491a301359848f109b3a583adec1824ff79e3a006ecf97cc68030f8c9e57c5cb

Sharing

Copy URL Twitter E-mail

General

Target
491a301359848f109b3a583adec1824ff79e3a006ecf97cc68030f8c9e57c5cb
Size 4.8MB
Sample261102-xe59vaex7m
SHA256 491a301359848f109b3a583adec1824ff79e3a006ecf97cc68030f8c9e57c5cb
MD5 b04b933180184e799e1b55994ea8acf9
SHA1 ed0853a5b0ac7088286751a847484eb6f3eee116
SHA512 69c8ccd2112b9986306ce5a6b0ab25f91414ff9f18c9e4c5b0ed0552d81d1c838dd547d38b6041d6d7e9c91dbb7d3e7c414d911c95155ef0a10bd33404924c5b
SSDEEP 98304:bHOa1nc187IKsJUonocnaSJqMjbotQJ+nDeS70l6h5i:aaV7gJUonoH2botUWDeS706h5i
TLSH
T1783612117AC49032E7B30A309A7D9676597EBC316E32898FE784076E19706D1DF2DB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
491a301359848f109b3a583adec1824ff79e3a006ecf97cc68030f8c9e57c5cb

File Explorer

491a301359848f109b3a583adec1824ff79e3a006ecf97cc68030f8c9e57c5cb

.exe 4.8MB

491a301359848f109b3a583adec1824ff79e3a006ecf97cc68030f8c9e57c5cb

IMPHASH e007abe1efd10604a02a720daae5c188
SHA256 491a301359848f109b3a583adec1824ff79e3a006ecf97cc68030f8c9e57c5cb
MD5 b04b933180184e799e1b55994ea8acf9
SHA1 ed0853a5b0ac7088286751a847484eb6f3eee116
SHA512 69c8ccd2112b9986306ce5a6b0ab25f91414ff9f18c9e4c5b0ed0552d81d1c838dd547d38b6041d6d7e9c91dbb7d3e7c414d911c95155ef0a10bd33404924c5b
SSDEEP 98304:bHOa1nc187IKsJUonocnaSJqMjbotQJ+nDeS70l6h5i:aaV7gJUonoH2botUWDeS706h5i
TLSH
T1783612117AC49032E7B30A309A7D9676597EBC316E32898FE784076E19706D1DF2DB23
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

442708

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\1015926\out\Release\Setup.pdb

kernel32

QueryPerformanceFrequency GetFileTime SystemTimeToFileTime GetVolumeInformationW GetFileSizeEx CompareFileTime GetFileSize GetEnvironmentVariableW GetLogicalDriveStringsW GetWindowsDirectoryW GetDriveTypeW WriteConsoleW FlushFileBuffers SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetStdHandle IsValidLocale GetConsoleOutputCP ReadConsoleW GetConsoleMode GetFileType FreeLibraryAndExitThread GlobalAlloc ExitThread GetModuleHandleExW ExitProcess RtlUnwind FreeResource GetSystemWindowsDirectoryW lstrcmpiA lstrcmpA GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree HeapWalk HeapUnlock HeapLock SetFilePointerEx CreateFileA GetCPInfo FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent TlsAlloc LockFile SetConsoleTextAttribute DosDateTimeToFileTime TlsSetValue TlsGetValue LocalFileTimeToFileTime GetExitCodeProcess OpenMutexW UnlockFile LockFileEx GetFileAttributesExW FindNextFileA GetStdHandle lstrlenW lstrcmpiW DeleteCriticalSection GetFullPathNameW GetCommandLineW GetLocalTime QueryDosDeviceW GetDiskFreeSpaceExW FindAtomW GlobalAddAtomW InitializeCriticalSection GetSystemTime GlobalDeleteAtom CreateProcessW GetCurrentThread PostQueuedCompletionStatus CreateIoCompletionPort TerminateThread OutputDebugStringW FindNextFileW FindClose MoveFileExW MoveFileW CopyFileW GetPrivateProfileStringW GlobalFindAtomW Process32NextW CreateToolhelp32Snapshot WritePrivateProfileStringW FindResourceW SizeofResource LockResource LoadResource GetModuleHandleA FindResourceExW GetVersion DeviceIoControl GetProcessHeap HeapDestroy GetTempPathW WriteFile SetFilePointer SetFileAttributesW RemoveDirectoryW ReadFile GetTempFileNameW DeleteFileW CreateDirectoryW EnumSystemLocalesW GetUserDefaultLCID GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetTimeZoneInformation MulDiv LocalFree LocalAlloc GlobalFree GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary UnmapViewOfFile MapViewOfFile CreateFileMappingW ReadProcessMemory VirtualFree VirtualAlloc GetVersionExW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetSystemInfo GlobalMemoryStatusEx IsProcessorFeaturePresent GetCurrentThreadId CreateThread TerminateProcess GetCurrentProcessId GetCurrentProcess Sleep CreateEventW CreateMutexW WaitForSingleObject ReleaseMutex ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetQueuedCompletionStatus HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError RaiseException FormatMessageW SetFileTime Process32FirstW SetEndOfFile AreFileApisANSI GetVolumeNameForVolumeMountPointW GetLongPathNameW GetFileAttributesW FindFirstFileW FindFirstFileA CreateFileW

