021b0cbf226901c3dff865badac14606

Sharing

Copy URL

Twitter E-mail

General

Target

021b0cbf226901c3dff865badac14606
Size

121KB
MD5

021b0cbf226901c3dff865badac14606
SHA1

de36ae59c8f71b7d7391d52ea2343a1f960908ee
SHA256

7dfeebeb24919749a64ea866080c81d0ab607b42dd27e28a709cef984265c908
SHA512

87354c23fad1d1cccdb028e6e656a18cd9417e7e4fbbe4da1297c200e7710b2f0b2a79073ca42252a27861a3af949cf63ffd1a4497b0a9c6d331035fa44334cc
SSDEEP

3072:/o5GoZYquZIPJCr743kerpmYExqHXhT5RnaY8Is7fCVz9VWokC:/oryZICr743keXnHEIqfCz4ok

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
021b0cbf226901c3dff865badac14606

Files

021b0cbf226901c3dff865badac14606
.exe windows:4 windows x86 arch:x86

10b7ae1feb81d3f8d0f2c18f0675fa0f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

UrlCanonicalizeW
PathCombineW
UrlGetPartW
UrlCombineW
UrlApplySchemeW
PathAppendW

crypt32

CryptUnprotectData
CryptProtectData

shell32

SHGetFolderPathW
CommandLineToArgvW
Shell_NotifyIconW
FindExecutableW
SHAppBarMessage
ShellExecuteW
ShellExecuteExW

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetWkstaUserGetInfo
NetUserAdd
NetUserDel
NetLocalGroupAddMembers
NetUserEnum
NetGetJoinInformation

wtsapi32

WTSUnRegisterSessionNotification
WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSRegisterSessionNotification

user32

DestroyMenu
InvalidateRect
KillTimer
GetClassNameW
UpdateLayeredWindow
CreateWindowExW
GetMessageW
AllowSetForegroundWindow
GetMonitorInfoW
PostMessageW
FindWindowW
AttachThreadInput
ClientToScreen
SetForegroundWindow
GetCursorPos
SetCursor
IsWindow
GetForegroundWindow
UnhookWindowsHookEx
GetDesktopWindow
LoadCursorW
CreatePopupMenu
GetWindowRect
SetTimer
PostThreadMessageW
GetDlgItem
GetClassInfoExW
LoadIconW
SetCapture
ReleaseDC
GetFocus
GetWindowThreadProcessId
GetKeyState
SendMessageW
MapDialogRect
DestroyWindow
CallNextHookEx
SetProcessDefaultLayout
SystemParametersInfoW
PtInRect
GetWindowTextLengthW
SetWindowPos
CharNextW
GetParent
CloseClipboard
RegisterWindowMessageW
FillRect
PeekMessageW
MonitorFromWindow
GetWindowTextW
DialogBoxIndirectParamW
DefWindowProcW
SetClipboardData
SetWindowTextW
RegisterClassExW
UnregisterClassA
PostQuitMessage
EndPaint
CreateAcceleratorTableW
InvalidateRgn
CallWindowProcW
GetClientRect
EndDialog
GetSysColor
GetWindow
ShowWindow
TrackPopupMenu
SetWindowLongW
GetWindowLongW
SetFocus
ScreenToClient
DestroyIcon
SetWindowsHookExW
DispatchMessageW
IsChild
GetDC
TranslateMessage
OpenClipboard
DestroyAcceleratorTable
ReleaseCapture
MoveWindow
AppendMenuW
BeginPaint
RedrawWindow
SendDlgItemMessageW
SetWindowContextHelpId

gdi32

GetStockObject
BitBlt
CreateCompatibleBitmap
SelectObject
CreateSolidBrush
DeleteDC
GetDeviceCaps
DeleteObject
CreateCompatibleDC
GetObjectW

secur32

GetUserNameExW

gdiplus

GdipAlloc
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdipFree
GdiplusShutdown
GdipCloneImage
GdiplusStartup
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM

ddraw

DirectDrawCreate
DirectDrawEnumerateA
DirectDrawCreateEx

kernel32

GetProcessHeap
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
SizeofResource
SetEvent
GetThreadLocale
DeleteCriticalSection
HeapAlloc
VirtualLock
GetProcessId
FreeLibrary
Sleep
MulDiv
ReleaseMutex
SetUnhandledExceptionFilter
InterlockedCompareExchange
OpenProcess
GetLocaleInfoA
QueryPerformanceCounter
InterlockedExchange
GetProcessVersion
InterlockedDecrement
HeapReAlloc
MultiByteToWideChar
lstrlenA
VirtualUnlock
LockResource
WaitForMultipleObjects
GetStartupInfoW
HeapSetInformation
LoadLibraryW
GlobalHandle
GetCurrentProcess
GetLocaleInfoW
GlobalLock
GetCurrentThreadId
VirtualAlloc
WaitForSingleObject
lstrlenW
IsProcessorFeaturePresent
CreateMutexW
FindResourceExW
FindResourceW
ExitProcess
RaiseException
LoadLibraryExW
UnhandledExceptionFilter
ResetEvent
VirtualFree
InitializeCriticalSection
GetTempPathW
GlobalUnlock
LocalFree
LoadLibraryA
GetModuleFileNameW
InterlockedIncrement
TerminateProcess
HeapFree
GetACP
HeapSize
GetVersionExW
LoadResource
CreateEventW
CreateThread
ProcessIdToSessionId
GetComputerNameW
CloseHandle
GlobalAlloc
GetVersionExA
LocalAlloc
IsDebuggerPresent
LeaveCriticalSection
FormatMessageW
FlushInstructionCache
GetLastError
lstrcmpW
GetSystemDirectoryW
WideCharToMultiByte
GlobalFree
CreateFileW
HeapDestroy
SetLastError
GetProcAddress
EnterCriticalSection
LCMapStringW
GetModuleHandleW

ole32

OleLockRunning
CoInitializeEx
StringFromGUID2
OleInitialize
CLSIDFromProgID
CoAllowSetForegroundWindow
CoTaskMemFree
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket
CoGetClassObject
CoTaskMemAlloc
CoUninitialize
CLSIDFromString
StringFromCLSID
CreateStreamOnHGlobal
OleUninitialize
CoCreateGuid

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10b7ae1feb81d3f8d0f2c18f0675fa0f

Headers

File Characteristics

Imports

version

shlwapi

crypt32

shell32

netapi32

wtsapi32

user32

gdi32

secur32

gdiplus

ddraw

kernel32

ole32

Sections

.text Size: 68KB - Virtual size: 68KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 44KB - Virtual size: 43KB

.rsrc Size: 1024B - Virtual size: 344KB

.text
Size: 68KB - Virtual size: 68KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 44KB - Virtual size: 43KB

.rsrc
Size: 1024B - Virtual size: 344KB