5afc81cf2ac3da71523d785ac8931801c7c8b79fa8c5c3efa03a3174bb10c9b6

Sharing

Copy URL Twitter E-mail

General

Target
5afc81cf2ac3da71523d785ac8931801c7c8b79fa8c5c3efa03a3174bb10c9b6
Size 7.9MB
Sample261027-g99bzsch34
SHA256 5afc81cf2ac3da71523d785ac8931801c7c8b79fa8c5c3efa03a3174bb10c9b6
MD5 0a52720cea4296e717e16592cfbceebc
SHA1 3a21ee9027f9bfc236ffd5059baaa4c5e07a675c
SHA512 fbd83589241a653bac1c11bcced4486cbb96389fd0a94c59c1f4e8403d0bf601216ecbf97b1fc630c3e844ea0ad407a1eb2f0621f84239b57a89d32547497c81
SSDEEP 196608:Z2B458bSvBWYlsZzQG1mhwSvvFvCF3CeJ+:Z2B4WbS5W+suG12wSl2nc
TLSH
T19486AE11F2958024F4B346B06D7DBA29587EBF752B36D1CF2680369E49B0AC22D71B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5afc81cf2ac3da71523d785ac8931801c7c8b79fa8c5c3efa03a3174bb10c9b6

File Explorer

5afc81cf2ac3da71523d785ac8931801c7c8b79fa8c5c3efa03a3174bb10c9b6

.exe 7.9MB

5afc81cf2ac3da71523d785ac8931801c7c8b79fa8c5c3efa03a3174bb10c9b6

IMPHASH 3536c7fb1cf5bbcc8d729cdac514ddd3
SHA256 5afc81cf2ac3da71523d785ac8931801c7c8b79fa8c5c3efa03a3174bb10c9b6
MD5 0a52720cea4296e717e16592cfbceebc
SHA1 3a21ee9027f9bfc236ffd5059baaa4c5e07a675c
SHA512 fbd83589241a653bac1c11bcced4486cbb96389fd0a94c59c1f4e8403d0bf601216ecbf97b1fc630c3e844ea0ad407a1eb2f0621f84239b57a89d32547497c81
SSDEEP 196608:Z2B458bSvBWYlsZzQG1mhwSvvFvCF3CeJ+:Z2B4WbS5W+suG12wSl2nc
TLSH
T19486AE11F2958024F4B346B06D7DBA29587EBF752B36D1CF2680369E49B0AC22D71B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2866966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\1010741\out\Release\Reader.pdb

kernel32

OpenThread ResumeThread GetModuleHandleExW Thread32First Thread32Next GlobalSize GlobalLock GlobalUnlock GetThreadLocale SetThreadLocale SystemTimeToTzSpecificLocalTime SystemTimeToFileTime FileTimeToSystemTime GetModuleHandleA GetSystemTime InterlockedIncrement GetShortPathNameW SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateDirectoryW GetFileAttributesW CreateThread MoveFileW SetThreadPriority ReleaseSemaphore ReadDirectoryChangesW GetExitCodeProcess CopyFileW MulDiv SetHandleInformation CreatePipe PeekNamedPipe LocalAlloc GetBinaryTypeW ReleaseMutex SleepEx GetCommandLineW SetCurrentDirectoryW ProcessIdToSessionId FlushFileBuffers GlobalFree GlobalAlloc SetFilePointerEx InterlockedDecrement GetTempFileNameW GetTempPathW GetComputerNameW FindNextFileW FindFirstFileW GetFileAttributesExW FormatMessageW GetLocalTime SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA IsValidCodePage FindFirstFileExW WriteConsoleW SetStdHandle GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetStdHandle GetConsoleCP GetConsoleMode GetFileType ExitProcess ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject GetProcessAffinityMask DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SignalObjectAndWait CreateTimerQueue GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetACP GetCurrentDirectoryW VerifyVersionInfoW VerSetConditionMask HeapWalk HeapUnlock HeapLock CreateFileA LCMapStringW CompareStringW GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc QueryPerformanceFrequency QueryPerformanceCounter GetStringTypeW TryEnterCriticalSection GetCurrentThread SwitchToThread DuplicateHandle LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent FindClose lstrcmpiW OpenProcess Process32NextW GetVolumeInformationW GetOEMCP Process32FirstW CreateToolhelp32Snapshot MapViewOfFile PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort GetExitCodeThread TerminateThread GetCurrentThreadId InterlockedExchange MapViewOfFileEx LoadLibraryW CreateFileMappingW lstrlenA UnmapViewOfFile GetFileSize InterlockedCompareExchange GetVersionExW GetCurrentProcess LocalFree GetVersion ExpandEnvironmentStringsW MoveFileExW DeleteFileW SetFileAttributesW lstrlenW ReadFile GetFileSizeEx GetPrivateProfileStringW GetDriveTypeW GetPrivateProfileIntW RemoveDirectoryW SetEndOfFile ReadConsoleW FindResourceExW FindResourceW OutputDebugStringW SetFilePointer WriteFile SizeofResource LoadResource GetProcessHeap HeapSize HeapDestroy LockResource CreateProcessW GetModuleFileNameW DeleteCriticalSection InitializeCriticalSection GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetTimeFormatW GetDateFormatW SetThreadAffinityMask LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetThreadTimes TerminateProcess CreateSemaphoreW Sleep CreateEventW CreateMutexW WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CancelIo DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle GetFullPathNameW CreateFileW

