021e50bf77e1067dd81ce24ed5e0db11 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

021e50bf77e1067dd81ce24ed5e0db11
Size

17KB
MD5

021e50bf77e1067dd81ce24ed5e0db11
SHA1

6df75f14602d7fc04d72962c55803282e4e426a6
SHA256

26f910b16af323c5050c02b53912749f7a54a3f6256218103a3b58af2a582dfd
SHA512

e6458c2b9418e2402501958195411697e9a1da2360bf4e01a3debd8b8aca393e804358354c04c6ed7ff6f69673ca1c6f4e6acfcb35ca69e7310a124037c89a37
SSDEEP

384:JN4vrN38y15blNHj3GZUkMER9ksvAQoEdoQxc:JN4zN3F/lNyZEER9VfoEc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
021e50bf77e1067dd81ce24ed5e0db11

Files

021e50bf77e1067dd81ce24ed5e0db11
.dll windows:4 windows x86 arch:x86

96144bcb540c1762865355eaf17e3c78

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
GetCurrentProcessId
FreeLibrary
GetTempPathA
GetWindowsDirectoryA
CreateMutexA
lstrcatA
CreateThread
DisableThreadLibraryCalls
GetCurrentProcess
LoadLibraryA
ExitProcess
Sleep
GetProcAddress

user32

GetForegroundWindow
FindWindowExA
PostMessageA
GetWindowTextA
keybd_event
MessageBoxA
wsprintfA

advapi32

LookupPrivilegeValueA
DeleteService

msvcrt

fclose
fopen
??2@YAPAXI@Z
fscanf
printf

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW
Rsll

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 818B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