5e4bca61cfe91754cedd58f4167746894b76e7f4a15e6f738187fbef30527fd9

Sharing

Copy URL Twitter E-mail

General

Target
5e4bca61cfe91754cedd58f4167746894b76e7f4a15e6f738187fbef30527fd9
Size 3.6MB
Sample261102-jckcpsas4l
SHA256 5e4bca61cfe91754cedd58f4167746894b76e7f4a15e6f738187fbef30527fd9
MD5 84ef1c6defd3689a8e008facba8c29c4
SHA1 15280ed3aea98b5d22590a48e8d296d4798bd83b
SHA512 8c0d2e59a7e6dd802606548afad1c047a45b77cdf11f57ca40ae34c3fbf08bca1f029d06f20cf1aedaf75614a1af723d3bc757d5421468d4c84b95ed2e119ff1
SSDEEP 98304:ijFGqQ/3Y7MTbCGF/AsedZD0pB2ucv9XOY:EFTvMT1/POvkY
TLSH
T18506CF1136C2807BD9A30131497DE7FA197D6E351F3081E7A3D43A2D6E389E21A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e4bca61cfe91754cedd58f4167746894b76e7f4a15e6f738187fbef30527fd9

File Explorer

5e4bca61cfe91754cedd58f4167746894b76e7f4a15e6f738187fbef30527fd9

.exe 3.6MB

5e4bca61cfe91754cedd58f4167746894b76e7f4a15e6f738187fbef30527fd9

IMPHASH a81994a8e54b90ebc57ddfe905d7f15e
SHA256 5e4bca61cfe91754cedd58f4167746894b76e7f4a15e6f738187fbef30527fd9
MD5 84ef1c6defd3689a8e008facba8c29c4
SHA1 15280ed3aea98b5d22590a48e8d296d4798bd83b
SHA512 8c0d2e59a7e6dd802606548afad1c047a45b77cdf11f57ca40ae34c3fbf08bca1f029d06f20cf1aedaf75614a1af723d3bc757d5421468d4c84b95ed2e119ff1
SSDEEP 98304:ijFGqQ/3Y7MTbCGF/AsedZD0pB2ucv9XOY:EFTvMT1/POvkY
TLSH
T18506CF1136C2807BD9A30131497DE7FA197D6E351F3081E7A3D43A2D6E389E21A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1388387

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\873524\out\Release\360AblumViewer.pdb

gdiplus

GdipGetImageWidth GdipGetImageHeight GdipCloneImage GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreateFromHDC GdipFree GdipDisposeImage GdipCreateBitmapFromGdiDib GdipDeleteGraphics GdipCreateHBITMAPFromBitmap GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipDrawImageRectI GdipFillRectangleI GdipCreateBitmapFromScan0 GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImagePixelFormat GdipGetImageRawFormat GdipGetImageGraphicsContext GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipGetPropertyItem GdipGetPropertyItemSize GdipDrawImageRectRect GdipReleaseDC GdipAlloc

