21c2ecf81282a34cf6a8a578b5ee0d29

Sharing

Copy URL Twitter E-mail

General

Target

21c2ecf81282a34cf6a8a578b5ee0d29
Size

70KB
MD5

21c2ecf81282a34cf6a8a578b5ee0d29
SHA1

1a4c8fbcd438e33242e6d45accd674e741c62eeb
SHA256

e2de3ba63a52f79028affab0e6a8ed6d21ca525f225dc5b726e9b3a89921d6e1
SHA512

f90eb5e4177663af89696225e00bd79fa0631fdec3e19437997e833ce6f89e2d3ccca5d8fa82f8ed23c8f63910fd9cddcacf4f9fdf79e8ff7ad95eaed1b634b3
SSDEEP

1536:iUd6cj8X62MTaUMMnMMMMMQqvuOYQIYQDvmIh97qX8kqgFqhbbauUvYV+diHmO0U:ie6cAFUMMnMMMMMX7I7Dvm7qFaHQHbkG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21c2ecf81282a34cf6a8a578b5ee0d29

Files

21c2ecf81282a34cf6a8a578b5ee0d29
.exe windows:5 windows x86 arch:x86

b5f3c0fa0678c75c01db0a8c820e4f3c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtSuspendProcess
RtlAddAccessAllowedObjectAce
RtlAdjustPrivilege
NtQuerySemaphore

uxtheme

GetThemeMargins
CloseThemeData
GetThemeFont
OpenThemeData
DrawThemeBackground
IsAppThemed
DrawThemeParentBackground
GetThemeAppProperties
GetThemeMetric
GetThemeBackgroundContentRect
IsThemeActive
GetThemeBackgroundExtent
SetWindowTheme
GetThemePartSize
GetThemeColor

shell32

SHGetPathFromIDListA
SHGetFolderPathW
SHGetPathFromIDListW
SHFileOperationW
ShellExecuteW
SHCreateShellItem
ExtractAssociatedIconExW
SHBindToParent
SHGetSpecialFolderPathW
ShellExecuteA
SHChangeNotify
SHPathPrepareForWriteW
SHGetDataFromIDListW
SHAppBarMessage
ExtractIconExW
SHBrowseForFolderW
Shell_NotifyIconW
SHGetSpecialFolderLocation
ShellAboutW
SHGetFileInfoW
SHGetInstanceExplorer
DragQueryFileW
ExtractIconW
SHGetDesktopFolder
SHSetLocalizedName
SHGetFolderPathAndSubDirW
ShellExecuteExW
Shell_NotifyIconA
SHGetFolderLocation

kernel32

VirtualAlloc

psapi

GetProcessImageFileNameW

rtutils

TraceDumpExA
RouterLogEventStringA
LogErrorW
RouterLogRegisterA
RouterGetErrorStringW
RouterLogEventExA

ddraw

DirectDrawCreate

Sections

.text
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 37KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b5f3c0fa0678c75c01db0a8c820e4f3c

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

uxtheme

shell32

kernel32

psapi

rtutils

ddraw

Sections

.text Size: 1024B - Virtual size: 996B

.rsrc Size: 26KB - Virtual size: 26KB

.data Size: 2KB - Virtual size: 40KB

.idata Size: 2KB - Virtual size: 1KB

.rdata Size: 37KB - Virtual size: 40KB

.text
Size: 1024B - Virtual size: 996B

.rsrc
Size: 26KB - Virtual size: 26KB

.data
Size: 2KB - Virtual size: 40KB

.idata
Size: 2KB - Virtual size: 1KB

.rdata
Size: 37KB - Virtual size: 40KB