21c76e0341cd0bac03eed85a0f92aa106a09e4fd4691f0e48322194faef9bd73

Sharing

Copy URL Twitter E-mail

General

Target
21c76e0341cd0bac03eed85a0f92aa106a09e4fd4691f0e48322194faef9bd73
Size 5.9MB
Sample260818-ee283sfc35
SHA256 21c76e0341cd0bac03eed85a0f92aa106a09e4fd4691f0e48322194faef9bd73
MD5 6534e31efb30c332edb891e5425d1de8
SHA1 31ad18c675ffcde42fa379d2dcb8a4058d540828
SHA512 2d0e4a67018c9d61deb6034230675615a470612b33266a25045ddadae1d4237aaf97f5ca6022dab7f25f3ef393b6c10c8bfd713d0b514e54edba1edf34c79d40
SSDEEP 98304:pMuL8dj6f4wGNusLsUyxlkvVYdJi5Ah1NS699xzErPVcFQi:pGj6xEusfVYdJi2P9B+cFQi
TLSH
T1C056C012BAD18471E66302306569B3BB4DBEFAA11B30C5CB739C162E4F719C19D3B762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21c76e0341cd0bac03eed85a0f92aa106a09e4fd4691f0e48322194faef9bd73

File Explorer

21c76e0341cd0bac03eed85a0f92aa106a09e4fd4691f0e48322194faef9bd73

.exe 5.9MB

21c76e0341cd0bac03eed85a0f92aa106a09e4fd4691f0e48322194faef9bd73

IMPHASH b1c5b00705207dd0cd7732257f84f8dc
SHA256 21c76e0341cd0bac03eed85a0f92aa106a09e4fd4691f0e48322194faef9bd73
MD5 6534e31efb30c332edb891e5425d1de8
SHA1 31ad18c675ffcde42fa379d2dcb8a4058d540828
SHA512 2d0e4a67018c9d61deb6034230675615a470612b33266a25045ddadae1d4237aaf97f5ca6022dab7f25f3ef393b6c10c8bfd713d0b514e54edba1edf34c79d40
SSDEEP 98304:pMuL8dj6f4wGNusLsUyxlkvVYdJi5Ah1NS699xzErPVcFQi:pGj6xEusfVYdJi2P9B+cFQi
TLSH
T1C056C012BAD18471E66302306569B3BB4DBEFAA11B30C5CB739C162E4F719C19D3B762
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1546268

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

CareUEyes.pdb

winmm

timeSetEvent mciSendStringW timeKillEvent

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

kernel32

FindNextFileW GetFileAttributesExW GetCurrentDirectoryW MapViewOfFile GetVolumeInformationW GetFileAttributesW GetTempPathW CreateDirectoryW SetFilePointerEx SetEndOfFile FlushFileBuffers GetFileInformationByHandle CreateToolhelp32Snapshot GetFileSizeEx FormatMessageW TryEnterCriticalSection GetSystemTimeAsFileTime SystemTimeToFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetVersionExW GetSystemInfo GetSystemDirectoryW GetTimeZoneInformation GetUserDefaultLangID FindFirstChangeNotificationW FindCloseChangeNotification WaitForMultipleObjects FindNextChangeNotification Process32FirstW Process32NextW ResetEvent OpenFileMappingW IsBadReadPtr GetSystemTime GetCurrentDirectoryA GetModuleFileNameA GetVersionExA HeapCreate FreeResource GetFullPathNameW SleepEx VerSetConditionMask QueryPerformanceFrequency VerifyVersionInfoW QueryPerformanceCounter MoveFileExA CompareFileTime GetFileType GetStdHandle PeekNamedPipe FormatMessageA InterlockedDecrement WriteFile UnmapViewOfFile SuspendThread GetThreadContext lstrlenA InterlockedIncrement VirtualFree GlobalAlloc VirtualAlloc FlushInstructionCache VirtualProtect GetEnvironmentVariableW GetEnvironmentVariableA CreateProcessW ResumeThread TerminateProcess FindFirstFileW ReadProcessMemory LoadLibraryExA LoadLibraryA GetComputerNameA OutputDebugStringW IsBadWritePtr SetLastError ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode GetACP GetDriveTypeW SetStdHandle GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetStartupInfoW UnhandledExceptionFilter LocalFree GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW GetExitCodeThread SwitchToThread WaitForSingleObjectEx DuplicateHandle IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent lstrcmpW ExitProcess GlobalAddAtomA Sleep InterlockedCompareExchange GetModuleHandleA SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection GetProcessHeap FindClose ReadFile CreateFileMappingW GetFileSize GlobalLock GlobalUnlock MulDiv WideCharToMultiByte OutputDebugStringA DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateThread LoadLibraryW GetProcAddress FreeLibrary GetLastError CloseHandle SetUnhandledExceptionFilter GetCurrentProcess GetCurrentProcessId GetCommandLineA GetModuleHandleW GetLocalTime GetTickCount HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetCommandLineW SetCurrentDirectoryW InitializeCriticalSectionAndSpinCount lstrcmpiW LockResource SizeofResource FindResourceExW DecodePointer RaiseException MultiByteToWideChar DeleteFileW LoadResource FindResourceW LoadLibraryExW GetCurrentThread GetModuleFileNameW VirtualQuery GetCurrentThreadId CreateFileW