kernel32

VirtualFree FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW SetThreadAffinityMask GetDateFormatW GetTimeFormatW CompareStringW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetNumberFormatW GetCurrencyFormatW EnumCalendarInfoExW EnumDateFormatsExW GetSystemDefaultLCID GetUserDefaultLCID GetModuleHandleW LockResource HeapDestroy HeapSize GetProcessHeap GetCurrentProcessId DeleteCriticalSection LoadResource SizeofResource FindResourceW FindResourceExW GetPrivateProfileIntW GlobalAlloc GlobalLock GlobalUnlock FileTimeToSystemTime InitializeCriticalSection WaitForMultipleObjects GetFileTime FindFirstChangeNotificationW FindNextChangeNotification FindCloseChangeNotification FreeResource FindClose SetFileTime TzSpecificLocalTimeToSystemTime GetTimeZoneInformation SystemTimeToFileTime lstrlenW FindFirstFileW FindNextFileW GetVersion GetShortPathNameW GetLongPathNameW GetFileSizeEx GetTempPathW RemoveDirectoryW GetFileAttributesExW DeleteFileW QueryPerformanceCounter QueryPerformanceFrequency GetVersionExW InterlockedExchange InterlockedCompareExchange LocalFree GetCurrentProcess GetCurrentThreadId GetSystemTime GetWindowsDirectoryW VirtualAlloc GlobalFree GetFileSize ReadFile GetFileAttributesA DeleteFileA MulDiv WriteFile MoveFileW OutputDebugStringW InterlockedDecrement lstrcmpiW GetSystemWindowsDirectoryW lstrcmpA lstrcmpiA SetEndOfFile SetFilePointer GetLocalTime GetThreadLocale FormatMessageW CreateDirectoryW CopyFileW GetCommandLineW ExpandEnvironmentStringsW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW CreateProcessW SystemTimeToTzSpecificLocalTime MoveFileExW TlsAlloc SwitchToThread IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent VirtualQuery GetNativeSystemInfo GetSystemDirectoryW TlsSetValue TlsFree LCMapStringW GetTickCount GetSystemTimeAsFileTime GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW LocalFileTimeToFileTime CreateFileA SetFilePointerEx HeapLock HeapUnlock HeapWalk OpenThread ReleaseMutex RtlUnwind InterlockedFlushSList ExitProcess GetModuleHandleExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetACP GetCommandLineA GetSystemInfo GetThreadTimes TerminateProcess GetProcessTimes CreateWaitableTimerW CreateSemaphoreW Sleep CreateEventW CreateEventA CreateMutexW CreateMutexA WaitForSingleObjectEx WaitForSingleObject ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CancelIo DeviceIoControl TlsGetValue HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle AreFileApisANSI GetVolumePathNamesForVolumeNameW GetVolumeNameForVolumeMountPointW GetFullPathNameW GetFileAttributesW CreateFileW GetStdHandle GetCurrentThread GetConsoleCP GetConsoleMode VirtualProtect GetFileType IsValidLocale EnumSystemLocalesW ReadConsoleW FlushFileBuffers IsValidCodePage GetOEMCP SetStdHandle WriteConsoleW SetConsoleCtrlHandler FindFirstFileExA FindFirstFileExW FindNextFileA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW OutputDebugStringA ReleaseSemaphore SignalObjectAndWait CreateSemaphoreA GetModuleFileNameA TryEnterCriticalSection HeapQueryInformation SetThreadPriority GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetProcessAffinityMask RegisterWaitForSingleObject UnregisterWait GetModuleHandleA SetProcessAffinityMask DuplicateHandle QueryDepthSList UnregisterWaitEx CreateTimerQueue WaitForMultipleObjectsEx InterlockedIncrement RtlCaptureStackBackTrace

user32

MapWindowPoints GetWindowRect SetWindowTextW TrackPopupMenu GetParent SetWindowPos LoadCursorW SetWindowLongW GetWindowLongW PtInRect CopyRect FillRect GetWindow LoadImageW MonitorFromWindow GetMonitorInfoW InflateRect GetMenuStringW GetSubMenu GetMenuItemID GetMenuItemCount AppendMenuW DeleteMenu SetMenuItemInfoW OffsetRect CharLowerBuffW EqualRect SendMessageTimeoutW UnregisterClassW DestroyWindow CharNextW ShowCursor EnumWindows SetFocus EnableWindow EnumDisplayMonitors SetCapture ScreenToClient GetCursorPos SetCursor GetClientRect GetWindowTextW InvalidateRect ReleaseDC GetDC DrawTextW GetSystemMetrics GetDlgItem CallWindowProcW ReleaseCapture BeginPaint EndPaint IsWindowVisible CreateWindowExW ShowWindow SetPropW GetPropW RemovePropW GetSysColor MonitorFromPoint SetTimer KillTimer SetCursorPos ClientToScreen UpdateWindow LoadMenuW DestroyMenu CheckMenuItem MoveWindow PeekMessageW AttachThreadInput GetWindowPlacement SetWindowPlacement IsZoomed IsClipboardFormatAvailable IsWindowEnabled DefWindowProcW TrackMouseEvent GetForegroundWindow SetForegroundWindow EndDialog EnableMenuItem SetClassLongW GetKeyState PostMessageW SystemParametersInfoW EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsWindow SendMessageW MessageBoxW GetActiveWindow IsRectEmpty IntersectRect GetWindowThreadProcessId DialogBoxParamW

