21c1a977a9f1c0c5c923513dcf653115df798faf58146844a3d176431e829b6c

Sharing

Copy URL Twitter E-mail

General

Target

21c1a977a9f1c0c5c923513dcf653115df798faf58146844a3d176431e829b6c
Size

300KB
MD5

63030b2e0462150fe84c5a8493756931
SHA1

f365f43780f80efc67b0b0db5f219b159879edfa
SHA256

21c1a977a9f1c0c5c923513dcf653115df798faf58146844a3d176431e829b6c
SHA512

b14dbc894505016012df0002ad67e373d06b23981072113a2435d7bd09630f4355a88e9a9e07fcb2bc857a115d58d500c39e44d4f3d457d084b6681cafc12ae0
SSDEEP

3072:4ACGCAYxpEpufTEVjmFpsPpEzlOSVaeIY7W8db5PBUWZDmR98YDCSC:pCQwfTwmFWxEZOSVkY7W8NxAsY

Score

N/A

Malware Config

Signatures

Files

21c1a977a9f1c0c5c923513dcf653115df798faf58146844a3d176431e829b6c
.exe windows x86

fe5e227f52a4eb3d16241ec4bb5e8e9b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

DragQueryPoint
SHGetDiskFreeSpaceA
DuplicateIcon
SHGetMalloc
SHChangeNotify
SHFree
SHFileOperationA
SHCreateShellItem
DragQueryFileA
DragAcceptFiles
ShellMessageBoxA
SHGetDataFromIDListA
ExtractIconA
StrChrA
DragFinish
FindExecutableA
SHGetDesktopFolder

certcli

CACloseCertType
CACloseCA
CADeleteCA
CAEnumFirstCA
CAEnumNextCA

user32

DrawStateA
LoadMenuW
GetClassLongA
GetMessageW
InsertMenuA
GetPropA
GetDlgItemTextW
FlashWindow
LoadBitmapA
DialogBoxParamA
LoadIconA
CreateDesktopW
wsprintfA
IsCharLowerW
DispatchMessageW
LoadCursorA

kernel32

GetPrivateProfileIntA
GetDriveTypeA
GetAtomNameA
GetShortPathNameA
GetGeoInfoW
GetTimeFormatA
UpdateResourceW
GetConsoleAliasW
GetProcessId
LoadLibraryW
GetConsoleTitleW
SleepEx
CompareStringA
VirtualProtect
ReadConsoleA
GetModuleHandleA

uxtheme

CloseThemeData
DrawThemeEdge
IsThemeActive
GetThemeTextExtent
GetThemeBool
OpenThemeData
GetThemeSysSize
GetThemeColor
GetThemeTextMetrics
GetThemeRect
DrawThemeBackground

modemui

CountryRunOnce
drvCommConfigDialogA
drvSetDefaultCommConfigA
InvokeControlPanel

onex

OneXAddTLV
OneXInitialize
OneXDeInitialize
OneXCopyAuthParams

wtsapi32

WTSVirtualChannelClose
WTSEnumerateProcessesA
WTSUnRegisterSessionNotification
WTSVirtualChannelWrite
WTSVirtualChannelOpen
WTSEnumerateServersA
WTSSendMessageA
WTSOpenServerW
WTSEnumerateSessionsW
WTSVirtualChannelPurgeInput
WTSSetUserConfigW

Sections

.text
Size: 240KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe5e227f52a4eb3d16241ec4bb5e8e9b

Headers

DLL Characteristics

File Characteristics

Imports

shell32

certcli

user32

kernel32

uxtheme

modemui

onex

wtsapi32

Sections

.text Size: 240KB - Virtual size: 237KB

.data Size: 48KB - Virtual size: 44KB

.rsrc Size: 8KB - Virtual size: 6KB

.text
Size: 240KB - Virtual size: 237KB

.data
Size: 48KB - Virtual size: 44KB

.rsrc
Size: 8KB - Virtual size: 6KB