ec729f0da14041a880a7ca60bfb9fb0dd063f77fb51c8176e69d11f045679dbb

Sharing

Copy URL Twitter E-mail

General

Target
ec729f0da14041a880a7ca60bfb9fb0dd063f77fb51c8176e69d11f045679dbb
Size 4.8MB
Sample261011-ryw8dsww6m
SHA256 ec729f0da14041a880a7ca60bfb9fb0dd063f77fb51c8176e69d11f045679dbb
MD5 ca395faec14ce67cef849fcb0749fe9c
SHA1 be8853a874a79081400f4db28a01d2dc3bba2613
SHA512 f4a2d94c760a01506a5180818c823de0879b1bdc6705b5e43e0fa718088b6e5eb642497d327aeee72ced1fa38184e7a780b1aff2c5ffef875ce18d45f95d8870
SSDEEP 98304:VcOpi3ZD2O41Veya4BnXxA83uuCh5fIdBG4yce8FB1k:VcncMyrlS8Tf3De
TLSH
T14836F121F922C176D5A342319D7C9ABB85ACBF254F3404CB63C83E295D705D32E36A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec729f0da14041a880a7ca60bfb9fb0dd063f77fb51c8176e69d11f045679dbb

File Explorer

ec729f0da14041a880a7ca60bfb9fb0dd063f77fb51c8176e69d11f045679dbb

.exe 4.8MB

ec729f0da14041a880a7ca60bfb9fb0dd063f77fb51c8176e69d11f045679dbb

IMPHASH 9911d466c777d93c39819a8170e33d6a
SHA256 ec729f0da14041a880a7ca60bfb9fb0dd063f77fb51c8176e69d11f045679dbb
MD5 ca395faec14ce67cef849fcb0749fe9c
SHA1 be8853a874a79081400f4db28a01d2dc3bba2613
SHA512 f4a2d94c760a01506a5180818c823de0879b1bdc6705b5e43e0fa718088b6e5eb642497d327aeee72ced1fa38184e7a780b1aff2c5ffef875ce18d45f95d8870
SSDEEP 98304:VcOpi3ZD2O41Veya4BnXxA83uuCh5fIdBG4yce8FB1k:VcncMyrlS8Tf3De
TLSH
T14836F121F922C176D5A342319D7C9ABB85ACBF254F3404CB63C83E295D705D32E36A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

902596

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\960660\out\Release\DiskPartSetup.pdb

kernel32

GlobalFree GetLongPathNameW OpenProcess GetCurrentProcess SetEndOfFile GetDiskFreeSpaceExW CreateDirectoryW SetFileAttributesW DeleteFileW MoveFileExW GetVolumeInformationW GetFileAttributesExW OpenThread lstrcmpA lstrcmpiW GetModuleHandleExW GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToFileTime GetModuleHandleA GetVersionExW InterlockedIncrement GetCommandLineW GetExitCodeThread InterlockedDecrement LoadLibraryW UnmapViewOfFile GetFileSize InterlockedCompareExchange FindNextFileW FindFirstFileW GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW OutputDebugStringW FormatMessageW GetLocalTime FindClose SetFilePointer WriteFile SizeofResource WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetFileType ExitProcess ExitThread RtlUnwind LoadResource GetCurrentThreadId GetProcessHeap HeapSize SetFilePointerEx LocalFree LockResource GetModuleFileNameW DeleteCriticalSection InitializeCriticalSection Process32NextW GetUserDefaultLCID GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle FreeLibraryAndExitThread GetCurrentThread UnregisterWait RegisterWaitForSingleObject DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue ReleaseSemaphore GetProcessAffinityMask GlobalMemoryStatus GetStdHandle GetFileInformationByHandle GetSystemWindowsDirectoryW FreeResource lstrcmpiA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP MulDiv GetCurrentDirectoryW SetFileTime GetFileAttributesW VerifyVersionInfoW VerSetConditionMask ReleaseMutex HeapWalk HeapUnlock HeapLock CreateFileA LocalFileTimeToFileTime LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter GetCPInfo TryEnterCriticalSection GetStringTypeW IsDebuggerPresent GlobalAlloc ReadFile HeapDestroy DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetLastError GetLastError RaiseException CloseHandle GetFileSizeEx Process32FirstW CreateToolhelp32Snapshot GetCurrentProcessId CreateFileW