user32

BeginPaint GetUpdateRect SetWindowRgn GetCursor ScreenToClient EqualRect DestroyCursor UnionRect GetSysColor SetWindowLongW GetWindowLongW ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW DefWindowProcW FindWindowW WaitForInputIdle RegisterClassW GetDesktopWindow FindWindowExW GetWindowThreadProcessId CharUpperW SendMessageTimeoutW AttachThreadInput IsIconic BringWindowToTop SetActiveWindow GetForegroundWindow SetForegroundWindow SendMessageW wsprintfW PostMessageW SetWindowPos IsWindowVisible OpenClipboard CloseClipboard GetClipboardData IsClipboardFormatAvailable CallWindowProcW UnregisterClassW GetClassInfoExW LoadCursorW SetTimer KillTimer GetMessageW TranslateMessage DispatchMessageW PostQuitMessage SetFocus EnableWindow GetClientRect GetWindowRect MapWindowPoints GetParent GetWindow MonitorFromWindow GetMonitorInfoW PeekMessageW PostThreadMessageW RegisterDeviceNotificationW UnregisterDeviceNotification SetWindowTextW MoveWindow GetSystemMetrics LoadImageW ClientToScreen GetDC GetDlgItem GetWindowTextW GetWindowTextLengthW CopyRect LoadIconW GetWindowPlacement IsZoomed UpdateWindow GetAsyncKeyState EmptyClipboard RegisterClipboardFormatW SetClipboardData GetMessagePos InvalidateRect SetParent IntersectRect GetFocus SetCursor ReleaseCapture SetCapture UpdateLayeredWindow MapVirtualKeyW MonitorFromPoint MonitorFromRect GetDlgCtrlID RedrawWindow ReleaseDC DrawTextW IsRectEmpty GetClassNameW GetCursorPos PtInRect SystemParametersInfoW GetKeyState CharNextW RegisterWindowMessageW GetKeyNameTextW EndPaint OffsetRect

gdi32

CreateDCW CreateFontW DeleteObject CreateFontIndirectW CreateDIBSection GetObjectW DeleteDC CreateCompatibleDC GetCurrentObject SelectObject SetBkColor SetBkMode SetTextColor GetDeviceCaps EnumFontFamiliesW GetStockObject DPtoLP BitBlt CreateRoundRectRgn CreateRectRgnIndirect GetWindowOrgEx RestoreDC SaveDC ExtSelectClipRgn StretchBlt SetStretchBltMode GetObjectA SetWindowOrgEx GetTextExtentPoint32W

winspool.drv

OpenPrinterW ord203 DeviceCapabilitiesW ClosePrinter GetPrinterW DocumentPropertiesW EnumPrintersW

