c4e88221dbc49959ee4300424937368ee4e6ece544c0a777704e525928391d32

Sharing

Copy URL Twitter E-mail

General

Target
c4e88221dbc49959ee4300424937368ee4e6ece544c0a777704e525928391d32
Size 176KB
Sample261107-3fsb9swtav
SHA256 c4e88221dbc49959ee4300424937368ee4e6ece544c0a777704e525928391d32
MD5 3a54072e2018df30c0f7f2e624ac3260
SHA1 3790ce63c974484812a10f7e595f4d501eaee364
SHA512 e4f0e39282c57adc0c1f2af232fd2703409ee0e9e4a152a408fb263ea8be0cdbeb4b303964452d949fe6c9393b77ff2aa4836a17e6b8c2f9d811bde6ff02c9e7
SSDEEP 3072:rpM+O0BsKDeMli9wZTa6D/6LUjxqm//RhCK92LrQPYMyO5EPJ:+0B7x/Ta6L6L2Q8b32vEYl
TLSH
T1C5048C207BD1C0B3D98B183501F5977A697ABAB10724D5C3B7941F7A9E302D1EA3A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c4e88221dbc49959ee4300424937368ee4e6ece544c0a777704e525928391d32

File Explorer

c4e88221dbc49959ee4300424937368ee4e6ece544c0a777704e525928391d32

.exe 176KB

c4e88221dbc49959ee4300424937368ee4e6ece544c0a777704e525928391d32

IMPHASH 939ce4b4c6495488d9809a33738cb97b
SHA256 c4e88221dbc49959ee4300424937368ee4e6ece544c0a777704e525928391d32
MD5 3a54072e2018df30c0f7f2e624ac3260
SHA1 3790ce63c974484812a10f7e595f4d501eaee364
SHA512 e4f0e39282c57adc0c1f2af232fd2703409ee0e9e4a152a408fb263ea8be0cdbeb4b303964452d949fe6c9393b77ff2aa4836a17e6b8c2f9d811bde6ff02c9e7
SSDEEP 3072:rpM+O0BsKDeMli9wZTa6D/6LUjxqm//RhCK92LrQPYMyO5EPJ:+0B7x/Ta6L6L2Q8b32vEYl
TLSH
T1C5048C207BD1C0B3D98B183501F5977A697ABAB10724D5C3B7941F7A9E302D1EA3A34B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\819052\out\Release\SysCleanProService.pdb

kernel32

CreateToolhelp32Snapshot GetVersion WideCharToMultiByte SetEvent ConnectNamedPipe CreateNamedPipeW WriteFile ReadFile GetOverlappedResult MultiByteToWideChar DisconnectNamedPipe CreateEventW WaitForMultipleObjects OpenEventW Sleep FreeResource GetCurrentProcess GetSystemWindowsDirectoryW WTSGetActiveConsoleSessionId DeleteFileW Process32NextW LockResource CreateFileMappingW Process32FirstW GlobalFree SetLastError GetLastError GetVersionExW SizeofResource GlobalAlloc OpenProcess IsBadReadPtr LoadResource FindResourceW SetErrorMode FindResourceExW UnmapViewOfFile MapViewOfFile GetCurrentProcessId CloseHandle DeleteCriticalSection DeviceIoControl EnterCriticalSection GetProcAddress CreateFileW GetModuleFileNameW LeaveCriticalSection lstrcmpA GetSystemDirectoryW LoadLibraryW FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FreeLibrary InitializeCriticalSection GetConsoleMode GetModuleHandleW LoadLibraryExW InterlockedCompareExchange GetConsoleCP lstrlenA RaiseException HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap CreateFileA SystemTimeToFileTime GetSystemTimeAsFileTime LocalFileTimeToFileTime SetFilePointerEx GetFileSizeEx CreateMutexW TlsGetValue WaitForSingleObject OutputDebugStringW TlsSetValue HeapUnlock OpenThread HeapLock HeapWalk GetCurrentThreadId ReleaseMutex TlsAlloc TlsFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage ExitProcess LCMapStringW HeapCreate VirtualFree VirtualAlloc GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount SetFilePointer lstrcmpiA

advapi32

RegQueryValueExA RegEnumKeyExW RegEnumKeyExA RegOpenKeyExA GetTokenInformation RegCloseKey RegOpenKeyExW RegOpenCurrentUser ImpersonateLoggedOnUser RegQueryValueExW ControlService ReportEventW RegisterServiceCtrlHandlerW SetServiceStatus QueryServiceStatus StartServiceW ChangeServiceConfig2W DeregisterEventSource OpenServiceW StartServiceCtrlDispatcherW OpenSCManagerW DeleteService CloseServiceHandle RegisterEventSourceW CreateServiceW SetSecurityDescriptorDacl InitializeSecurityDescriptor RevertToSelf DuplicateTokenEx CreateProcessAsUserW OpenProcessToken

ole32

CoUninitialize CoInitializeEx

shlwapi

PathFindFileNameW SHGetValueW PathAppendW PathFileExistsW PathRemoveFileSpecW PathCombineW SHGetValueA SHSetValueA

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

urlmon

URLDownloadToCacheFileW

wtsapi32

WTSQueryUserToken

Sharing

General

Malware Config

Signatures

File Explorer

c4e88221dbc49959ee4300424937368ee4e6ece544c0a777704e525928391d32

kernel32

advapi32

ole32

shlwapi

version

urlmon

wtsapi32

generic