0e21f393380a3eae8f2b0c2e42404e3c51782db4f146e9cd1d5776c77b6a9cbb

Sharing

Copy URL Twitter E-mail

General

Target

0e21f393380a3eae8f2b0c2e42404e3c51782db4f146e9cd1d5776c77b6a9cbb
Size

3.6MB
MD5

ba2bf1d932bf9f4c9a185bbe6c686cad
SHA1

b9761de9b0484db12cae7e9b0e736a9b00163055
SHA256

0e21f393380a3eae8f2b0c2e42404e3c51782db4f146e9cd1d5776c77b6a9cbb
SHA512

a0ffa063b76f573838cd6b1b837663ded2019d93fea172fe6d042ba05792073aab79d46917b28ae2090b99f3d9094f8d431a294014825e9233716206861f80dd
SSDEEP

49152:2uz9dvdAUCCXe5l4ZkZd+XbAp4X2MRRAjGay3Iov9:2uvv/xaqRRR6U3I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e21f393380a3eae8f2b0c2e42404e3c51782db4f146e9cd1d5776c77b6a9cbb

Files

0e21f393380a3eae8f2b0c2e42404e3c51782db4f146e9cd1d5776c77b6a9cbb
.dll windows:6 windows x86

1530970109a69a0caf5710a8391c72f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

comctl32

ImageList_ReplaceIcon
ImageList_Add
ImageList_AddMasked
ImageList_Destroy
ImageList_Replace
ImageList_Create
ImageList_SetImageCount
_TrackMouseEvent
ImageList_GetIconSize
InitCommonControlsEx
ord380

shell32

ord74
ord88
ShellExecuteW

shlwapi

StrCmpLogicalW
SHAutoComplete
StrCmpIW
ord12

gdiplus

GdipDeleteBrush
GdipCreatePen1
GdipCreateSolidFill
GdipSetSmoothingMode
GdipAlloc
GdipCloneBrush
GdipFree
GdipDeletePen
GdipBitmapLockBits
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipClosePathFigure
GdipFillPath
GdipDrawPath
GdipFillPolygon
GdipCreateFromHDC
GdipDeleteGraphics
GdipFillRectangleI
GdiplusShutdown
GdipDrawLineI
GdipSetClipRectI
GdipCreateLineBrushFromRectI
GdipCreateBitmapFromHBITMAP
GdipDrawImageRectRectI
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdipGetImageHeight
GdipGetImageWidth
GdipCreateBitmapFromScan0
GdipCloneImage
GdipDisposeImage
GdipBitmapUnlockBits
GdiplusStartup

shared

_uGetWindowText@8
_uGetFullPathName@8
_ModalDialog_PokeExisting@0
_ModalDialog_CanCreateNew@0
_uMessageBox@16
_stricmp_utf8_partial@12
_uExtTextOut@32
_uGetTextExtentPoint32@16
_uTabCtrl_InsertItem@12
_uCharLower@4
_uGetFileAttributes@4
_uGetModuleFileName@8
_uSendMessageText@16
_uTreeView_InsertItem@8
_uFixAmpersandChars@8
_uShellNotifyIconEx@32
_uChooseColor@12
_uFormatSystemErrorMessage@8
_uModifyMenu@20
_uGetMenuString@16
_uGetMenuItemType@8
_uTabCtrl_SetItem@12
_uSetDlgItemText@12
_stricmp_utf8_max@12
_uGetOpenFileName@32
_FindOwningPopup@4
_uSendDlgItemMessageText@20
_uShellNotifyIcon@24
_stricmp_utf8_ex@16
_uSetWindowText@8
_uGetDlgItemText@12
_uAppendMenu@16
_uStringCompare@8
_uFixAmpersandChars_v2@8
_ModalDialog_Switch@4
_GetInfiniteWaitEvent@0
_uLoadImage@24
_stricmp_utf8@8
??1uCallStackTracker@@QAE@XZ
??0uCallStackTracker@@QAE@PBD@Z
_uPrintCrashInfo_OnEvent@8
_uBugCheck@0
_uDragQueryFile@12
_uDragQueryFileCount@4

