3891175fecc735fd9f2baf40bb93a37329bead049f3192f35d3c6d33c3fb8a10
- SHA256 3891175fecc735fd9f2baf40bb93a37329bead049f3192f35d3c6d33c3fb8a10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
最新版.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
最新版.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 3891175fecc735fd9f2baf40bb93a37329bead049f3192f35d3c6d33c3fb8a10
- Size 4.9MB
- Sample261027-e5fg1aav7t
- SHA256 3891175fecc735fd9f2baf40bb93a37329bead049f3192f35d3c6d33c3fb8a10
- MD5 beffa702718d13f260deadf39fa4732f
- SHA1 e5fe0718470c11afe703db9c2a66a2cafdffc163
- SHA512 dab419b1d5fb6883edee3c078120c3c585c23e0fc6c0e2bbe14195f358ed030eade2b5f5b5664aafd77d7760b7ac78bd1dfa39daf492eb6e6691483488539d3a
- SSDEEP 98304:Mj6egzuZYQ4IPmilaRjU7QT3eIy4Zude1MwQvVcy0MO1If/:MjSSeilaBUWOm1MbvVcpMF/
- TLSH T1A23633028964B161DB46EDBF39238E5BF665C3431E6F45F856BE00A853CDC93804BF6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/最新版.exe
File Explorer
-
3891175fecc735fd9f2baf40bb93a37329bead049f3192f35d3c6d33c3fb8a10.zip 4.9MB
-
最新版.exe.exe 8.1MB
最新版.exe
- IMPHASH 22c67069e019fd068a56e96f40392001
- SHA256 cb5820004d0a8127b38796cc3dbf938f27b07035ee04f9db22d48144ca0ca7c3
- MD5 915d562bd7f47582ec0b50506c8f44c5
- SHA1 f48c5689adbc6cbf84a6bdf987161cdba2997650
- SHA512 5dd3d49049aff2e2064738cce4be2da1ceeb295efd5ae5f3f49fa310d5ff9dac0a140af4a623caee66c22d5b0fda42c79b03a137350c51281929344c7bf05b30
- SSDEEP 98304:20UDqm2TZ6bOh0WCB+T5doCXziCfGNiHRNIEoT0UDqmUTZ6b+w0WCB+T5doCXzif:lSGO6VcSAEowSEf6VcSAEo
- TLSH T1BC86E012BB81C073E59E0171517AA77B193EB6320735C4C7A3D42EA9AD306D2AB3D397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
325541
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\vmagent_new\bin\joblist\861621\out\Release\CPInstaller.pdb
kernel32
DeviceIoControl
GetLogicalDriveStringsW
FlushInstructionCache
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetVersionExW
GetExitCodeThread
WriteFile
SetFilePointer
WaitForSingleObject
SetEvent
CreateEventW
FlushFileBuffers
MoveFileExW
ReadFile
FreeResource
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
SetEnvironmentVariableW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetTempPathW
WritePrivateProfileStringW
InterlockedIncrement
InterlockedDecrement
GetTempFileNameW
CreateMutexW
GetCurrentProcessId
ResetEvent
WaitForMultipleObjects
CreateThread
CopyFileW
GetPrivateProfileStringA
GetCurrentThread
lstrcmpiW
LocalFileTimeToFileTime
SetFileTime
CloseHandle
SetFileAttributesW
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
OutputDebugStringW
SetFilePointerEx
SystemTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTickCount
Sleep
GetLocaleInfoA
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateFileW
GetStringTypeA
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleA
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
TlsFree
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoW
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
ExitThread
ExitProcess
VirtualQuery
GetSystemInfo
VirtualProtect
GetConsoleMode
GetConsoleCP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
GetSystemWindowsDirectoryW
lstrcmpiA
lstrcmpA
CreateFileA
GetSystemDirectoryW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetModuleFileNameW
RemoveDirectoryW
SetLastError
lstrlenA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryW
GetCurrentProcess
OpenProcess
GetFileSizeEx
GetDriveTypeW
GetDiskFreeSpaceExW
TlsAlloc
GetWindowsDirectoryW
DeleteFileW
FormatMessageW
CreateDirectoryW
GetLastError
GetStdHandle
SetEndOfFile
SetConsoleTextAttribute
TlsSetValue
TlsGetValue
GetCurrentThreadId
GetFileAttributesW
MultiByteToWideChar
InterlockedExchange
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
