0c22dc4b552accf74004a0f203fc07adf12a78a0a399e16431e7f2aa30f683d5

Sharing

Copy URL Twitter E-mail

General

Target

0c22dc4b552accf74004a0f203fc07adf12a78a0a399e16431e7f2aa30f683d5
Size

796KB
MD5

00263390f5f3d4b9fb668f2c8d5acfdf
SHA1

066a8bb42459df7dab30130e45932ea852af4332
SHA256

0c22dc4b552accf74004a0f203fc07adf12a78a0a399e16431e7f2aa30f683d5
SHA512

5680424f26bb36c5fb4013ae4ccf379ddc5520c71d2b320a7baefb6f22427491ef09ccd6bf2088904f9da63511d833a083551bb682fedcb9375203a6f56f821f
SSDEEP

24576:0iW9pYomm5XTvgClxqLCuk3epkRkS8+V:0HwMTvgClxS/pAkS8+V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c22dc4b552accf74004a0f203fc07adf12a78a0a399e16431e7f2aa30f683d5

Files

0c22dc4b552accf74004a0f203fc07adf12a78a0a399e16431e7f2aa30f683d5
.dll windows:6 windows x86 arch:x86

1b67bfbca92a8b1aa2c79f9c88e5ad23

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\code\clean_master\1\webwrap\webwrap\Release\webwrap.pdb

Imports

gdiplus

GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImagePointRectI
GdipDrawImageRectRectI
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdiplusStartup

kernel32

CreateFileW
FlushFileBuffers
WriteFile
WaitForSingleObject
OpenProcess
lstrlenW
GetCurrentThreadId
LoadLibraryExW
lstrcmpW
SetLastError
SetEvent
CreateEventW
WaitForMultipleObjects
SetFileTime
RaiseException
DecodePointer
GetTickCount
CreateThread
Sleep
WideCharToMultiByte
MultiByteToWideChar
MoveFileW
CopyFileW
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
FindResourceExW
GetSystemDirectoryW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetStdHandle
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
InterlockedFlushSList
RtlUnwind
lstrcmpA
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
CloseHandle
GetFileAttributesW
GetDriveTypeW
GetDiskFreeSpaceExW
FindNextFileW
DeviceIoControl
FreeResource
GetVersionExW
GetSystemWindowsDirectoryW
GetFileSize
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
K32GetProcessImageFileNameW
SetFilePointer
K32GetModuleFileNameExW
QueryDosDeviceW
GetLongPathNameW
GetLogicalDriveStringsW
WritePrivateProfileStringW
GetPrivateProfileStringW
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GlobalFree
GlobalUnlock
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
SetFileAttributesW
WriteConsoleW
GlobalLock
GlobalAlloc
GetTempPathW
ReadFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSizeEx
CreateMutexW
ReleaseMutex
GetCurrentProcessId
LocalFree
GetLocaleInfoW
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
GetCPInfo
FormatMessageW
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW

user32

IsWindow
GetMonitorInfoW
MonitorFromWindow
GetSystemMetrics
SetWindowPos
LoadCursorW
CreateWindowExW
GetClassInfoExW
RegisterClassExW
DispatchMessageW
TranslateMessage
SystemParametersInfoW
GetClassNameW
EnumWindows
FindWindowExW
SetParent
GetParent
LoadImageW
LoadIconW
PostMessageW
SetWindowLongW
GetWindowLongW
GetWindowRect
GetClientRect
SetWindowTextW
InvalidateRect
SetForegroundWindow
GetForegroundWindow
KillTimer
SetTimer
ReleaseCapture
SetFocus
IsZoomed
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DestroyWindow
wsprintfW
UpdateLayeredWindow
BeginPaint
EndPaint
SetWindowRgn
EqualRect
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetDesktopWindow
EnumDisplaySettingsW
RegisterClassW
CallWindowProcW
PostQuitMessage
DefWindowProcW
AttachThreadInput
GetWindowThreadProcessId
GetShellWindow
ReleaseDC
GetDC
GetActiveWindow
GetWindowPlacement
ShowWindow
UnregisterClassW
PostThreadMessageW
PeekMessageW
GetMessageW
MonitorFromRect
FindWindowW
OffsetRect
CopyRect
SendMessageW
SetClassLongW
IsWindowVisible

gdi32

CreateCompatibleDC
DeleteObject
SelectObject
SetViewportOrgEx
CreateCompatibleBitmap
CombineRgn
BitBlt
DeleteDC
GetDeviceCaps
SetBkColor
CreateRectRgn
ExtTextOutW

comdlg32

CommDlgExtendedError
GetSaveFileNameW

advapi32

RegEnumKeyExW
RegGetValueW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeValueW
GetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
MapGenericMask
GetFileSecurityW
DuplicateToken
AccessCheck
OpenProcessToken
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHFileOperationW
SHGetPropertyStoreForWindow
SHChangeNotify
ord165
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ShellExecuteW

ole32

CreateStreamOnHGlobal
CoCreateGuid
CoInitialize
CoUninitialize
CoTaskMemAlloc
PropVariantClear
CoTaskMemFree
CoCreateInstance

oleaut32

VariantClear
SysFreeString
SysAllocString

shlwapi

PathIsDirectoryW
StrStrIW
PathIsRootW
StrStrIA
StrTrimA
PathRemoveFileSpecW
PathFileExistsW
PathCombineW
PathAppendW
SHGetValueW
SHSetValueW
AssocQueryStringW
StrCmpNIW
PathIsRelativeW
StrCmpIW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

iphlpapi

GetAdaptersInfo

Exports

Exports

CreateWindowFactoryV1
CreateWindowFactoryV2

Sections

.text
Size: 612KB - Virtual size: 612KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b67bfbca92a8b1aa2c79f9c88e5ad23

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

version

wintrust

crypt32

iphlpapi

Exports

Exports

Sections

.text Size: 612KB - Virtual size: 612KB

.rdata Size: 134KB - Virtual size: 134KB

.data Size: 16KB - Virtual size: 21KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 612KB - Virtual size: 612KB

.rdata
Size: 134KB - Virtual size: 134KB

.data
Size: 16KB - Virtual size: 21KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 29KB - Virtual size: 28KB