21eb3998669390d8233f693b50119428

Sharing

Copy URL

Twitter E-mail

General

Target

21eb3998669390d8233f693b50119428
Size

13.4MB
MD5

21eb3998669390d8233f693b50119428
SHA1

57b2624f26f6a3a7d897fac848bd9e5112f8854b
SHA256

4ba3c2e318f4df08c52a5f922f64818b1dd84f5aa9cf0e05bb1763a31e9aa4cc
SHA512

9922b5ab063defa13fe1b9e27b7e099a2cb85cce7a5df538699fcbd2269d69eefb0dba1cb48090fd73bed0bf46f5a056cc66fea27069d9993cdd7fd79ad50326
SSDEEP

6144:6M0Em6Qk5N3Scccccccccccccccccccccccccccccccccccccccccccccccccccn:EEma

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21eb3998669390d8233f693b50119428

Files

21eb3998669390d8233f693b50119428
.exe windows:5 windows x86 arch:x86

a07a52f9260a9a13a9d974f54b55a466

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

nddeapi

NDdeShareAddA
NDdeShareGetInfoA
NDdeShareEnumA
NDdeShareSetInfoA

certcli

CACloseCertType
CACloseCA
CADeleteCA
CAEnumFirstCA

user32

IsDialogMessageW
CreateDesktopA
wsprintfW
LoadIconA
LoadMenuW
GetMessageW
DrawStateW
LoadCursorA
DialogBoxParamA
InsertMenuA
PeekMessageW
GetClassLongA
PostMessageW

kernel32

GetModuleHandleA
WaitNamedPipeA
CreateDirectoryA
EnterCriticalSection
lstrcmp
lstrcmp
CreateMutexA
IsBadStringPtrA
FindFirstFileA
SystemTimeToFileTime
LoadLibraryW
LoadLibraryExW
GetProcAddress
lstrcmp
lstrcmp
lstrcmp

shlwapi

PathIsRootA
UrlIsA
PathCommonPrefixA
UrlGetPartA
UrlGetLocationA
UrlEscapeA
UrlHashA
PathCombineA
UrlCombineA
UrlCreateFromPathA
UrlIsNoHistoryA
UrlUnescapeA
PathCompactPathA

clusapi

ClusterEnum
CloseCluster
ClusterControl
CloseClusterNode
CloseClusterGroup

advapi32

ReadEventLogW
CryptSignHashA
RegOpenKeyA
RegUnLoadKeyA
RegReplaceKeyA
RegCreateKeyExW
OpenEventLogA
RegRestoreKeyW
IsTextUnicode
GetUserNameA
RegEnumKeyW

comsvcs

CoCreateActivity
CoLoadServices
CoEnterServiceDomain
RecycleSurrogate
SafeRef

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.kdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rcrs
Size: 13.3MB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a07a52f9260a9a13a9d974f54b55a466

Headers

DLL Characteristics

File Characteristics

Imports

nddeapi

certcli

user32

kernel32

shlwapi

clusapi

advapi32

comsvcs

Sections

.text Size: 96KB - Virtual size: 96KB

.kdata Size: 8KB - Virtual size: 8KB

.zdata Size: 1KB - Virtual size: 1KB

.rcrs Size: 13.3MB - Virtual size: 1KB

.text
Size: 96KB - Virtual size: 96KB

.kdata
Size: 8KB - Virtual size: 8KB

.zdata
Size: 1KB - Virtual size: 1KB

.rcrs
Size: 13.3MB - Virtual size: 1KB