uxtheme

SetWindowTheme
GetThemePartSize
GetThemeMargins
GetThemeTextExtent
DrawThemeText
IsThemeActive
CloseThemeData
IsAppThemed
IsThemePartDefined
GetThemeColor
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
OpenThemeData
EnableThemeDialogTexture
DrawThemeBackground

dwmapi

DwmSetWindowAttribute

usp10

ScriptRecordDigitSubstitution
ScriptFreeCache
ScriptStringFree
ScriptStringAnalyse
ScriptString_pcOutChars
ScriptStringGetLogicalWidths
ScriptStringOut
ScriptString_pSize
ScriptApplyDigitSubstitution

windowscodecs

WICConvertBitmapSource

kernel32

LCMapStringW
CompareStringW
ExitProcess
SetConsoleCtrlHandler
GetFileType
SetStdHandle
ResumeThread
ExitThread
HeapQueryInformation
HeapSize
HeapReAlloc
RtlUnwind
TerminateProcess
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
VirtualFree
VirtualProtect
VirtualAlloc
UnregisterWaitEx
DuplicateHandle
CreateTimerQueue
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateThread
GetCurrentProcess
SignalObjectAndWait
InitializeSListHead
GetModuleHandleA
GetModuleFileNameW
FreeLibraryAndExitThread
GetThreadTimes
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
LoadLibraryExW
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateEventExW
InitializeCriticalSectionEx
SetThreadPriority
GetCurrentThread
CloseHandle
WaitForSingleObject
SetLastError
GetUserDefaultLCID
GetTickCount
GlobalLock
FindResourceW
SizeofResource
LoadResource
LockResource
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
LoadLibraryW
GetProcAddress
FreeLibrary
OutputDebugStringW
GetCurrentThreadId
FormatMessageW
IsDebuggerPresent
MulDiv
CompareStringEx
GetLocalTime
QueryPerformanceCounter
QueryPerformanceFrequency
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
GetModuleHandleExW
GlobalAlloc
GlobalUnlock
GlobalFree
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
HeapAlloc
CreateMutexExW
GetProcessHeap
GetModuleHandleW
DebugBreak
SwitchToThread
GetLocaleInfoEx
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
InitOnceComplete
InitOnceBeginInitialize
TryAcquireSRWLockExclusive
InitializeSRWLock
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
IsProcessorFeaturePresent
GlobalSize
GetTimeFormatW
GetDateFormatW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetTickCount64
RaiseException
GetThreadPriority
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
Sleep
ResetEvent
SetEvent
CreateEventW
WriteConsoleW
EnumSystemLocalesW
GetStdHandle
IsValidLocale
SetFilePointerEx
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetTimeZoneInformation
FlushFileBuffers
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
CreateFileW
GetLastError

