C:\vmagent_new\bin\joblist\625640\out\Release\Uninstaller.pdb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
General
-
Target
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7
-
Size
689KB
-
MD5
52a0860155906d97838ac445fb91d303
-
SHA1
b6a2317d54c964e270fb63508b12e0c390f9b06a
-
SHA256
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7
-
SHA512
0b2c3da7b07e7ab5ee926aca352fe6fc76007aa0b006efaa23b55db4cae2b362c091839d181a5004f62c1601b966809dd511c638b7448defeba9de1aad030a09
-
SSDEEP
12288:5tpyxhomlpOKPjAavqoBWOmNsaBoPvnTEHeK5d:VyxhoUTv5Wtsa0vA+K5
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7
Files
-
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe windows:5 windows x86 arch:x86
f506a72f90a2dda1f7566cc7dfe652d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
RemoveDirectoryW
CreateEventW
SetEvent
WaitForMultipleObjects
GetTempFileNameW
OpenProcess
TerminateProcess
GlobalAlloc
GlobalFree
GetCurrentThread
GetThreadContext
VirtualQuery
SetThreadPriority
VirtualAlloc
OpenThread
GetSystemInfo
GetThreadPriority
VirtualProtect
SuspendThread
ResumeThread
WideCharToMultiByte
SetFilePointer
GetTickCount
ReadFile
GetFileSizeEx
lstrcmpiW
GetLastError
CreateMutexW
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
InterlockedExchange
FindClose
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
WriteFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
SetHandleCount
GetModuleFileNameA
HeapCreate
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
GetStartupInfoW
GetCurrentProcessId
GetFileType
WriteConsoleW
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReleaseMutex
HeapWalk
HeapLock
HeapUnlock
OutputDebugStringW
TlsGetValue
SetFilePointerEx
LocalFileTimeToFileTime
CreateFileA
FindNextFileW
FindFirstFileW
lstrcpyW
CreateThread
GetSystemDirectoryW
InterlockedCompareExchange
Sleep
GetSystemWindowsDirectoryW
FreeResource
MulDiv
CopyFileW
GetLongPathNameW
GetEnvironmentVariableW
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
GetVersion
DeleteCriticalSection
InitializeCriticalSection
RaiseException
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
DeviceIoControl
lstrlenW
FreeLibrary
LoadLibraryW
CreateFileW
LocalAlloc
DeleteFileW
MoveFileExW
SetFileAttributesW
GetTempPathW
GetVersionExW
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CloseHandle
TlsFree
TlsAlloc
TlsSetValue
GetSystemTimeAsFileTime
GetModuleHandleA
ExitProcess
SystemTimeToFileTime
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetStdHandle
LoadLibraryExW
CreateProcessW
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
FreeEnvironmentStringsW
user32
ShowWindow
SetForegroundWindow
BringWindowToTop
CharNextW
SetWindowPos
FindWindowW
CreateDialogParamW
PostMessageW
IsWindow
SetWindowLongW
IsIconic
GetSystemMenu
EnableMenuItem
LoadImageW
ReleaseCapture
GetDlgCtrlID
SystemParametersInfoW
SetCapture
AdjustWindowRectEx
GetMenu
GetParent
SetWindowTextW
PostQuitMessage
GetDlgItem
IsDialogMessageW
SetCursor
SetTimer
PtInRect
ClientToScreen
GetCapture
UpdateWindow
DrawFocusRect
GetSystemMetrics
InflateRect
DrawEdge
GetSysColor
IsWindowEnabled
KillTimer
OffsetRect
FillRect
InvalidateRect
EndPaint
DrawTextW
GetWindowTextW
GetClientRect
BeginPaint
CallWindowProcW
GetWindowLongW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
SendMessageW
DestroyWindow
DefWindowProcW
MessageBoxW
ReleaseDC
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetDC
GetWindowRect
UnregisterClassA
gdi32
GetCurrentObject
GetStockObject
CreateSolidBrush
CreateDIBSection
BitBlt
StretchBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
DeleteDC
SetTextColor
SelectObject
SetBkMode
GetDeviceCaps
CreateFontW
advapi32
RegQueryInfoKeyW
RegDeleteValueW
RegQueryValueExA
RegDeleteKeyW
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
shell32
SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteW
ole32
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemAlloc
CreateStreamOnHGlobal
oleaut32
VariantClear
VarUI4FromStr
VariantInit
SysFreeString
SysAllocString
shlwapi
SHDeleteKeyW
SHSetValueW
StrStrIW
SHGetValueW
PathFileExistsW
PathCombineW
PathAppendW
PathRemoveFileSpecW
StrStrIA
comctl32
ImageList_SetImageCount
ImageList_Create
InitCommonControlsEx
ImageList_GetIconSize
ImageList_Draw
ImageList_Destroy
_TrackMouseEvent
ImageList_Add
gdiplus
GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdipAlloc
GdipFree
GdipCreateBitmapFromStream
GdipDisposeImage
GdiplusStartup
psapi
GetModuleFileNameExW
EnumProcesses
EnumProcessModules
Sections
.text Size: 237KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 165KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE