8c153f3b867e39e07872f816961fe3fae0f3087bdd0a3298a471522c71fd9a76

Sharing

Copy URL Twitter E-mail

General

Target
8c153f3b867e39e07872f816961fe3fae0f3087bdd0a3298a471522c71fd9a76
Size 4.8MB
Sample261011-nc9d2sts6m
SHA256 8c153f3b867e39e07872f816961fe3fae0f3087bdd0a3298a471522c71fd9a76
MD5 405f7ccb78755b98a5bd2ba7c4c1900f
SHA1 fea9303ab490df0d98ce15ca8bd1a34ad1919d95
SHA512 8a2363cdae25f1563a99870e7fb083dc9a200c23e0cfaa14f8989aeb3533adc83460a2408bd1bb3bfe979869287990c0df1f43c077fd12dfa87d548e0611beaa
SSDEEP 98304:UDSu7pQGaJ782D2bYEMcWaE+WtnQ1N5aG4yjOS5Jz3BfL:j6aJYm2bY9c3unSfb4rITL
TLSH
T19F362300BBD1D0F2D6521577019BD32B5AB6A237172859C3F6482E3AAF703E1AD37399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c153f3b867e39e07872f816961fe3fae0f3087bdd0a3298a471522c71fd9a76

File Explorer

8c153f3b867e39e07872f816961fe3fae0f3087bdd0a3298a471522c71fd9a76

.exe 4.8MB

8c153f3b867e39e07872f816961fe3fae0f3087bdd0a3298a471522c71fd9a76

IMPHASH 12db252371fc9da9fe3a15e758b2a928
SHA256 8c153f3b867e39e07872f816961fe3fae0f3087bdd0a3298a471522c71fd9a76
MD5 405f7ccb78755b98a5bd2ba7c4c1900f
SHA1 fea9303ab490df0d98ce15ca8bd1a34ad1919d95
SHA512 8a2363cdae25f1563a99870e7fb083dc9a200c23e0cfaa14f8989aeb3533adc83460a2408bd1bb3bfe979869287990c0df1f43c077fd12dfa87d548e0611beaa
SSDEEP 98304:UDSu7pQGaJ782D2bYEMcWaE+WtnQ1N5aG4yjOS5Jz3BfL:j6aJYm2bY9c3unSfb4rITL
TLSH
T19F362300BBD1D0F2D6521577019BD32B5AB6A237172859C3F6482E3AAF703E1AD37399
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

383623

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\890882\out\Release\Setup.pdb

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

GetPrivateProfileStringW GetTempPathW GetLocalTime GetCurrentProcessId DeviceIoControl FindClose FindNextFileW CopyFileW FindFirstFileW GetLogicalDriveStringsW GetWindowsDirectoryW GetSystemDirectoryW GetFileAttributesW GetExitCodeProcess RemoveDirectoryW DeleteFileW GetTempFileNameW lstrcatW InterlockedExchange MoveFileExW MoveFileW SetCurrentDirectoryW GetCurrentDirectoryW SetThreadPriority ResumeThread Process32NextW Process32FirstW CreateToolhelp32Snapshot OpenProcess CreateMutexW ReadFile GetFileSize TlsFree ReleaseMutex CreateMutexA GetModuleHandleA ProcessIdToSessionId Thread32Next SuspendThread OpenThread Thread32First GlobalMemoryStatus SystemTimeToFileTime FileTimeToSystemTime SetEnvironmentVariableW WritePrivateProfileSectionW QueryDosDeviceW ReadProcessMemory Module32NextW Module32FirstW GetPrivateProfileIntW InterlockedCompareExchange GetFileAttributesExW TlsSetValue TlsGetValue GetCommandLineW GetLongPathNameW lstrcmpW GetACP TerminateProcess GetPrivateProfileSectionW GetTimeZoneInformation FileTimeToLocalFileTime GetProcAddress SetFilePointer GetLocaleInfoW SetConsoleCtrlHandler GetConsoleMode WritePrivateProfileStringW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringA GetStartupInfoA GetFileType SetHandleCount GetDateFormatA GetTimeFormatA LCMapStringW IsValidCodePage GetOEMCP GetCPInfo ExitProcess HeapCreate FatalAppExitA GetCurrentThread TlsAlloc GetModuleFileNameA GetStdHandle GetStartupInfoW ExitThread GetSystemTimeAsFileTime RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA CreateProcessW GetModuleFileNameW IsValidLocale CreateFileA SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile CompareStringA SetEnvironmentVariableA MultiByteToWideChar CompareStringW FreeLibrary SetLastError InterlockedDecrement InterlockedIncrement FreeResource LocalFileTimeToFileTime SetFilePointerEx GetFileSizeEx OutputDebugStringW HeapUnlock HeapLock HeapWalk GetLastError GetCurrentProcess FlushInstructionCache lstrlenW lstrcpyW AreFileApisANSI WideCharToMultiByte Sleep FindResourceExW FindResourceW CreateFileMappingW MapViewOfFile UnmapViewOfFile SetFileTime LoadLibraryExW GetCurrentThreadId lstrcmpiW CreateThread WaitForSingleObject TerminateThread ExpandEnvironmentStringsW CreateFileW WriteFile CloseHandle GetDriveTypeW GetDiskFreeSpaceExW GetVersionExW GetVersion GetConsoleCP LoadResource LockResource SizeofResource RaiseException GetTickCount CreateDirectoryW SetFileAttributesW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleHandleW GetFileTime GetLocaleInfoA