InterlockedCompareExchange
FindResourceExW
FindResourceW
LoadResource
LockResource
GetStringTypeW
DosDateTimeToFileTime
SizeofResource
lstrlenW
user32
GetClassInfoExW
SendMessageTimeoutW
IsWindow
GetDC
UnregisterClassA
GetWindowThreadProcessId
GetShellWindow
SetWindowPos
SetForegroundWindow
BringWindowToTop
IsIconic
ShowWindow
IsWindowVisible
MessageBoxW
GetActiveWindow
FillRect
GetClientRect
RedrawWindow
GetParent
DefWindowProcW
SetWindowLongW
GetWindowLongW
CallWindowProcW
BeginPaint
EndPaint
EndDialog
MoveWindow
GetWindowRect
ScreenToClient
GetDlgItem
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindow
ReleaseDC
GetWindowTextW
EnableWindow
SetWindowTextW
RegisterClassW
CharNextW
PrintWindow
PostQuitMessage
IsDlgButtonChecked
GetSystemMetrics
LoadImageW
SetDlgItemTextW
CreateDialogParamW
PeekMessageW
GetMessageW
GetClassInfoW
DispatchMessageW
FindWindowExW
SystemParametersInfoW
UpdateLayeredWindow
SetWindowRgn
KillTimer
SetTimer
CopyRect
DialogBoxParamW
RegisterClassExW
GetCursorPos
IsWindowEnabled
DestroyWindow
LoadCursorW
TranslateMessage
IsDialogMessageW
ClientToScreen
CreateWindowExW
PtInRect
GetWindowTextLengthW
InvalidateRect
UpdateWindow
ScrollWindow
SetFocus
SendMessageW
PostMessageW
gdi32
CombineRgn
CreateRectRgn
SetBkColor
ExtTextOutW
BeginPath
MoveToEx
AngleArc
LineTo
EndPath
PathToRegion
SelectClipRgn
BitBlt
CreateCompatibleBitmap
SetViewportOrgEx
CreateDIBSection
SelectObject
DeleteDC
CreateCompatibleDC
DeleteObject
CreateSolidBrush
GetDeviceCaps
GetObjectW
CreateFontW
advapi32
LookupPrivilegeValueW
RegOpenKeyExA
RegEnumKeyExA
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
InitiateSystemShutdownW
OpenThreadToken
ImpersonateSelf
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
DuplicateTokenEx
CreateProcessAsUserW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueExA
GetTokenInformation
shell32
SHGetSpecialFolderPathW
ShellExecuteExW
SHCreateDirectoryExW
SHBrowseForFolderW
SHGetPathFromIDListW
SHFileOperationW
CommandLineToArgvW
ShellExecuteW
ord165
ole32
CoInitialize
CoUninitialize
CoCreateGuid
CreateStreamOnHGlobal
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
oleaut32
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
SysStringLen
SysFreeString
SysAllocString
shlwapi
SHGetValueW
SHSetValueW
StrCpyW
PathCombineW
PathRemoveFileSpecW
AssocQueryStringW
PathFindExtensionW
PathIsRelativeW
PathCompactPathExW
StrStrIW
PathIsPrefixW
PathIsDirectoryEmptyW
PathUnquoteSpacesW
PathQuoteSpacesW
PathAddBackslashW
PathFindFileNameW
StrCmpNIW
PathRemoveExtensionW
PathIsSameRootW
PathStripToRootW
PathCanonicalizeW
PathAppendW
PathFileExistsW
StrCmpIW
StrTrimA
SHSetValueA
SHGetValueA
StrStrIA
comctl32
InitCommonControlsEx
_TrackMouseEvent
gdiplus
GdipAlloc
GdipFree
GdiplusShutdown
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipCreateFromHDC
GdipDeleteGraphics
GdipCloneImage
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
wininet
InternetCloseHandle
HttpOpenRequestW
HttpSendRequestW
InternetOpenW
InternetConnectW
HttpQueryInfoW
version
GetFileVersionInfoW
VerQueryValueW
iphlpapi
GetAdaptersInfo
Name
.text
Size
420KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7.5MB
Virtual Size
7.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=150, version=20413,
count=33, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=175, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=138, version=30729,
count=5, id=132, productName=VS2008 build 21022, version=21022,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=33, id=123, productName=VS2005 build 50727, version=50727,
count=406, id=1, productName=Unmarked objects,
count=127, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,