21069588669a06d48b0ca8fa6f949b75

Sharing

Copy URL Twitter E-mail

General

Target

21069588669a06d48b0ca8fa6f949b75
Size

2.7MB
MD5

21069588669a06d48b0ca8fa6f949b75
SHA1

0fb354a41cd57a8890e11654b9fd73b39e678a8b
SHA256

c17103817236373fbf65d0842b3882755df49bf23038745e139ed94ca44be0f3
SHA512

31262e45a33294ab5e628659ffeac7ffc5301515460e771f73aea57462c3c73ad83d03ff49370108cae451c95bf50e982c0fcecd21ec3df035eab4ee87cd4319
SSDEEP

49152:j3d1mvLhEgwbTQy5cB5owhQJjITNsOlia0:jjmvLhEgwbTWMjITNFEa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21069588669a06d48b0ca8fa6f949b75

Files

21069588669a06d48b0ca8fa6f949b75
.exe windows:5 windows x86 arch:x86

8aadf4ed137cc331c0378b176120822f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

Imports

msacm32

acmStreamClose

msvcrt

?terminate@@YAXXZ
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
fflush
_filelengthi64
fwrite
fread
_telli64
fseek
towupper
towlower
srand
isalnum
_controlfp
_fileno
mktime
localtime
strtol
_ftol
getenv
fprintf
fclose
fopen
_errno
time
_strnicmp
toupper
strncmp
memmove
memchr
strstr
wcsstr
tolower
_stricmp
strchr
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_except_handler3
gmtime
_tzset

comctl32

ImageList_GetImageCount
InitCommonControlsEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

CreateFileW
GetCurrentDirectoryA
CloseHandle
CompareFileTime
FormatMessageA
ReleaseSemaphore
WriteFile
WriteConsoleW
WriteConsoleA
WinExec
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjects
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
UnmapViewOfFile
UnlockFile
UnhandledExceptionFilter
GetComputerNameW
CreateSemaphoreA
GetFileSize
LoadLibraryA
LeaveCriticalSection
ExitProcess
GetTickCount
EnterCriticalSection
InitializeCriticalSection
GetCommandLineW
GetVersion
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DosDateTimeToFileTime
DuplicateHandle
EnumResourceLanguagesW
EnumResourceNamesW
EnumResourceTypesW
EnumSystemLocalesA
ExitThread
ExpandEnvironmentStringsW
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileW
FindResourceW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeResource
GetACP
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentDirectoryW
GetCurrentThread
GetDateFormatA
GetDiskFreeSpaceExW
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeThread
GetFileAttributesW
GetFileInformationByHandle
GetFileTime
GetFileType
GetFullPathNameW
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetLocalTime
GetLogicalDrives
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNumberFormatW
GetOEMCP
GetPrivateProfileIntW
GetProcAddress
GetProcessHeap
GetProfileIntW
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeExW
GetStringTypeW
GetSystemDefaultLangID
GetSystemInfo
GetSystemTime
GetThreadLocale
GetTimeFormatA
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetVersionExW
GetVolumeInformationW
GetWindowsDirectoryW
GlobalAddAtomW
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomW
GlobalFlags
GlobalFree
GlobalGetAtomNameW
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalUnlock
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsValidCodePage
IsValidLocale
LCMapStringA
LCMapStringW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockFile
LockResource
lstrcmpA
lstrcmpiW
lstrcmpW
lstrcpynW
lstrcpyW
lstrlenA
lstrlenW
MapViewOfFile
MulDiv
MultiByteToWideChar
OpenFileMappingW
OutputDebugStringA
QueryDosDeviceW
RaiseException
ReadFile
ReleaseMutex
ResetEvent
ResumeThread
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetHandleCount
SetLastError
SetStdHandle
SetThreadLocale
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue

