11a2c639d2f7a890958dc2f52e2efde42747bbd664c12c401aee7b4be2d0d047

Sharing

Copy URL Twitter E-mail

General

Target
11a2c639d2f7a890958dc2f52e2efde42747bbd664c12c401aee7b4be2d0d047
Size 1.4MB
Sample261011-ndlpdagg38
SHA256 11a2c639d2f7a890958dc2f52e2efde42747bbd664c12c401aee7b4be2d0d047
MD5 70d2c81e48fc7c80e998a9ab4ce794ce
SHA1 1ed52eae997514585165ef30627d9254b3aa3537
SHA512 d0272a22808c6407ee6947a3e092ab8308dc06e9b8383e4d354f3b5e525f4cb940b0bebb8178ede21b4be4f6ba516df00919792db362b17741b4075c42062c9e
SSDEEP 24576:ZqRUQDtlLJg3oQ6XKAsCIh13VsJSUlY430JJcuBiqA/ol198timWRZVTf:ZilLJgYQTlCIhMvlB3AcNqAo9uEf
TLSH
T10265D033798283BEE4BE0130592A87A5533F6D301B3649DF73C8B6591A375E15FB0A62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11a2c639d2f7a890958dc2f52e2efde42747bbd664c12c401aee7b4be2d0d047

File Explorer

11a2c639d2f7a890958dc2f52e2efde42747bbd664c12c401aee7b4be2d0d047

.exe 1.4MB

11a2c639d2f7a890958dc2f52e2efde42747bbd664c12c401aee7b4be2d0d047

IMPHASH 087cdb429a7615d6fc3179efa6e97910
SHA256 11a2c639d2f7a890958dc2f52e2efde42747bbd664c12c401aee7b4be2d0d047
MD5 70d2c81e48fc7c80e998a9ab4ce794ce
SHA1 1ed52eae997514585165ef30627d9254b3aa3537
SHA512 d0272a22808c6407ee6947a3e092ab8308dc06e9b8383e4d354f3b5e525f4cb940b0bebb8178ede21b4be4f6ba516df00919792db362b17741b4075c42062c9e
SSDEEP 24576:ZqRUQDtlLJg3oQ6XKAsCIh13VsJSUlY430JJcuBiqA/ol198timWRZVTf:ZilLJgYQTlCIhMvlB3AcNqAo9uEf
TLSH
T10265D033798283BEE4BE0130592A87A5533F6D301B3649DF73C8B6591A375E15FB0A62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

280195

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\617257\out\Release\MultiMediaOpt.pdb

kernel32

GetDriveTypeW GetDiskFreeSpaceExW GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetVersion CreateEventW WaitForSingleObject SetEvent WaitForMultipleObjects LoadLibraryW CreateFileA ReadFile DeleteFileW GetCurrentThreadId GetCurrentProcessId WriteFile GetCommandLineW SetLastError ResetEvent RaiseException InterlockedDecrement InterlockedIncrement lstrcmpiW ExitProcess CreateMutexW MulDiv DecodePointer GetTempFileNameW FindClose InterlockedExchange WritePrivateProfileStringW DeviceIoControl InitializeCriticalSection GetPrivateProfileStringW HeapDestroy WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage GetSystemDirectoryW FindFirstFileExW GetTimeZoneInformation ReadConsoleW InterlockedCompareExchange GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW HeapFree GetFileType GetACP GetStdHandle GetCommandLineA FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind GetModuleHandleExW QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx LocalFree ReleaseMutex OpenThread HeapWalk HeapUnlock HeapLock SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime SystemTimeToFileTime LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent GetCPInfo GetLogicalDriveStringsW GetLongPathNameW GetTempPathW GetLongPathNameA GetTempPathA GetFileAttributesA GetFileAttributesW FindNextFileW FindFirstFileW CloseHandle GetFileSizeEx CreateFileW FindResourceExW GetProcessHeap HeapAlloc WideCharToMultiByte Sleep HeapReAlloc GetVersionExW GetSystemWindowsDirectoryW GetModuleHandleW GetCurrentProcess LoadLibraryExW FindResourceW SizeofResource LoadResource LockResource FreeResource EnterCriticalSection GetProcAddress FreeLibrary GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread EncodePointer GetStringTypeW GetDateFormatW HeapSize LeaveCriticalSection GetModuleFileNameW MultiByteToWideChar GetConsoleMode

user32

GetWindowTextW GetWindowRect DrawTextW SetCursor GetParent GetClientRect EndPaint BeginPaint InvalidateRect MessageBoxW GetActiveWindow ScreenToClient SendMessageW GetWindowTextLengthW wsprintfW FindWindowExW PostMessageW LoadCursorW IntersectRect RegisterClassW GetClassInfoW PeekMessageW GetMessageW TranslateMessage DispatchMessageW SendMessageTimeoutW FindWindowW CharNextW EndDialog ReleaseDC GetDC CreateWindowExW CreateDialogParamW GetClassInfoExW RegisterClassExW DestroyWindow DialogBoxParamW IsIconic UpdateWindow MoveWindow EnableWindow IsDialogMessageW IsWindowVisible PostQuitMessage GetSystemMetrics SetWindowTextW LoadImageW UnregisterClassW CallWindowProcW GetWindow MonitorFromWindow GetMonitorInfoW MapWindowPoints GetDlgItem SetWindowPos ShowWindow IsWindow SetWindowLongW GetWindowLongW DefWindowProcW

gdi32

SetStretchBltMode GetObjectW CreateCompatibleDC CreateDIBSection ExtTextOutW SetBkColor GetDeviceCaps GetTextExtentPointW DeleteObject SelectObject SetTextColor DeleteDC CreateFontW

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegDeleteKeyW RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExA RegDeleteValueW RegSetValueExW

shell32

ord165 ShellExecuteW SHGetPathFromIDListW DragQueryFileW SHBrowseForFolderW SHCreateDirectoryExW SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoTaskMemRealloc CoInitialize CoUninitialize CoCreateInstance OleInitialize CoTaskMemAlloc

oleaut32

VarUI4FromStr SysFreeString SysAllocString SysStringByteLen SysAllocStringByteLen SysStringLen VariantInit VariantClear

version

VerQueryValueW

shlwapi

PathCombineW PathFileExistsW PathFindExtensionW SHGetValueW PathIsRelativeW PathFindFileNameW PathCanonicalizeW PathRemoveFileSpecW PathAppendW

comctl32

InitCommonControlsEx ord17 _TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdiplusShutdown GdiplusStartup

Sharing

General

Malware Config

Signatures

File Explorer

11a2c639d2f7a890958dc2f52e2efde42747bbd664c12c401aee7b4be2d0d047

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

version

shlwapi

comctl32

msimg32

gdiplus

generic