sidebar[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

sidebar.exe
Size

1.1MB
MD5

dcca4b04af87e52ef9eaa2190e06cbac
SHA1

12a602b86fc394b1c88348fb099685eabb876495
SHA256

8858cfd159bb32ae9fcca1a79ea83c876d481a286e914071d48f42fca5b343d8
SHA512

e512d79e09c2157342b77b9655c6b527dcd3fc68b7c4c89090bdf9a6e6a5828088f611e60ebe2df215a75cd6c212cbbdfdbfb3fc9d41fce69fa4f51680d265d8
SSDEEP

24576:ADLlebF9CbCJs2jqlySXA4YhhLh7heYqjITq:+eZ9CMrelJjKhLh7hej6q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sidebar.exe

Files

sidebar.exe
.exe windows:6 windows x86

95c2d06d622df94ea8927b59eacb1485

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

EventRegister
EventUnregister
EventWrite
RegCloseKey
RegOpenKeyExW
IsTextUnicode
RegQueryValueExW
RegNotifyChangeKeyValue
CryptGetHashParam
CryptHashData
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
RegisterEventSourceW
CryptReleaseContext
GetTokenInformation
OpenProcessToken
EventEnabled
RegDeleteKeyW
DeregisterEventSource
ReportEventW

kernel32

InterlockedIncrement
Sleep
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
EnterCriticalSection
LeaveCriticalSection
DeleteFileW
GetTickCount
GetModuleHandleW
InterlockedExchange
InterlockedPushEntrySList
QueryDepthSList
OpenThread
GetCurrentThreadId
TlsSetValue
lstrcmpiW
ExpandEnvironmentStringsW
ReadFile
GetFileSizeEx
CreateFileW
CompareStringOrdinal
WritePrivateProfileStringW
WriteFile
HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
SetEvent
CreateEventW
GetStartupInfoW
GetThreadPreferredUILanguages
CopyFileW
lstrcmpW
SetFileAttributesW
FreeLibrary
LoadLibraryExW
SetFilePointer
GetTempFileNameW
GetTempPathW
MultiByteToWideChar
SetCurrentDirectoryA
CreateDirectoryA
SetCurrentDirectoryW
CreateDirectoryW
ResetEvent
WaitForMultipleObjects
TlsGetValue
SearchPathW
GlobalFree
SetFilePointerEx
DelayLoadFailureHook
GetProcAddress
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
CompareStringW
ReleaseMutex
WaitForSingleObject
GetLastError
CreateMutexW
lstrlenW
GetModuleFileNameW
TlsAlloc
RegisterApplicationRestart
LocalFree
UnmapViewOfFile
GetLocaleInfoW
CreateFileMappingW
MapViewOfFile
SetLastError
FindResourceExW
GetCommandLineW
DeleteCriticalSection
CreateThread
InitializeCriticalSection
SetErrorMode
HeapSetInformation
LocalAlloc
RegEnumKeyExW
IsValidLocale
GetTimeZoneInformation
GetDynamicTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GlobalLock
GlobalUnlock
GetDiskFreeSpaceExW
SetVolumeLabelW
GetLogicalDrives
GetVolumeInformationW
GetDriveTypeW
GetSystemWindowsDirectoryW
GetSystemInfo
GetComputerNameW
GetSystemPowerStatus
GlobalMemoryStatusEx
OutputDebugStringW
RaiseException
GetEnvironmentVariableW
GetFileAttributesW
GetFileSize
QueueUserAPC
InterlockedFlushSList
InitializeSListHead
CompareFileTime
GetFileAttributesExW
GetSystemTime
SystemTimeToFileTime
FindFirstFileW
FindNextFileW
FindClose
DeleteAtom
GetTickCount64
GlobalGetAtomNameW
GlobalDeleteAtom
QueryPerformanceFrequency
CreateWaitableTimerW
SetWaitableTimer
TlsFree
CancelWaitableTimer
WideCharToMultiByte
GlobalAddAtomW
GetVersionExW
LoadLibraryW
GetFileTime
FindResourceW
SizeofResource
LoadResource
LockResource
FormatMessageW
MulDiv
RegLoadMUIStringW
GetSystemDirectoryW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
InterlockedDecrement
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
LoadLibraryExA