user32

GetActiveWindow
GetAsyncKeyState
GetCapture
GetClassInfoExW
GetClassInfoW
GetClassLongW
GetClassNameW
GetClientRect
GetCursor
GetCursorPos
GetDCEx
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyboardLayoutList
GetKeyboardState
GetKeyState
GetLastActivePopup
GetMenu
GetMenuCheckMarkDimensions
GetMenuDefaultItem
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoW
GetMenuState
GetMenuStringW
GetMessagePos
GetMessageTime
GetMessageW
GetNextDlgGroupItem
GetNextDlgTabItem
GetParent
GetPropW
GetScrollInfo
GetScrollPos
GetSubMenu
GetSysColorBrush
GetSystemMenu
GetTabbedTextExtentA
GetTopWindow
GetWindowDC
GetWindowLongA
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowRgn
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
GrayStringW
HideCaret
InflateRect
InsertMenuItemW
InsertMenuW
IntersectRect
InvalidateRect
InvalidateRgn
InvertRect
IsCharAlphaW
IsChild
IsClipboardFormatAvailable
IsDialogMessageW
IsIconic
IsMenu
IsRectEmpty
IsWindowUnicode
IsWindowVisible
KillTimer
LoadAcceleratorsW
LoadBitmapW
LoadCursorW
LoadIconW
LoadImageW
LoadMenuIndirectW
LoadMenuW
LoadStringW
LockWindowUpdate
LookupIconIdFromDirectoryEx
MapDialogRect
MapVirtualKeyW
MapWindowPoints
MessageBeep
ModifyMenuW
MoveWindow
OffsetRect
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageW
PtInRect
RedrawWindow
RegisterClassW
RegisterClipboardFormatW
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
ScrollWindow
SendDlgItemMessageA
SendDlgItemMessageW
SendMessageTimeoutW
SendMessageW
SendNotifyMessageW
SetActiveWindow
SetCapture
SetCursor
SetCursorPos
SetDlgItemTextW
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemBitmaps
SetParent
SetPropW
SetRectEmpty
SetScrollInfo
SetScrollPos
SetTimer
SetWindowContextHelpId
SetWindowLongA
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowsHookExW
SetWindowTextW
ShowCaret
ShowOwnedPopups
ShowScrollBar
ShowWindow
SystemParametersInfoA
SystemParametersInfoW
TabbedTextOutW
ToUnicodeEx
TrackPopupMenu
TranslateAcceleratorW
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnionRect
UnregisterClassW
UpdateWindow
ValidateRect
WaitMessage
WindowFromPoint
CopyRect
CreateDialogIndirectParamW
CreateIconFromResourceEx
FillRect
EqualRect
EndDialog
EnableMenuItem
EnableWindow
DrawTextW
DrawTextExW
DrawTextA
DrawStateW
DrawMenuBar
DrawIconEx
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefFrameProcW
DeferWindowPos
CreateWindowExW
CreatePopupMenu
CreateIconIndirect

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumKeyW
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RegQueryValueW
RegSetValueExW
CryptAcquireContextA
CryptGetProvParam
CryptGetUserKey
CryptReleaseContext
CryptSignHashA
CryptDestroyHash
CryptSetHashParam
CryptCreateHash
CryptGenRandom
CryptDestroyKey
CryptExportKey

ole32

CoLockObjectExternal
RegisterDragDrop
OleUninitialize
OleRun
OleIsCurrentClipboard
OleInitialize
OleFlushClipboard
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoRevokeClassObject
CoInitialize
CoRegisterMessageFilter

ws2_32

socket
send
shutdown
closesocket
recv
bind
select
__WSAFDIsSet
connect
htons
WSAStartup
getsockopt
inet_addr
ioctlsocket
WSAIoctl
WSAGetLastError
setsockopt
ntohs
inet_ntoa
getsockname
gethostbyname

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 388KB - Virtual size: 14.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.trouh
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 404KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8aadf4ed137cc331c0378b176120822f

Headers

File Characteristics

Imports

msacm32

msvcrt

comctl32

version

kernel32

user32

winspool.drv

advapi32

ole32

ws2_32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 300KB - Virtual size: 299KB

.data Size: 388KB - Virtual size: 14.4MB

.trouh Size: 8KB - Virtual size: 6KB

.rsrc Size: 404KB - Virtual size: 404KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 300KB - Virtual size: 299KB

.data
Size: 388KB - Virtual size: 14.4MB

.trouh
Size: 8KB - Virtual size: 6KB

.rsrc
Size: 404KB - Virtual size: 404KB