user32

SetWindowPos IsWindowVisible CharUpperW GetDesktopWindow DrawTextW GetSysColor DefWindowProcW GetWindowThreadProcessId SetForegroundWindow GetForegroundWindow SetActiveWindow BringWindowToTop PostMessageW IsIconic ShowWindow IsWindow AttachThreadInput RegisterClassExW DestroyWindow GetWindowLongW SetWindowLongW CreateWindowExW wsprintfW ClientToScreen SetWindowTextW EnableWindow SetFocus GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect GetSystemMetrics KillTimer SetTimer PostQuitMessage SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW FindWindowW IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard CallWindowProcW RegisterClassW UpdateLayeredWindow MoveWindow IsZoomed GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect SetWindowRgn InvalidateRect GetCursorPos ScreenToClient OffsetRect IsRectEmpty PtInRect LoadCursorW MonitorFromPoint EqualRect SetCursor IntersectRect UnionRect SetClipboardData EmptyClipboard GetAsyncKeyState

advapi32

RegEnumKeyExA RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken RegQueryValueExW

shell32

SHGetPathFromIDListW ord165 SHGetSpecialFolderPathW SHBrowseForFolderW ShellExecuteW CommandLineToArgvW SHGetFolderPathW

ole32

CoTaskMemFree CoUninitialize CoInitializeEx CoCreateInstance CoCreateGuid CreateStreamOnHGlobal OleUninitialize CoTaskMemAlloc OleInitialize CoTaskMemRealloc CoInitialize

oleaut32

SysStringLen SysAllocStringLen SysAllocString SysFreeString VarUI4FromStr VariantClear

shlwapi

StrStrIA SHSetValueW SHSetValueA PathIsPrefixW PathIsDirectoryW PathCanonicalizeW StrCmpIW SHGetValueW PathRemoveFileSpecW PathFindFileNameW PathCombineW PathAppendW StrStrIW StrCmpNIW PathFileExistsW SHGetValueA StrTrimA PathIsRelativeW PathRemoveBackslashW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

winmm

timeKillEvent timeSetEvent

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

crypt32

CryptStringToBinaryA

iphlpapi

GetAdaptersInfo

wininet

InternetCrackUrlW InternetOpenW InternetCloseHandle InternetConnectW InternetSetOptionW HttpQueryInfoW HttpSendRequestW HttpOpenRequestW

gdi32

CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps DeleteObject GetWindowOrgEx RestoreDC SaveDC ExtSelectClipRgn CreateCompatibleDC DeleteDC SelectObject SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection GetObjectA SetWindowOrgEx CreateRoundRectRgn BitBlt CreateRectRgnIndirect

gdiplus

GdipMeasureString GdipSetStringFormatFlags GdipSetStringFormatAlign GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipDeleteFont GdipDrawString GdipCloneStringFormat GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSetPathGradientWrapMode GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCloneBrush GdipCreateFontFromLogfontA GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipDeleteBrush GdipSetPathGradientFocusScales GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipFillRegion GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen1 GdipCreatePen2 GdipDeletePen GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipClosePathFigure GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipCreateSolidFill GdipCreateLineBrushFromRectI GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillEllipse GdipFillPath GdipDrawImageRectRectI GdipSetClipPath GdipResetClip GdipCreateFontFromDC

msimg32

AlphaBlend

generic

count=31, id=241, version=40116,

count=190, id=243, version=40116,

count=39, id=242, version=40116,

count=12, id=260, version=27051,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27034,

count=4, id=261, version=27024,

count=4, id=199, version=41118,

count=28, id=259, version=26706,

count=103, id=261, version=27051,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=12, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=135, id=261, version=26706,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=663, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=1, id=260, version=27048,

count=25, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,