9b0e25390051d19107a38d6c45e5e06b9e286923d852c364eabfc7c30ceb8102

Sharing

Copy URL Twitter E-mail

General

Target
9b0e25390051d19107a38d6c45e5e06b9e286923d852c364eabfc7c30ceb8102
Size 1.2MB
Sample261027-jcp8ysstbx
SHA256 9b0e25390051d19107a38d6c45e5e06b9e286923d852c364eabfc7c30ceb8102
MD5 9b222258593790ab69f1c45feabb287a
SHA1 b7901dcee3fcd26f81fe1216b5b1494daa0fd009
SHA512 cd788853ee7634da12a8cac1c36bf4be442ea019083a7115c178a9cf12ea428f3be4eec9992b3a7a115ebe4acf8d24250ac5ee64220fe69686f2a277755178ab
SSDEEP 12288:EdSWgmq1/yCU/W+EUFvJ5rfYFWGGBHYl53K9dz+wK4udjtQ/7aYEyn5CzDnB0Spi:SqSW+HFfQUNB4vF4udpkjEDj2j
TLSH
T11B45BD12A687CB66DA87007241E58E35972DBDA133C79DC3726436ED9D303C1AB36BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b0e25390051d19107a38d6c45e5e06b9e286923d852c364eabfc7c30ceb8102

File Explorer

9b0e25390051d19107a38d6c45e5e06b9e286923d852c364eabfc7c30ceb8102

.exe 1.2MB

9b0e25390051d19107a38d6c45e5e06b9e286923d852c364eabfc7c30ceb8102

IMPHASH c655d4c10703bd102eada058fbab550c
SHA256 9b0e25390051d19107a38d6c45e5e06b9e286923d852c364eabfc7c30ceb8102
MD5 9b222258593790ab69f1c45feabb287a
SHA1 b7901dcee3fcd26f81fe1216b5b1494daa0fd009
SHA512 cd788853ee7634da12a8cac1c36bf4be442ea019083a7115c178a9cf12ea428f3be4eec9992b3a7a115ebe4acf8d24250ac5ee64220fe69686f2a277755178ab
SSDEEP 12288:EdSWgmq1/yCU/W+EUFvJ5rfYFWGGBHYl53K9dz+wK4udjtQ/7aYEyn5CzDnB0Spi:SqSW+HFfQUNB4vF4udpkjEDj2j
TLSH
T11B45BD12A687CB66DA87007241E58E35972DBDA133C79DC3726436ED9D303C1AB36BC9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

170115

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\661480\out\Release\360FileChecker.pdb

kernel32

CreateFileW GetFileSizeEx FindFirstFileW FindNextFileW GetFileAttributesW GetFileAttributesA GetTempPathW GetVersion GetCommandLineW SetFilePointer GlobalLock SetEvent GetTickCount WriteFile GlobalAlloc ReadFile GlobalUnlock CreateEventW GetCurrentProcessId GetTempFileNameW FindClose DeleteFileW WaitForSingleObject WaitForMultipleObjects InterlockedExchange DeviceIoControl WideCharToMultiByte GetModuleHandleExW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetModuleHandleA QueryPerformanceCounter CloseHandle FreeEnvironmentStringsW FlushFileBuffers GetConsoleMode GetConsoleCP GetStringTypeA GetStartupInfoA GetFileType SetHandleCount InitializeCriticalSectionAndSpinCount GetModuleFileNameA GetStdHandle IsValidCodePage GetOEMCP GetACP HeapCreate GetStringTypeW LCMapStringW LCMapStringA RtlUnwind GetStartupInfoW CreateThread ExitThread GetCPInfo IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess TlsFree TlsAlloc ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock TlsSetValue OutputDebugStringW TlsGetValue SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime GetSystemTimeAsFileTime GetCurrentThreadId DeleteCriticalSection lstrcmpiW LockResource EnterCriticalSection GetProcAddress SetLastError GetLastError RaiseException ExitProcess FlushInstructionCache lstrlenW MultiByteToWideChar GetModuleFileNameW MulDiv LeaveCriticalSection GetVersionExW SizeofResource Sleep LoadLibraryW GetSystemDirectoryW InitializeCriticalSection GetModuleHandleW InterlockedCompareExchange GetSystemWindowsDirectoryW GetCurrentProcess InterlockedDecrement InterlockedIncrement LoadLibraryExW LoadResource FreeLibrary SystemTimeToFileTime CreateFileA VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetLocaleInfoA FindResourceW FindResourceExW FreeResource CreateMutexW GetEnvironmentStringsW

user32

SetWindowLongW ShowWindow PeekMessageW TranslateMessage GetDC SendMessageTimeoutW CreateDialogParamW GetActiveWindow MessageBoxW DefWindowProcW UnregisterClassA DispatchMessageW EndPaint BeginPaint GetClassInfoW RegisterClassW CallWindowProcW LoadCursorW RegisterClassExW IntersectRect CreateWindowExW ReleaseDC GetWindowTextLengthW CloseClipboard SetTimer GetWindowRect PostQuitMessage LoadImageW DrawTextW KillTimer DialogBoxParamW GetParent GetClientRect IsDialogMessageW InvalidateRect GetWindowLongW GetWindowTextW EmptyClipboard MonitorFromWindow GetDlgItem SetWindowPos IsWindow OpenClipboard GetSystemMetrics MapWindowPoints EnableWindow SetClipboardData SetWindowTextW GetMonitorInfoW GetWindow MoveWindow PostMessageW IsIconic SendMessageW FindWindowExW DestroyWindow GetMessageW CharNextW FindWindowW EndDialog

gdi32

SetBkColor ExtTextOutW CreateDIBSection DeleteObject GetObjectW SetStretchBltMode GetTextExtentPointW DeleteDC SelectObject CreateFontW GetDeviceCaps CreateCompatibleDC

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegQueryValueExA RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegCloseKey RegEnumKeyExW CheckTokenMembership RegOpenKeyExW FreeSid AllocateAndInitializeSid RegQueryValueExW

shell32

ShellExecuteW ShellExecuteExW DragQueryFileW

ole32

OleInitialize CoTaskMemAlloc CoInitialize CoTaskMemFree CoTaskMemRealloc CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysStringLen VariantInit SysStringByteLen VarUI4FromStr SysAllocString VariantClear SysAllocStringByteLen

version

VerQueryValueW

shlwapi

PathCombineW SHGetValueW PathRemoveFileSpecW PathCanonicalizeW PathIsRelativeW PathAppendW PathFileExistsW

comctl32

InitCommonControlsEx ord17

msimg32

AlphaBlend

gdiplus

GdiplusShutdown GdiplusStartup

Sharing

General

Malware Config

Signatures

File Explorer

9b0e25390051d19107a38d6c45e5e06b9e286923d852c364eabfc7c30ceb8102

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

version

shlwapi

comctl32

msimg32

gdiplus

generic