gdi32

ExtTextOutW
GetDeviceCaps
CreateDIBSection
SetLayout
CreateFontIndirectW
SetBkColor
GetDIBits
SaveDC
RestoreDC
SetViewportOrgEx
GetWindowOrgEx
StretchBlt
SetStretchBltMode
GetPath
GdiGetBatchLimit
DeleteDC
DeleteObject
CreateCompatibleDC
OffsetWindowOrgEx
SetBkMode
GetClipBox
GetObjectW
BitBlt
GetStockObject
SelectObject
LineDDA
GetTextExtentExPointW
SetTextColor
GdiAlphaBlend

user32

SendMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
SendMessageTimeoutW
RegisterWindowMessageW
CreateWindowExW
CharPrevW
GetThreadDesktop
OpenInputDesktop
RegisterPowerSettingNotification
MessageBoxIndirectW
CharUpperBuffW
CharUpperW
MessageBeep
UnhookWinEvent
GetUserObjectInformationW
FindWindowW
PostMessageW
GetWindowThreadProcessId
AllowSetForegroundWindow
GetShellWindow
LoadStringW
MessageBoxW
DrawFrameControl
LoadImageW
InsertMenuItemW
SetRectEmpty
CloseDesktop
GetMonitorInfoW
SetWinEventHook
UnregisterPowerSettingNotification
InflateRect
DrawTextExW
GetIconInfo
SwitchToThisWindow
ShowWindow
SetDlgItemTextW
SetForegroundWindow
SetFocus
OffsetRect
PtInRect
GetForegroundWindow
GetCursorPos
SetTimer
GetDlgItem
GetWindowRect
SetWindowPos
ScreenToClient
KillTimer
DestroyIcon
IsWindow
DestroyWindow
GetSystemMetrics
CharNextW
ReleaseDC
GetDC
GetWindowLongW
DestroyMenu
RemoveMenu
GetSubMenu
LoadMenuW
SetWindowLongW
GetWindow
DeleteMenu
GetMenuItemCount
EndPaint
MapWindowPoints
BeginPaint
GetParent
FillRect
SetRect
GetClientRect
RemovePropW
DefWindowProcW
SetPropW
GetPropW
RegisterClassW
LoadCursorW
CreateDialogParamW
GetKeyState
GetDoubleClickTime
SetCapture
ReleaseCapture
GetFocus
NotifyWinEvent
UpdateLayeredWindow
RedrawWindow
IsIconic
SetCursor
GetMessagePos
GetKeyboardState
GetMessageTime
MonitorFromPoint
IntersectRect
IsHungAppWindow
IsWindowVisible
PostQuitMessage
UnregisterHotKey
GetWindowTextW
SetParent
RegisterHotKey
GetSysColor
SystemParametersInfoW
MonitorFromWindow
GetDesktopWindow
EnumDisplayMonitors
TrackPopupMenu
CheckMenuItem
CopyRect
PrintWindow
SetLayeredWindowAttributes
CloseGestureInfoHandle
DeregisterShellHookWindow
RegisterShellHookWindow
GetWindowInfo
IsDialogMessageW
MsgWaitForMultipleObjectsEx
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
EqualRect
IsChild
SetActiveWindow
LoadIconW
AdjustWindowRectEx
AppendMenuW
CreatePopupMenu
EndDialog
EnableWindow
SetWindowTextW
GetAsyncKeyState

msvcrt

?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
??1type_info@@UAE@XZ
_controlfp
_ftol2_sse
iswalpha
wcschr
wcsrchr
_wtol
??_V@YAXPAX@Z
_ftol2
free
__CxxFrameHandler3
??_U@YAPAXI@Z
memset
memmove
malloc
memcpy
_vsnwprintf
wcsspn
_wtoi
wcstok
realloc
_purecall
_open
_read
_write
_close
_lseek
strtok
strrchr
wcsstr
bsearch
_wcsicmp
_wcsnicmp
wcsncmp
_itow_s
_CIexp
floor
ceil
_CIfmod
_CIsqrt
_CIcos
_CIsin
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_CxxThrowException
_wtof
__getmainargs
_cexit
_exit
_XcptFilter
__set_app_type

