ae5875a473f22c3a13165906df58e2f1b9d9bbe2e335585c74378763042a8b12

General

Target
ae5875a473f22c3a13165906df58e2f1b9d9bbe2e335585c74378763042a8b12
Size 1.2MB
Sample261017-edf98a119j
SHA256 ae5875a473f22c3a13165906df58e2f1b9d9bbe2e335585c74378763042a8b12
MD5 9036d7d252eeb434db72e5f1109e53a9
SHA1 24e210ab0c0675751a1cac2cc98efc0e5360d46f
SHA512 aff53d2c2a66dc38a3dfecb7ee2eb7ed02d60636269eeb6895431e4ddd6a4cf2a08827bae23b34ce02239d195871c4c26ab042b9a98162b0775050a365153754
SSDEEP 24576:VYvkHcBHqeLWwCZbL5Z1XynBNCf2OotIlWcmlgSllzjcIo:VJ8BKbbL5Z1XyBQZkIlWcyRE
TLSH
T1AE550163AF5150B7DAB6173AA46217B1297DFB323F078B9753901A3A4D302C16D21F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae5875a473f22c3a13165906df58e2f1b9d9bbe2e335585c74378763042a8b12

File Explorer

ae5875a473f22c3a13165906df58e2f1b9d9bbe2e335585c74378763042a8b12

.exe 1.2MB

ae5875a473f22c3a13165906df58e2f1b9d9bbe2e335585c74378763042a8b12

IMPHASH 4156d16573afebc11e64fd1f1077d1ae
SHA256 ae5875a473f22c3a13165906df58e2f1b9d9bbe2e335585c74378763042a8b12
MD5 9036d7d252eeb434db72e5f1109e53a9
SHA1 24e210ab0c0675751a1cac2cc98efc0e5360d46f
SHA512 aff53d2c2a66dc38a3dfecb7ee2eb7ed02d60636269eeb6895431e4ddd6a4cf2a08827bae23b34ce02239d195871c4c26ab042b9a98162b0775050a365153754
SSDEEP 24576:VYvkHcBHqeLWwCZbL5Z1XynBNCf2OotIlWcmlgSllzjcIo:VJ8BKbbL5Z1XyBQZkIlWcyRE
TLSH
T1AE550163AF5150B7DAB6173AA46217B1297DFB323F078B9753901A3A4D302C16D21F2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

108686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\545749\out\Release\360ZipSandbox.pdb

kernel32

VirtualQuery GetCurrentProcess GetCurrentProcessId GetCurrentThreadId OpenThread SetThreadPriority GetThreadPriority GetThreadContext SuspendThread ResumeThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection Sleep CloseHandle GetSystemInfo GetModuleHandleW DecodePointer RaiseException VirtualProtect InitializeCriticalSectionAndSpinCount DeleteCriticalSection FindClose GetModuleFileNameW GetSystemDirectoryW CreateFileW FindFirstFileW FindNextFileW GetFileSizeEx ReadFile SetFilePointer WideCharToMultiByte FreeLibrary SetUnhandledExceptionFilter DeviceIoControl LoadLibraryW LoadLibraryExW GetEnvironmentVariableW GetVersionExW VirtualAlloc FlushInstructionCache GetProcAddress GetLastError HeapReAlloc HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW IsProcessorFeaturePresent UnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW WriteFile SetFilePointerEx LocalFileTimeToFileTime CreateFileA SystemTimeToFileTime SetLastError TlsSetValue HeapFree HeapLock CreateMutexW WaitForSingleObject ReleaseMutex HeapWalk TlsAlloc HeapAlloc GetProcessHeap TlsGetValue TlsFree HeapUnlock RtlUnwind EncodePointer GetStdHandle GetFileType GetModuleHandleExW WriteConsoleW ExitProcess MultiByteToWideChar GetACP WaitForSingleObjectEx CreateThread LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode GetStringTypeW GetCurrentThread

user32

GetMessageW GetInputState PostThreadMessageW

shlwapi

PathRemoveFileSpecW StrStrIA StrStrIW PathMatchSpecW PathCombineW

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryValueExA RegCloseKey RegQueryValueExW

Sharing

General

Malware Config

Signatures

File Explorer

ae5875a473f22c3a13165906df58e2f1b9d9bbe2e335585c74378763042a8b12

kernel32

user32

shlwapi

advapi32

generic