWindowRect MonitorFromWindow GetClientRect MapWindowPoints SetWindowPos ScreenToClient CharNextW GetMonitorInfoW EndDialog CallWindowProcW LoadImageW GetSystemMenu DeleteMenu GetCursorPos IsWindowVisible TrackPopupMenu PostQuitMessage WindowFromPoint IsWindow IsChild KillTimer SetTimer SetWindowTextW SendMessageW GetWindowLongW MonitorFromPoint

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW OpenProcessToken GetTokenInformation RegCreateKeyExW RegSetValueExW RegOpenKeyExA RegQueryValueExW RegCloseKey RegEnumKeyExA RegQueryValueExA

shell32

SHGetSpecialFolderPathW ShellExecuteExW ExtractIconExW Shell_NotifyIconW SHFileOperationW ShellExecuteW

ole32

CoCreateInstance CLSIDFromProgID CoUninitialize CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

SysStringByteLen SysAllocStringByteLen VariantCopy VarUI4FromStr DispCallFunc VariantClear VariantInit SysAllocString SysFreeString

shlwapi

PathAppendW PathFileExistsW SHGetValueW PathRemoveFileSpecW StrStrIW PathFindFileNameW PathIsDirectoryW wvnsprintfW SHGetValueA PathCombineW SHSetValueA

comctl32

InitCommonControlsEx

psapi

EnumProcessModules GetModuleFileNameExW

version

VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

WSASetLastError connect getpeername freeaddrinfo ntohs WSAStartup bind htons select getsockopt __WSAFDIsSet inet_addr sendto getsockname send recv closesocket recvfrom gethostbyname socket ioctlsocket setsockopt htonl WSACleanup WSAGetLastError getaddrinfo

Sharing

General

Malware Config

Signatures

File Explorer

50e39aaa99dececdeadc86d5ff5ce3819fb6c910f222887aa4c249d93decd089

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

version

ws2_32

generic