atl

ord30
ord23
ord57
ord18
ord21
ord32
ord16
ord58
ord11
ord10

ntdll

WinSqmIncrementDWORD
RtlIpv4AddressToStringExW
NtQuerySystemInformation
WinSqmSetDWORD
WinSqmIsOptedIn
WinSqmAddToStreamEx
WinSqmAddToStream
RtlIpv6AddressToStringExW

ole32

CoUninitialize
CoInitializeEx
OleUninitialize
CoTaskMemFree
CoCreateInstance
CreateBindCtx
CoTaskMemAlloc
CLSIDFromProgID
StringFromGUID2
CoCreateGuid
PropVariantClear
ReleaseStgMedium
StringFromCLSID
GetHGlobalFromStream
CLSIDFromString
CreateStreamOnHGlobal
CoInitialize
OleInitialize

oleaut32

SysAllocString
GetErrorInfo
LoadTypeLibEx
VariantInit
VariantChangeType
VariantCopy
SetErrorInfo
VariantClear
SysAllocStringLen
SysStringLen
SysFreeString
LoadRegTypeLi
CreateErrorInfo
SafeArrayCreateVector
LoadTypeLi
SystemTimeToVariantTime

comctl32

ord345
ord380
ord339
ord334
ord324
ord332
ord328
ord326
ord327
ord323
ord322
ord321
ord320
ord329
ord386
ord410
ord412
ord413

gdiplus

GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipCloneImage
GdipCreateHatchBrush
GdipCreateTexture2
GdipSetTextureTransform
GdipCreatePathGradientFromPath
GdipSetPathGradientWrapMode
GdipSetPathGradientCenterColor
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientSigmaBlend
GdipSetPathGradientLinearBlend
GdipSetPathGradientGammaCorrection
GdipSetLineLinearBlend
GdipCreateLineBrush
GdipSetLineGammaCorrection
GdipCreateBitmapFromScan0
GdipSaveImageToStream
GdipDisposeImage
GdipSetLineSigmaBlend
GdipSetPathGradientPresetBlend
GdipMultiplyLineTransform
GdipSetLinePresetBlend
GdipSetPathGradientCenterPoint
GdipSetPathGradientFocusScales
GdipFillPath
GdipSetSolidFillColor
GdipSetPenCustomEndCap
GdipSetPenCustomStartCap
GdipSetCustomLineCapStrokeCaps
GdipStartPathFigure
GdipAddPathLine2
GdipCreateCustomLineCap
GdipClonePen
GdipCreatePathIter
GdipPathIterNextSubpath
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipSetPenMode
GdipSetPenStartCap
GdipSetPenEndCap
GdipSetPenCompoundArray
GdipSetPenDashCap197819
GdipSetPenDashArray
GdipSetPenMiterLimit
GdipSetPenLineJoin
GdipAddPathRectangle
GdipAddPathEllipse
GdipAddPathPath
GdipAddPathBezier
GdipClosePathFigure
GdipResetPath
GdipDeletePathIter
GdipDeleteCustomLineCap
GdipMeasureString
GdipCreateStringFormat
GdipGetPenColor
GdipTransformPath
GdipSetClipPath
GdipDeleteMatrix
GdipDeleteStringFormat
GdipCreateBitmapFromHBITMAP
GdipCreateMatrix
GdipCreateMatrix2
GdipSetStringFormatFlags
GdipSetWorldTransform
GdipDrawString
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipCreatePen1
GdipDeletePen
GdipDeleteRegion
GdipGetImageWidth
GdipGetImageHeight
GdipSetImageAttributesColorMatrix
GdipSetPenColor
GdipSetPenDashStyle
GdipTranslateWorldTransform
GdipDrawRectangle
GdipDrawImageRectRect
GdipSetClipRect
GdipSetClipRegion
GdipGetClip
GdipIsVisibleRect
GdipSaveGraphics
GdipRestoreGraphics
GdipCreateRegion
GdipCreateFromHDC
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipAddPathLine
ord1
GdipSetPixelOffsetMode
GdipDrawRectangleI
GdipFillRectangleI
GdipDrawImageRectRectI
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipSetImageAttributesColorKeys
GdiplusStartup
GdiplusShutdown
GdipDeleteBrush
GdipCreateSolidFill
GdipCloneBrush
GdipFillRectangle
GdipImageRotateFlip
GdipCreateBitmapFromHICON
GdipDeletePath
GdipDeleteFont
GdipDeleteFontFamily
GdipGetDC
GdipReleaseDC
GdipSetMatrixElements
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipGetPathTypes
GdipGetPointCount
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipImageSelectActiveFrame
GdipGetImageRawFormat
GdipSetPageUnit
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipSetCompositingMode
GdipBitmapSetResolution
GdipCreateHBITMAPFromBitmap
GdipCreateFont
GdipCreateFontFamilyFromName
GdipGetInterpolationMode
GdipResetWorldTransform
GdipGetCompositingQuality
GdipGetCompositingMode
GdipAddPathRectangleI
GdipCreatePath
GdipSetClipHrgn
GdipSetClipRectI
GdipDrawLine
GdipRecordMetafile
GdipLoadImageFromFileICM
GdipCreateFromHWND
GdipGetVisibleClipBoundsI
GdipSetStringFormatAlign
GdipGetImageBounds
GdipGetPenWidth
GdipGetPenMode
GdipIsVisiblePathPoint
GdipWidenPath
GdipFlattenPath
GdipClonePath
GdipDrawPath
GdipGetPathPoints