user32

GetWindow
EnumWindows
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetCursor
DrawIconEx
GetParent
TrackPopupMenuEx
WindowFromDC
ValidateRect
IsWindowEnabled
GetPropW
SetDlgItemInt
GetWindowPlacement
EnumChildWindows
GetDlgCtrlID
IsClipboardFormatAvailable
EndDeferWindowPos
GetCapture
SystemParametersInfoW
ScrollWindowEx
SetScrollInfo
GetScrollInfo
IsIconic
GetWindowThreadProcessId
ReleaseCapture
DeferWindowPos
GetClassNameW
MonitorFromWindow
ChildWindowFromPointEx
GetMonitorInfoW
MonitorFromPoint
ClientToScreen
SetMenuItemInfoW
InsertMenuW
GetMenuItemCount
GetCursorPos
SetForegroundWindow
GetAsyncKeyState
RealChildWindowFromPoint
GetKeyState
DeregisterShellHookWindow
RegisterShellHookWindow
RegisterWindowMessageW
WindowFromPoint
DestroyWindow
IsChild
IsWindow
UpdateWindow
UnregisterClassW
SetWindowPlacement
RegisterClassW
LoadCursorW
SetActiveWindow
MessageBoxW
BeginDeferWindowPos
DrawTextW
InvalidateRect
DrawEdge
GetDoubleClickTime
SetWindowTextW
GetNextDlgTabItem
SetCapture
ChildWindowFromPoint
CreateDialogParamW
DialogBoxParamW
DrawFocusRect
EqualRect
GetClipboardData
GetIconInfo
GetMenuItemID
GetMenuState
GetSubMenu
CheckMenuRadioItem
UnhookWindowsHookEx
PostMessageW
SetTimer
KillTimer
SetFocus
GetFocus
InsertMenuItemW
GetAncestor
GetDlgItemInt
IntersectRect
MapWindowPoints
GetTopWindow
FillRect
SetLayeredWindowAttributes
GetLayeredWindowAttributes
IsWindowVisible
LoadImageW
GetMessagePos
BeginPaint
EndPaint
PtInRect
GetSystemMetrics
InflateRect
DrawTextExW
GetWindowTextW
GetWindowTextLengthW
RegisterClipboardFormatW
ScreenToClient
DestroyMenu
TrackPopupMenu
AppendMenuW
CreatePopupMenu
GetSysColorBrush
SendDlgItemMessageW
EndDialog
GetDlgItem
DestroyIcon
GetClientRect
GetDC
ReleaseDC
GetWindowRect
EnableWindow
CallWindowProcW
GetWindowLongW
DefWindowProcW
GetComboBoxInfo
SetWindowLongW
CreateWindowExW
RedrawWindow
GetSysColor
SendMessageW
SetWindowPos
SetParent
ShowWindow
DispatchMessageW
TranslateMessage
PostQuitMessage
GetUpdateRect
GetMessageW
SetWindowsHookExW
CallNextHookEx
PostThreadMessageW
CharLowerW
MapDialogRect
GetMenuItemInfoW

gdi32

SetBkColor
SelectObject
GetObjectW
GetTextExtentPoint32W
GetBkMode
CombineRgn
CreateRectRgnIndirect
SetPixel
SetTextAlign
GetTextMetricsW
SetTextColor
OffsetWindowOrgEx
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
BitBlt
CreateDIBSection
GdiFlush
CreatePen
SetBkMode
MoveToEx
LineTo
GetDeviceCaps
GetTextColor
EnumFontFamiliesExW
GdiAlphaBlend
ExtTextOutW
SetWindowOrgEx
GetStockObject
Rectangle
CreateDIBitmap
DeleteDC
CreateFontIndirectW
GetPixel
DeleteObject

comdlg32

ChooseFontW

ole32

RegisterDragDrop
CoCreateFreeThreadedMarshaler
CoUninitialize
CoInitializeEx
OleGetClipboard
OleSetClipboard
CoGetObjectContext
CoGetApartmentType
OleInitialize
OleUninitialize
CoCreateInstance
ReleaseStgMedium
RevokeDragDrop

urlmon

CopyStgMedium

oleaut32

GetErrorInfo
SetErrorInfo
SysAllocString
SysFreeString
SysStringLen

Exports

Exports

foobar2000_get_interface

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 258KB - Virtual size: 258KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.movehcs
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1530970109a69a0caf5710a8391c72f3

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

shell32

shlwapi

gdiplus

shared

uxtheme

dwmapi

usp10

windowscodecs

kernel32

user32

gdi32

comdlg32

ole32

urlmon

oleaut32

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 258KB - Virtual size: 258KB

.data Size: 43KB - Virtual size: 56KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 96KB - Virtual size: 96KB

.movehcs Size: 4KB - Virtual size: 4KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 258KB - Virtual size: 258KB

.data
Size: 43KB - Virtual size: 56KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 96KB - Virtual size: 96KB

.movehcs
Size: 4KB - Virtual size: 4KB