user32

IsIconic DialogBoxParamW CopyRect SetWindowRgn MessageBeep RedrawWindow SetFocus GetDlgCtrlID EnableMenuItem PeekMessageW BringWindowToTop SetWindowPos GetSystemMenu LoadIconW PostThreadMessageW GetShellWindow CreateDialogParamW LoadCursorW GetParent PtInRect InflateRect ScreenToClient GetMonitorInfoW GetWindow GetWindowRect GetWindowTextW SetWindowTextW MoveWindow GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage ExitWindowsEx wsprintfW CreateWindowExW DestroyWindow UpdateLayeredWindow SetTimer GetSystemMetrics GetDC ReleaseDC MapWindowPoints GetWindowLongW SetWindowLongW FindWindowW FindWindowExW GetWindowThreadProcessId LoadImageW MonitorFromWindow wvsprintfW GetActiveWindow MessageBoxW SendMessageTimeoutW UnregisterClassW CharNextW IsWindow ShowWindow IsWindowVisible GetDlgItem SetDlgItemTextW EnableWindow IsWindowEnabled SetForegroundWindow CallWindowProcW BeginPaint EndPaint GetWindowTextLengthW GetClientRect GetCursorPos TrackMouseEvent RegisterClassExW GetClassInfoExW KillTimer InvalidateRect EndDialog

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC CreateRectRgn CombineRgn SetBkColor CreateSolidBrush EnumFontFamiliesW SetViewportOrgEx CreateDIBSection DeleteObject SelectObject GetDeviceCaps

advapi32

OpenServiceW RegEnumValueA RegEnumKeyExA RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW AddAccessAllowedAce AddAce EqualSid GetAce GetAclInformation GetFileSecurityW GetLengthSid GetSecurityDescriptorControl GetSecurityDescriptorDacl InitializeAcl InitializeSecurityDescriptor SetFileSecurityW SetSecurityDescriptorDacl LookupAccountNameW GetUserNameW RegEnumKeyExW RegEnumValueW RegOpenKeyW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW BuildExplicitAccessWithNameW DeleteAce LookupAccountSidW GetExplicitEntriesFromAclW GetTrusteeNameW RegQueryInfoKeyW CopySid GetSecurityDescriptorSacl IsValidSid GetSecurityInfo AllocateAndInitializeSid FreeSid SetSecurityInfo OpenThreadToken AdjustTokenPrivileges ImpersonateSelf LookupPrivilegeValueW ChangeServiceConfigW RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx OpenProcessToken QueryServiceStatusEx StartServiceW QueryServiceStatus RegQueryInfoKeyA OpenSCManagerW ControlService CloseServiceHandle

shell32

SHGetMalloc SHFileOperationW SHCreateDirectoryExW SHGetSpecialFolderLocation SHGetPathFromIDListW ShellExecuteExW ord680 SHBrowseForFolderW SHGetSpecialFolderPathA CommandLineToArgvW ord165 SHChangeNotify ShellExecuteW SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoTaskMemAlloc CoInitializeEx CoUninitialize CoInitializeSecurity CoSetProxyBlanket CoCreateGuid CoCreateInstance CoTaskMemRealloc PropVariantClear OleRun CreateStreamOnHGlobal CoInitialize

oleaut32

VariantInit SysAllocStringByteLen SysStringByteLen SysStringLen SysFreeString SysAllocString VarUI4FromStr SysAllocStringLen VariantClear VariantChangeType

shlwapi

SHDeleteKeyW SHGetValueW StrStrIA SHSetValueA StrCmpNIW StrTrimA StrStrIW StrCmpIW PathAppendW PathCombineW wnsprintfW PathIsDirectoryEmptyW PathIsPrefixW StrCpyW StrCatW PathMatchSpecW PathIsSameRootW StrRetToStrW StrCmpW PathRemoveExtensionW PathFindFileNameW PathUnquoteSpacesW PathRemoveArgsW PathCombineA PathAppendA PathAddBackslashW PathIsDirectoryW SHSetValueW SHGetValueA SHDeleteValueW PathRemoveFileSpecW PathIsRelativeW PathFindExtensionW PathFileExistsW PathFileExistsA PathCommonPrefixW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

psapi

EnumProcesses GetModuleFileNameExW GetProcessImageFileNameW

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

comctl32

InitCommonControlsEx

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertDuplicateCertificateContext CertDeleteCertificateFromStore CertCompareCertificate CertGetNameStringW

gdiplus

GdipCreateSolidFill GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipDrawImagePointRectI GdiplusShutdown GdiplusStartup GdipSetStringFormatLineAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipRestoreGraphics GdipSaveGraphics GdipDrawImageRectRectI GdipFillPath GdipGraphicsClear GdipRotateWorldTransform GdipScaleWorldTransform GdipTranslateWorldTransform GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipSetStringFormatAlign GdipDeleteBrush GdipCloneBrush GdipAddPathBezierI GdipAddPathArcI GdipClosePathFigure GdipDeletePath GdipCreatePath GdipDrawImageRectRect GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes

rpcrt4

NdrAsyncServerCall RpcBindingFree RpcBindingFromStringBindingW RpcStringFreeW NdrServerCall2 NdrAsyncClientCall RpcStringBindingComposeW NdrClientCall2

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

wininet

InternetGetConnectedState

generic

count=24, id=259, version=30795,

count=211, id=261, version=30795,

count=2, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, productName=Unmarked objects (old),

count=10, id=261, version=30147,

count=5, id=253, version=34918,

count=27, id=259, version=34918,

count=22, id=260, version=34918,

count=3, id=261, version=27045,

count=8, id=260, version=27045,

count=95, id=261, version=34918,

count=34, id=260, version=30795,

count=55, id=257, version=30795,

count=748, id=1, productName=Unmarked objects,

count=1, id=261, version=34435,

count=12, id=260, version=35207,

count=145, id=261, version=35207,

count=1, id=255, version=35207,

count=1, id=151,

count=1, id=258, version=35207,