user32

WaitForInputIdle MoveWindow GetWindowRgn EnumThreadWindows CharLowerBuffW SetCursor GetSysColor ClientToScreen WindowFromPoint GetSystemMetrics SwitchToThisWindow SetForegroundWindow BringWindowToTop UnregisterClassA SendMessageTimeoutW FillRect CallWindowProcW GetDlgCtrlID SetCapture UpdateWindow GetCapture ReleaseCapture PtInRect CreateDialogParamW SetRectEmpty DestroyCursor DefWindowProcW FindWindowW RegisterClassExW LoadCursorW PeekMessageW GetMessageW TranslateMessage DispatchMessageW LoadImageW GetClassNameW CreateCursor PostQuitMessage OffsetRect CharNextW GetCursorPos LoadStringW DrawTextW GetWindow SystemParametersInfoW MapWindowPoints IsWindow AdjustWindowRectEx IsDialogMessageW MessageBoxW GetDlgItem GetParent ChildWindowFromPoint SetDlgItemTextW GetDlgItemTextW SetFocus EnableWindow KillTimer SetTimer ShowWindow InvalidateRect ReleaseDC GetWindowDC GetDC EndPaint BeginPaint ScreenToClient GetWindowRect GetMenu GetWindowTextLengthW GetWindowTextW SetWindowTextW PostMessageW GetWindowLongW CreateWindowExW SetWindowLongW DestroyWindow SendMessageW ExitWindowsEx SetWindowPos GetClientRect IsWindowEnabled

gdi32

GetPixel DeleteDC Rectangle SetTextColor SetBkMode GetStockObject CreateFontIndirectW GetObjectW DeleteObject CreateCompatibleDC CreateCompatibleBitmap SelectObject StretchBlt CreatePen CreateBrushIndirect PtInRegion CreateRectRgn CreateDIBSection BitBlt SetStretchBltMode

advapi32

EqualSid RegCreateKeyW RegQueryValueExA LookupPrivilegeValueW AdjustTokenPrivileges RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW RegQueryValueExW RegDeleteValueW RegEnumValueW RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegCloseKey IsValidSid ConvertSidToStringSidA FreeSid AllocateAndInitializeSid GetTokenInformation LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetUserNameW OpenProcessToken

shell32

ShellExecuteW SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderLocation SHFileOperationW ord165 SHGetFolderPathW SHCreateDirectoryExW SHChangeNotify ShellExecuteExW CommandLineToArgvW SHGetSpecialFolderPathW

ole32

CoSetProxyBlanket CoUninitialize CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoInitializeSecurity CoInitializeEx CoInitialize

oleaut32

VarUI4FromStr VariantClear SysFreeString SysAllocString

shlwapi

PathAppendW StrCmpNIW SHDeleteKeyW SHDeleteValueW StrCmpNW PathRemoveFileSpecW SHSetValueW PathFindFileNameW StrStrIW PathCombineW PathAddBackslashW PathRemoveBackslashW SHGetValueW PathIsDirectoryW PathFileExistsW

comctl32

_TrackMouseEvent ImageList_Destroy InitCommonControlsEx ImageList_GetIconSize

ws2_32

connect htons socket gethostbyname WSAStartup closesocket

setupapi

SetupIterateCabinetW

psapi

GetModuleFileNameExW

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

wininet

InternetCloseHandle InternetReadFile InternetOpenUrlW InternetOpenW

msimg32

AlphaBlend

Sharing

General

Malware Config

Signatures

File Explorer

8c153f3b867e39e07872f816961fe3fae0f3087bdd0a3298a471522c71fd9a76

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

ws2_32

setupapi

psapi

wintrust

crypt32

wininet

msimg32

generic