user32

ReleaseDC MessageBoxW GetActiveWindow IsWindowVisible GetFocus GetParent ShowWindow SetWindowPos DestroyWindow SendMessageW UnregisterClassW CharNextW PtInRect GetDC OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindow MsgWaitForMultipleObjects CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW SetClassLongW GetClassLongW RemovePropW GetPropW SetPropW SetMenuContextHelpId GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu AppendMenuW GetMenuItemCount DestroyMenu DrawTextW SystemParametersInfoA CharLowerBuffW MapVirtualKeyA UpdateLayeredWindow OffsetRect DispatchMessageW FindWindowW GetWindowRect MonitorFromRect PostMessageW UnhookWinEvent SetWinEventHook GetForegroundWindow GetCursorPos WindowFromPoint GetMonitorInfoW BringWindowToTop GetUserObjectInformationW GetProcessWindowStation DrawIconEx SetWindowLongW SetForegroundWindow MonitorFromPoint GetSystemMetrics GetAsyncKeyState UnregisterHotKey RegisterHotKey EnumDisplayMonitors CopyRect ScreenToClient GetWindowLongW MonitorFromWindow GetClassNameW GetShellWindow GetAncestor LockWorkStation GetWindowThreadProcessId SystemParametersInfoW AttachThreadInput SetCapture GetCapture ReleaseCapture ClientToScreen InvalidateRect SetCursor SetActiveWindow PostQuitMessage GetDesktopWindow CreateWindowExW SetWindowTextW GetWindowTextW GetWindowTextLengthW MoveWindow GetClientRect BeginPaint EndPaint InvalidateRgn RedrawWindow SetFocus GetWindow IsChild GetDlgCtrlID GetDlgItem GetSysColor DestroyAcceleratorTable FillRect CreateAcceleratorTableW DefWindowProcW RegisterWindowMessageW GetClassInfoExW LoadCursorW CreatePopupMenu IsMenu IsWindowEnabled EnableWindow LoadImageW CreateIconFromResource LoadBitmapW GetIconInfo MapWindowPoints SetCaretPos HideCaret GetCaretBlinkTime CreateCaret UpdateWindow AnimateWindow TrackMouseEvent PeekMessageW EnableMenuItem TranslateMessage RegisterClassExW CallWindowProcW SetTimer KillTimer GetWindowLongA SetLayeredWindowAttributes IsIconic EnumDisplayDevicesW DestroyIcon SendMessageA GetWindowDC GetWindowRgn IsZoomed SetSysColors DestroyCursor GetMessageW EqualRect IsRectEmpty UnionRect IntersectRect InflateRect SetRect GetKeyState

gdi32

SetDeviceGammaRamp GetObjectW GetStockObject DeleteDC CreateCompatibleBitmap CreateSolidBrush DeleteObject SelectObject SetBkMode SaveDC SetViewportOrgEx CreateFontIndirectW EnumFontsW CreateRectRgn CreatePen SetROP2 CreateHatchBrush FrameRgn Rectangle SetGraphicsMode CreateRoundRectRgn ExcludeClipRect GetDeviceCaps RestoreDC ExtCreateRegion GetRegionData IntersectClipRect SelectClipRgn CreateDIBSection GetCurrentObject GetViewportOrgEx CreateBitmap StretchBlt GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI AddFontMemResourceEx RemoveFontMemResourceEx SetTextColor SetTextAlign GetTextMetricsW SetWorldTransform ExtTextOutW GetTextFaceW GdiFlush BitBlt CreateCompatibleDC EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW

comdlg32

GetOpenFileNameW ChooseColorW

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegNotifyChangeKeyValue RegQueryValueExW GetUserNameA RegDeleteValueW RegCreateKeyExW RegSetValueExW CryptEnumProvidersW

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW Shell_NotifyIconW SHFileOperationW SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderLocation ord680 ShellExecuteW

ole32

CoTaskMemAlloc CoCreateInstance OleUninitialize CoTaskMemRealloc CLSIDFromString CLSIDFromProgID CoGetClassObject CoTaskMemFree OleLockRunning IIDFromString CoCreateGuid CreateBindCtx StringFromGUID2 CreateStreamOnHGlobal OleInitialize

oleaut32

SysAllocString VarUI4FromStr VariantTimeToSystemTime SystemTimeToVariantTime VarBstrFromDate SysAllocStringLen SysStringLen LoadTypeLi VariantInit VariantClear OleCreateFontIndirect DispCallFunc SysFreeString LoadRegTypeLi VarUdateFromDate

shlwapi

PathFileExistsW PathIsDirectoryW PathFindExtensionW PathRemoveFileSpecW PathAppendW StrToIntExW PathQuoteSpacesW

gdiplus

GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipAlloc GdipFree GdipImageGetFrameCount GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipGraphicsClear GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipBitmapLockBits

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeA GetFileVersionInfoA GetFileVersionInfoSizeW

dwmapi

DwmGetWindowAttribute

ws2_32

getsockname getpeername connect bind WSAGetLastError send recv closesocket getsockopt htons ntohs setsockopt WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet select getaddrinfo freeaddrinfo recvfrom shutdown sendto gethostname socket getnameinfo

iphlpapi

GetAdaptersInfo

imm32

ImmGetContext ImmReleaseContext ImmAssociateContext

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore

wldap32

ord208 ord41 ord46 ord145 ord216 ord14 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord301 ord133 ord147 ord219

usp10

ScriptShape ScriptItemize ScriptFreeCache

generic

count=41, id=241, version=40116,

count=206, id=243, version=40116,

count=41, id=242, version=40116,

count=9, id=199, version=41118,

count=28, id=259, version=26706,

count=8, id=261, productName=VS2017 v15.9.7 build 27027, version=27027,

count=22, id=260, version=27041,

count=41, id=260, version=26706,

count=136, id=261, version=26706,

count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=21, productName=Unmarked objects (old),

count=658, id=260, version=27038,

count=5, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=689, id=1, productName=Unmarked objects,

count=344, id=261, version=27041,

count=85, id=261, version=27054,

count=7, id=261, version=27051,

count=144, id=265, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,