21f4c421aa269a0dcaf3a2afab073f22e20aeba47188d2e2b89d33bb6bca1532

Sharing

Copy URL Twitter E-mail

General

Target

21f4c421aa269a0dcaf3a2afab073f22e20aeba47188d2e2b89d33bb6bca1532
Size

3.1MB
MD5

3a2ae2165b3ebd04f72b3e120706c826
SHA1

478eb075ab454b52eace4841cebf8d2e6992c720
SHA256

21f4c421aa269a0dcaf3a2afab073f22e20aeba47188d2e2b89d33bb6bca1532
SHA512

b1391d6d9bda0c918c0e4e1d2df2d0cfd512522693eb4b96b16e076dc4f6f6ae7db0734bf8b8a3292f8a9e0c0457858783e8b5f8e2b0be8a4ab103f6aadaa678
SSDEEP

49152:6eTtL3h/ddHDBUKK3cyeCd3v5OfUp9TTkEIGy/XmJKRGXOLqP63BP:6gtLx/DHCKK3Bt5OfsIG/QqP63BP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21f4c421aa269a0dcaf3a2afab073f22e20aeba47188d2e2b89d33bb6bca1532

Files

21f4c421aa269a0dcaf3a2afab073f22e20aeba47188d2e2b89d33bb6bca1532
.exe windows x86

e766cb0a1c50717d7eabde5f54480b19

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryW
FreeLibraryAndExitThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
ExpandEnvironmentStringsW
PeekNamedPipe
WaitForMultipleObjects
GetSystemDirectoryA
SleepEx
ResetEvent
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileInformationByHandle
InterlockedCompareExchange
CreateEventW
GetTempPathW
FindResourceW
WriteFile
SizeofResource
LoadResource
LockResource
WideCharToMultiByte
DeleteFileW
GlobalAlloc
GlobalLock
GlobalUnlock
SetEvent
MultiByteToWideChar
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
FreeLibrary
LoadLibraryW
SetCurrentDirectoryW
FindClose
CreateDirectoryW
FindFirstFileW
FindNextFileW
MoveFileExW
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GlobalFree
WaitForSingleObject
CreateProcessW
ReleaseMutex
CreateMutexW
GetFileSizeEx
GetTickCount
AreFileApisANSI
GetVersionExW
lstrcmpiW
GetWindowsDirectoryW
GetSystemInfo
FormatMessageW
FlushInstructionCache
HeapCreate
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeResource
SetLastError
GetFullPathNameW
GetLocalTime
GetVersionExA
GetSystemTime
LoadLibraryA
GetModuleHandleA
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetStringTypeW
CompareStringW
LCMapStringW
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
OutputDebugStringW
WaitForSingleObjectEx
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
SetEndOfFile
OutputDebugStringA
MulDiv
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
QueryDosDeviceW
GetModuleHandleW
GetLogicalDriveStringsW
GetLastError
GetCurrentProcessId
OpenProcess
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetProcAddress
Sleep
InterlockedDecrement
InterlockedIncrement
CreateFileW
WritePrivateProfileStringW
GetModuleFileNameW
lstrlenW
CloseHandle
ReadFile
GetFileSize
GetPrivateProfileStringW
CreateThread

user32

LoadBitmapW
CreateIconFromResource
LoadImageW
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
SetRect
EnableMenuItem
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetSystemMetrics
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
PostQuitMessage
PostMessageW
GetCursorPos
GetMonitorInfoW
MonitorFromWindow
GetWindow
DestroyIcon
SetWindowLongW
MapWindowPoints
GetWindowRect
GetClientRect
GetActiveWindow
GetDlgItem
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetWindowLongW
GetKeyState
GetFocus
SetFocus
PtInRect
EqualRect
IsRectEmpty
UnionRect
CopyRect
SetCursor
KillTimer
SetTimer
DestroyWindow
DestroyCursor
IntersectRect
UnregisterClassW
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
ReleaseDC
GetDC
SendMessageW
ShowWindow
SetWindowPos
SetWindowTextW
InvalidateRect
EndPaint
AnimateWindow
IsWindow
SetForegroundWindow
FindWindowW
BeginPaint
UpdateWindow
ReleaseCapture
SetCapture
GetCapture
GetClassNameW
GetParent
ScreenToClient
IsZoomed
IsIconic
SetLayeredWindowAttributes
TrackMouseEvent
SystemParametersInfoW
LoadCursorW

advapi32

DuplicateTokenEx
CreateProcessAsUserW
LookupAccountSidW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetTokenInformation
GetTokenInformation
RegQueryValueExW
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteW

ole32

CoCreateInstance
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
CreateBindCtx
OleInitialize
CreateStreamOnHGlobal
OleUninitialize

shlwapi

PathFileExistsW
StrToIntExW

psapi

GetProcessImageFileNameW
GetModuleFileNameExW
EnumProcessModules
EnumProcesses

crypt32

CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore

gdiplus

GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipImageGetFrameDimensionsList
GdipAlloc
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetImageEncoders
GdipImageGetFrameCount
GdipDeleteGraphics
GdipDrawImageI
GdipSaveImageToFile
GdipGraphicsClear
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipDrawImageRectI

imm32

ImmAssociateContext
ImmGetContext
ImmDestroyContext
ImmCreateContext
ImmReleaseContext

gdi32

GetViewportOrgEx
GetCurrentObject
SetViewportOrgEx
GetObjectW
CreateDIBSection
EnumFontFamiliesExW
StretchBlt
SetBkMode
Rectangle
DeleteDC
DeleteObject
ExtCreateRegion
IntersectClipRect
SelectClipRgn
SelectObject
SetGraphicsMode
SetWorldTransform
GetStockObject
CreateSolidBrush
CreateFontIndirectW
GetDeviceCaps
GdiFlush
GetTextFaceW
ExtTextOutW
GetTextMetricsW
SetTextAlign
SetTextColor
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextExtentPointI
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsW
GetGlyphOutlineW
GetFontData
GetCharABCWidthsW
CreateBitmap
EnumFontsW
BitBlt
CreateCompatibleDC

oleaut32

SysAllocString
SysFreeString

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

ws2_32

ntohs
setsockopt
WSASetLastError
htonl
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
htons
__WSAFDIsSet
select
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
getsockopt
getsockname
getpeername
connect
bind
send
recv
WSAGetLastError
socket
closesocket
getservbyname
WSACleanup
WSAStartup

usp10

ScriptShape
ScriptItemize
ScriptFreeCache

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 468KB - Virtual size: 468KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e766cb0a1c50717d7eabde5f54480b19

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

crypt32

gdiplus

imm32

gdi32

oleaut32

userenv

ws2_32

usp10

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 468KB - Virtual size: 468KB

.data Size: 59KB - Virtual size: 157KB

.gfids Size: 512B - Virtual size: 376B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 6.6MB - Virtual size: 6.6MB

.reloc Size: 121KB - Virtual size: 121KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 468KB - Virtual size: 468KB

.data
Size: 59KB - Virtual size: 157KB

.gfids
Size: 512B - Virtual size: 376B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 6.6MB - Virtual size: 6.6MB

.reloc
Size: 121KB - Virtual size: 121KB