210b900d63f7f32b65ec779e2e5c2352b417b6a01ff28c74cdfa1f20568b5751

Sharing

Copy URL Twitter E-mail

General

Target

210b900d63f7f32b65ec779e2e5c2352b417b6a01ff28c74cdfa1f20568b5751
Size

13.3MB
MD5

fc25cb616e4e33212a6dadae99820d62
SHA1

d810ce6721937b908f5a025ce76da5147e0101a8
SHA256

210b900d63f7f32b65ec779e2e5c2352b417b6a01ff28c74cdfa1f20568b5751
SHA512

a71b97541d709914ecbac93534edf977dccd1878c267b15023d84cba4ee0fecdb78bb6a0ecae2fa177179c6964d6aa18e3090aefd17b1440438cb9559d27e299
SSDEEP

393216:qfQBY33OKZ45xrMA3cBcNLFEokrZur+sb:sOKZixxMBcNJxrq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
210b900d63f7f32b65ec779e2e5c2352b417b6a01ff28c74cdfa1f20568b5751

Files

210b900d63f7f32b65ec779e2e5c2352b417b6a01ff28c74cdfa1f20568b5751
.exe windows:5 windows x86

2d099a8d1db776194e271b0636644215

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

waveOutOpen
midiOutUnprepareHeader
midiStreamOpen
midiStreamProperty
midiOutPrepareHeader
midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
midiStreamOut
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutRestart
waveOutGetNumDevs

ws2_32

htons
WSAAsyncSelect
closesocket
send
select
WSACleanup
WSAStartup
gethostbyname
inet_ntoa
bind
gethostname
shutdown
WSAGetLastError
ntohs
getsockname
ntohl
htonl
__WSAFDIsSet
sendto
recvfrom
ioctlsocket
connect
recv
listen
getpeername
inet_addr
accept
socket

rasapi32

RasHangUpA
RasGetConnectStatusA

kernel32

QueryPerformanceCounter
GetTimeZoneInformation
GetLocaleInfoA
SetLastError
lstrcpyn
CreateMutexA
ReleaseMutex
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetExitCodeThread
OpenFileMappingA
IsBadReadPtr
GetLocalTime
LCMapStringA
RtlUnwind
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
GetCurrentProcess
VirtualFree
VirtualAlloc
IsBadWritePtr
RaiseException
GetCPInfo
GetACP
GetOEMCP
InterlockedDecrement
InterlockedIncrement
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
LCMapStringW
SetStdHandle
FlushFileBuffers
IsValidCodePage
IsDBCSLeadByteEx
FileTimeToSystemTime
SuspendThread
GetSystemTimeAsFileTime
GetSystemTime
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
LocalReAlloc
GlobalHandle
LocalAlloc
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
DuplicateHandle
lstrcpynA
FileTimeToLocalFileTime
LocalFree
TerminateProcess
GetFileSize
SetFilePointer
GetStringTypeA
GetWindowsDirectoryA
GetSystemDirectoryA
TerminateThread
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
InterlockedExchange
CompareStringW
CompareStringA
HeapCreate
SetEnvironmentVariableA
UnhandledExceptionFilter
HeapSize
CloseHandle
WaitForSingleObject
CreateProcessA
GetTickCount
GetCommandLineA
MulDiv
GetProcAddress
WaitForMultipleObjects
CreateFileA
DeviceIoControl
SetEvent
LockResource
ReadFile
lstrlenW
RemoveDirectoryA
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
WinExec
lstrcpyA
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetUserDefaultLCID
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetLastError
QueryPerformanceFrequency
WritePrivateProfileStringA
GetPrivateProfileStringA
GetComputerNameA
CreateThread
CreateEventA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GetTempPathA
FindFirstFileA
FindClose
SetFileAttributesA
GetFileAttributesA
DeleteFileA
CreateDirectoryA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery

user32

GetWindowTextA
FindWindowExA
GetDlgItem
GetClassNameA
GetDesktopWindow
GetKeyboardLayout
EndPaint
BeginPaint
MsgWaitForMultipleObjects
GetMessageTime
ScrollWindow
GetSysColorBrush
SetCaretPos
GetForegroundWindow
LoadIconA
TranslateMessage
DrawFrameControl
DrawEdge
DrawFocusRect
WindowFromPoint
GetMessageA
DispatchMessageA
SetRectEmpty
RegisterClipboardFormatA
CreateIconFromResourceEx
CreateIconFromResource
DrawIconEx
CreatePopupMenu
AppendMenuA
ModifyMenuA
CreateMenu
CreateAcceleratorTableA
GetDlgCtrlID
GetSubMenu
EnableMenuItem
ClientToScreen
EnumDisplaySettingsA
LoadImageA
SystemParametersInfoA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
SetScrollInfo
GetScrollInfo
CreateWindowExA
RegisterClassExA
UnregisterClassA
ShowCaret
CreateCaret
DestroyCaret
HideCaret
DestroyWindow
SetWindowTextA
MapWindowPoints
GetMenuCheckMarkDimensions
GetMenuState
SetMenuItemBitmaps
CheckMenuItem
MoveWindow
IsDialogMessageA
ScrollWindowEx
GetKeyState
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetClassInfoA
DefWindowProcA
GetSystemMenu
DeleteMenu
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
SetRect
InflateRect
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
SendDlgItemMessageA
GetScrollPos
RegisterClassA
GetMenuItemCount
GetMenuItemID
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
RemovePropA
GetLastActivePopup
RegisterWindowMessageA
GetWindowPlacement
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
GrayStringA
TabbedTextOutA
GetWindowDC
CharUpperA
GetWindowTextLengthA
DrawTextA
DrawTextW
AdjustWindowRectEx
CallWindowProcA
GetDoubleClickTime
WaitForInputIdle
wsprintfA
GetDC
FillRect
IsRectEmpty
ReleaseDC
IsChild
TrackPopupMenu
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
GetFocus
GetParent
GetTopWindow
PostMessageA
IsWindow
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBoxA
GetCursorPos
GetSystemMetrics
IsClipboardFormatAvailable
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
CharUpperBuffW