comdlg32

GetOpenFileNameW GetSaveFileNameW ChooseColorW

advapi32

RegCloseKey RegOpenCurrentUser RegEnumKeyExW RegQueryInfoKeyW ConvertSidToStringSidW GetUserNameW LookupAccountNameW CryptGenRandom CryptReleaseContext CryptAcquireContextW DuplicateTokenEx GetSidSubAuthorityCount GetSidSubAuthority RegOpenKeyW LookupPrivilegeValueW AdjustTokenPrivileges GetTokenInformation OpenProcessToken RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW

shell32

ShellExecuteExW ord155 SHFreeNameMappings SHOpenFolderAndSelectItems ord190 ExtractAssociatedIconW SHGetMalloc ord75 SHParseDisplayName SHBrowseForFolderW SHGetPathFromIDListW CommandLineToArgvW ord680 SHGetSpecialFolderPathW SHChangeNotify SHFileOperationW ShellExecuteW ord165 SHGetFolderPathW

ole32

StringFromCLSID CreateStreamOnHGlobal StringFromGUID2 CoCreateGuid PropVariantClear CoInitialize CoUninitialize CoTaskMemFree CoInitializeEx CoCreateInstance CoTaskMemRealloc GetHGlobalFromStream CoTaskMemAlloc

oleaut32

VariantClear VariantInit SysAllocStringLen SysAllocString SysStringLen LoadTypeLi LoadRegTypeLi VarUI4FromStr DispCallFunc SysFreeString

shlwapi

UrlGetPartW StrStrIW SHStrDupW SHDeleteValueW ord176 StrFormatByteSizeW PathCanonicalizeW PathIsRootW StrCpyNW SHSetValueW PathIsRelativeW PathStripPathW StrCmpW StrCmpIW PathAddBackslashW PathRemoveExtensionW SHDeleteKeyW SHQueryValueExW PathFileExistsW PathAppendW PathCombineW PathFindFileNameW PathFindExtensionW PathRemoveFileSpecW SHGetValueW PathIsDirectoryW StrCpyW StrCmpNIW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetProcessImageFileNameW

gdiplus

GdipSetSmoothingMode GdipCreateLineBrushFromRectI GdipDeleteBrush GdipCloneBrush GdipClosePathFigure GdipDeleteCachedBitmap GdipCreateCachedBitmap GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipFree GdipFillRectangleI GdipSetPixelOffsetMode GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdiplusStartup GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipMeasureString GdipFillPath GdiplusShutdown GdipCreateSolidFill GdipSaveImageToStream GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipResetClip GdipSetClipPath GdipDrawImageRectI GdipAlloc GdipDrawImageRectRectI GdipFillEllipse GdipDrawPath GdipDrawEllipse GdipDrawRectangleI GdipCreatePen1 GdipDeletePen GdipDrawArc GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreatePath GdipDeletePath GdipAddPathPath GdipCreateRegionPath GdipDeleteRegion GdipCreatePathGradientFromPath GdipSetPathGradientPresetBlend GdipSetPathGradientWrapMode GdipSetPathGradientFocusScales GdipFillRegion GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen2 GdipLoadImageFromFile GdipImageRotateFlip GdipSetWorldTransform GdipDrawImageRect GdipBitmapLockBits GdipBitmapUnlockBits GdipAddPathLine ord1 GdipAddPathRectangle GdipAddPathEllipse GdipSetPenDashStyle GdipSetPenDashArray GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipRotateWorldTransform GdipGetWorldTransform GdipDrawLineI

comctl32

_TrackMouseEvent InitCommonControlsEx ord17

msimg32

AlphaBlend

winmm

timeKillEvent timeSetEvent

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CryptQueryObject CryptStringToBinaryA CryptBinaryToStringA CertCloseStore CertFreeCertificateContext CertFindCertificateInStore CertGetNameStringW CryptMsgGetParam CryptMsgClose

setupapi

SetupIterateCabinetW

msi

ord173 ord217

secur32

GetUserNameExW

cabinet

ord22 ord20 ord23

generic

count=33, id=241, version=40116,

count=195, id=243, version=40116,

count=41, id=242, version=40116,

count=4, id=260, version=27043,

count=4, id=199, version=41118,

count=28, id=259, version=26706,

count=68, id=261, version=27051,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=40, id=260, version=26706,

count=138, id=261, version=26706,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=57, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=768, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=190, id=261, version=27048,

count=16, id=260, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,