9771d294a087a0d7e03614314c6cd50fa088c75349d538d993e8ea024e731eb1

General

Target
9771d294a087a0d7e03614314c6cd50fa088c75349d538d993e8ea024e731eb1
Size 1.5MB
Sample261027-e5ssbsys7l
SHA256 9771d294a087a0d7e03614314c6cd50fa088c75349d538d993e8ea024e731eb1
MD5 0c3350b5020f8d611b7866a89a341fb1
SHA1 ed9df4695135115ccdc61498cb8386fe6f30ed4f
SHA512 5b611d576abd2f9eb9a68011a76ab0e2ca69f0a04ecfc9446f8b4b07dd2f1e4d5598ae73ed6e30e3701a67ea2a9a71e8ec55da08ba267c9d2419376fe8b43b7c
SSDEEP 49152:lQfraqnVpEWU/3Rdo9UYr7tWtGVLrTnNEY:lMkWi3HoGg7/NEY
TLSH
T10E751200FAD284F9D17A94311166D7FB1A7DB8710A60AEDFB3D41A7ECE602C1A624773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9771d294a087a0d7e03614314c6cd50fa088c75349d538d993e8ea024e731eb1

File Explorer

9771d294a087a0d7e03614314c6cd50fa088c75349d538d993e8ea024e731eb1

.exe 1.5MB

9771d294a087a0d7e03614314c6cd50fa088c75349d538d993e8ea024e731eb1

IMPHASH cf66a35ed7d4fd0b4081e73f6b0ade9d
SHA256 9771d294a087a0d7e03614314c6cd50fa088c75349d538d993e8ea024e731eb1
MD5 0c3350b5020f8d611b7866a89a341fb1
SHA1 ed9df4695135115ccdc61498cb8386fe6f30ed4f
SHA512 5b611d576abd2f9eb9a68011a76ab0e2ca69f0a04ecfc9446f8b4b07dd2f1e4d5598ae73ed6e30e3701a67ea2a9a71e8ec55da08ba267c9d2419376fe8b43b7c
SSDEEP 49152:lQfraqnVpEWU/3Rdo9UYr7tWtGVLrTnNEY:lMkWi3HoGg7/NEY
TLSH
T10E751200FAD284F9D17A94311166D7FB1A7DB8710A60AEDFB3D41A7ECE602C1A624773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

50652

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\695102\out\Release\safehp.pdb

kernel32

CloseHandle RaiseException DecodePointer GetProcAddress DeleteCriticalSection GetCurrentProcessId GetModuleHandleW FreeLibrary LoadLibraryExW MultiByteToWideChar GetLastError CreateFileW WriteConsoleW InitializeCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW DeviceIoControl WriteFile GetStdHandle WideCharToMultiByte SetLastError CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW ReadFile GetFileSizeEx SetFilePointerEx LocalFileTimeToFileTime CreateFileA SystemTimeToFileTime HeapFree HeapLock CreateMutexW WaitForSingleObject GetCurrentThreadId ReleaseMutex HeapWalk HeapAlloc GetProcessHeap HeapUnlock OpenThread SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind ExitProcess GetModuleHandleExW GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType HeapSize FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW EnterCriticalSection

advapi32

RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegCloseKey RegEnumKeyExW

shlwapi

PathFileExistsW SHGetValueW PathCombineW

imm32

ImmDisableIME

Sharing

General

Malware Config

Signatures

File Explorer

9771d294a087a0d7e03614314c6cd50fa088c75349d538d993e8ea024e731eb1

kernel32

advapi32

shlwapi

imm32

generic