gdi32

ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetROP2
SetPolyFillMode
RestoreDC
SaveDC
CreateSolidBrush
CreateFontIndirectA
GetStockObject
GetObjectA
EndPage
EndDoc
DeleteDC
StartPage
BitBlt
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
Polygon
GetTextExtentPoint32A
GetDeviceCaps
GetDIBits
RealizePalette
SelectPalette
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
DeleteObject
SelectClipRgn
CreatePolygonRgn
GetClipRgn
SetStretchBltMode
CreateRectRgnIndirect
SetBkColor
TranslateCharsetInfo
SetTextAlign
GetNearestColor
MoveToEx
LineTo
ExtTextOutA
ExtTextOutW
SetTextColor
SetBkMode
GetTextExtentPoint32W
GetTextExtentExPointA
GetTextExtentExPointW
GetTextMetricsA
IntersectClipRect
ExtSelectClipRgn
GetViewportExtEx
PtVisible
RectVisible
TextOutA
Escape
FillRgn
CreateRectRgn
CombineRgn
PatBlt
CreatePen
SelectObject
CreatePatternBrush
CreateBitmap
CreateHatchBrush
CreateBrushIndirect
CreateDCA
CreateCompatibleBitmap
GetPolyFillMode
GetStretchBltMode
GetROP2
GetBkColor
GetBkMode
GetTextColor
CreateRoundRectRgn
CreateEllipticRgn
PathToRegion
EndPath
BeginPath
GetWindowOrgEx
GetViewportOrgEx
StartDocA
GetWindowExtEx

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegOpenKeyExA
RegSetValueExA
RegQueryValueA
RegCreateKeyExA
RegCloseKey

shell32

SHGetSpecialFolderPathA
Shell_NotifyIconA
ShellExecuteA

ole32

OleRun
CoCreateInstance
CLSIDFromString
OleUninitialize
OleInitialize
RevokeDragDrop
DoDragDrop
RegisterDragDrop
CLSIDFromProgID

oleaut32

SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElement
VariantCopyInd
VariantInit
SysAllocString
RegisterTypeLi
LoadTypeLi
SafeArrayGetDim
UnRegisterTypeLi
SafeArrayGetLBound
SafeArrayGetUBound
VariantChangeType
VariantClear
LHashValOfNameSys

comctl32

ImageList_GetIcon
ord17
ImageList_Destroy
ImageList_Read
ImageList_Duplicate

imm32

ImmReleaseContext
ImmGetCompositionStringW
ImmGetContext
ImmNotifyIME
ImmSetCompositionFontA
ImmSetCompositionWindow

wininet

InternetCanonicalizeUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetConnectA
InternetSetOptionA
InternetOpenA
InternetCloseHandle

comdlg32

ChooseColorA
GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 696KB - Virtual size: 696KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 524KB - Virtual size: 524KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l_E
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.%^*
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wl<
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.M*h
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2d099a8d1db776194e271b0636644215

Headers

File Characteristics

Imports

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

imm32

wininet

comdlg32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 696KB - Virtual size: 696KB

.data Size: 524KB - Virtual size: 524KB

.l_E Size: 28KB - Virtual size: 28KB

.text Size: 4KB - Virtual size: 4KB

.%^* Size: 3.3MB - Virtual size: 3.3MB

.wl< Size: 4KB - Virtual size: 4KB

.M*h Size: 6.9MB - Virtual size: 6.9MB

.rsrc Size: 6KB - Virtual size: 6KB

.l1 Size: 24KB - Virtual size: 24KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 696KB - Virtual size: 696KB

.data
Size: 524KB - Virtual size: 524KB

.l_E
Size: 28KB - Virtual size: 28KB

.text
Size: 4KB - Virtual size: 4KB

.%^*
Size: 3.3MB - Virtual size: 3.3MB

.wl<
Size: 4KB - Virtual size: 4KB

.M*h
Size: 6.9MB - Virtual size: 6.9MB

.rsrc
Size: 6KB - Virtual size: 6KB

.l1
Size: 24KB - Virtual size: 24KB