shlwapi

PathIsDirectoryW
PathFindFileNameW
PathFindExtensionW
PathRemoveExtensionW
PathIsRelativeW
PathCombineW
PathFileExistsW
ord270
ord219
PathIsURLW
UrlIsW
ord215
UrlEscapeW
PathRemoveFileSpecW
PathCreateFromUrlW
PathCanonicalizeW
UrlUnescapeW
StrStrNW
StrStrNIW
PathIsPrefixW
ord12
SHCreateStreamOnFileW
SHCreateStreamOnFileEx
PathGetDriveNumberW
ord214
AssocQueryStringW
PathCommonPrefixW
PathGetArgsW
StrToIntExW

shell32

DragAcceptFiles
ord155
SHGetFileInfoW
SHBindToObject
ord43
DragFinish
SHCreateItemFromIDList
ord165
ShellExecuteW
SHFileOperationW
SHGetFolderPathAndSubDirW
CommandLineToArgvW
SHCreateDirectoryExW
DragQueryPoint
ShellExecuteExW
SHGetFolderPathEx
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
ord4
SHGetFolderLocation
ord2
SHCreateItemWithParent
DragQueryFileW
ord102
SHParseDisplayName

urlmon

URLOpenBlockingStreamW
CreateURLMoniker
CoInternetGetSession

crypt32

CertCloseStore
CertFreeCertificateContext
CertGetNameStringW
CryptDecodeObject
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose

sfc_os

SfcIsFileProtected

dwmapi

DwmUpdateThumbnailProperties
DwmSetWindowAttribute

cryptui

CryptUIDlgViewCertificateW

uxtheme

DrawThemeTextEx
IsThemeActive
OpenThemeData
DrawThemeBackground
CloseThemeData
SetWindowThemeAttribute

Exports

Exports

Microsoft_WDF_UMDF_Version

Sections

.text
Size: 601KB - Virtual size: 601KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 505KB - Virtual size: 505KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

95c2d06d622df94ea8927b59eacb1485

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

atl

ntdll

ole32

oleaut32

comctl32

gdiplus

shlwapi

shell32

urlmon

crypt32

sfc_os

dwmapi

cryptui

uxtheme

Exports

Exports

Sections

.text Size: 601KB - Virtual size: 601KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 505KB - Virtual size: 505KB

.reloc Size: 30KB - Virtual size: 29KB

.text
Size: 601KB - Virtual size: 601KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 505KB - Virtual size: 505KB

.reloc
Size: 30KB - Virtual size: 29KB