gdi32

SelectClipRgn ExtCreatePen SetROP2 ExtSelectClipRgn ExcludeClipRect CreateRectRgn BitBlt TextOutW GetTextExtentPoint32W CreateCompatibleDC CreateCompatibleBitmap MoveToEx LineTo GetObjectW EndPage StartPage EndDoc StartDocW StretchDIBits ExtTextOutW SetMapMode CreateSolidBrush DeleteDC DeleteObject SelectObject SetBkMode SetTextColor GetTextMetricsW CreateFontW CreateFontIndirectW GetDeviceCaps GetStockObject Rectangle SetDIBitsToDevice GetTextFaceW DPtoLP CreateDCW CreatePen SetBkColor IntersectClipRect

winspool.drv

DeviceCapabilitiesW

comdlg32

PrintDlgExW GetOpenFileNameW GetSaveFileNameW

advapi32

FreeSid RevertToSelf RegCloseKey RegCreateKeyExA RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW ConvertSidToStringSidW LookupAccountNameW RegSetKeySecurity RegGetKeySecurity GetSecurityDescriptorDacl SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce GetAce AddAce GetAclInformation InitializeAcl RegDeleteKeyA AllocateAndInitializeSid RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegDeleteValueA RegDeleteKeyW ImpersonateSelf

shell32

ShellExecuteW ord102 SHCreateDirectoryExW SHGetDesktopFolder ord232 SHFileOperationW SHGetFolderPathW ord17 ord16 ord155 ord18 DragQueryFileW ord165 SHChangeNotify SHGetSpecialFolderPathW DragFinish SHGetFolderLocation DragAcceptFiles

ole32

CoTaskMemFree CreateStreamOnHGlobal CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

VariantInit VariantClear VarUI4FromStr SysAllocString SysFreeString

shlwapi

SHQueryValueExA SHDeleteKeyW SHDeleteKeyA SHQueryValueExW SHCopyKeyA SHCopyKeyW PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW SHGetValueW StrCmpLogicalW PathAddBackslashW PathFindExtensionW StrToIntExW SHGetValueA PathIsDirectoryW PathFindFileNameW

ws2_32

WSASetLastError select htonl ntohs __WSAFDIsSet

version

GetFileVersionInfoSizeA GetFileVersionInfoSizeW GetFileVersionInfoA VerQueryValueW GetFileVersionInfoW

psapi

EnumProcessModules EnumPageFilesA EnumPageFilesW GetPerformanceInfo GetDeviceDriverFileNameW GetDeviceDriverFileNameA GetDeviceDriverBaseNameW GetDeviceDriverBaseNameA EnumDeviceDrivers GetMappedFileNameA GetMappedFileNameW InitializeProcessForWsWatch QueryWorkingSet EmptyWorkingSet GetModuleBaseNameW GetModuleBaseNameA GetProcessImageFileNameW GetProcessImageFileNameA GetWsChanges GetModuleFileNameExW GetModuleFileNameExA

setupapi

SetupDiSetDeviceRegistryPropertyW SetupDiGetClassRegistryPropertyW SetupDiGetDeviceRegistryPropertyW SetupDiSetClassRegistryPropertyW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

secur32

GetUserNameExW

netapi32

Netbios

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CertGetNameStringW

generic

count=35, id=241, version=40116,

count=188, id=243, version=40116,

count=34, id=242, version=40116,

count=6, id=199, version=41118,

count=29, id=259, version=26706,

count=38, id=260, version=26706,

count=11, id=260, version=27045,

count=47, id=261, version=27045,

count=33, productName=Unmarked objects (old),

count=58, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=136, id=261, version=26706,

count=531, id=1, productName=Unmarked objects,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=102, id=261, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,