c02b827e2f35ac8776c5d06c34b5786581da93daaa7e63edd691c4bbb9dfb7d5

Sharing

Copy URL Twitter E-mail

General

Target
c02b827e2f35ac8776c5d06c34b5786581da93daaa7e63edd691c4bbb9dfb7d5
Size 9.8MB
Sample260907-ew13caef69
SHA256 c02b827e2f35ac8776c5d06c34b5786581da93daaa7e63edd691c4bbb9dfb7d5
MD5 ca43ca16b9b4482579e8bec5f2b96b7c
SHA1 0e4203a8641593f1ce82551ee1347b9a20160a4c
SHA512 a49110640d53d4d60d668694f45f5225392811a459bf27d963fae675a59603b8a4b69256e0ef0d9aae47024a0f91c05a09bb453b9fee08205cad4f638ae2c499
SSDEEP 98304:vG+Y3aT1JdCJE8piIUSX3qxZ9CDxqvnDeVx3LiGCPO2gYcjhE/Pm0:jTVkAjS4wxqCFmk
TLSH
T1CFA64C00A3F49A4AF4FA673099B797A12A3D7C509A33C35F3792B61F1935B908936713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c02b827e2f35ac8776c5d06c34b5786581da93daaa7e63edd691c4bbb9dfb7d5

File Explorer

c02b827e2f35ac8776c5d06c34b5786581da93daaa7e63edd691c4bbb9dfb7d5

.dll 9.8MB

c02b827e2f35ac8776c5d06c34b5786581da93daaa7e63edd691c4bbb9dfb7d5

IMPHASH b150249041bc34a4ca9f139178dc8613
SHA256 c02b827e2f35ac8776c5d06c34b5786581da93daaa7e63edd691c4bbb9dfb7d5
MD5 ca43ca16b9b4482579e8bec5f2b96b7c
SHA1 0e4203a8641593f1ce82551ee1347b9a20160a4c
SHA512 a49110640d53d4d60d668694f45f5225392811a459bf27d963fae675a59603b8a4b69256e0ef0d9aae47024a0f91c05a09bb453b9fee08205cad4f638ae2c499
SSDEEP 98304:vG+Y3aT1JdCJE8piIUSX3qxZ9CDxqvnDeVx3LiGCPO2gYcjhE/Pm0:jTVkAjS4wxqCFmk
TLSH
T1CFA64C00A3F49A4AF4FA673099B797A12A3D7C509A33C35F3792B61F1935B908936713
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1304816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

msvcrt

_CrtDbgReportW __iob_func _aligned_free _aligned_malloc _amsg_exit _assert _beginthreadex _errno _fpreset _initterm _iob _isctype _lock _lock_file _memicmp _onexit _snprintf _snwprintf _stricmp _swprintf _ultow _unlock _unlock_file _vscwprintf _vsnprintf _vsnwprintf _vswprintf _wcsdup _wcsicmp _wcslwr _wcsnicmp _wcsupr _wtoi abort acos atoi bsearch calloc cos fflush fputc free fwrite getenv isalpha isprint isspace iswspace isxdigit localeconv malloc mbrtowc memchr memcmp memcpy memmove memset realloc signal sin sprintf strchr strcmp strcpy strcspn strerror strlen strncmp strnlen strrchr tolower toupper towupper vfprintf vsprintf wcrtomb wcscat wcschr wcscmp wcscpy _wcsdup _wcsicmp wcslen wcsncmp wcsnlen wcsrchr wcsstr wcstol wcstoul

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid ChangeServiceConfigW CheckTokenMembership CloseServiceHandle CommandLineFromMsiDescriptor ControlService ConvertSidToStringSidW CreateProcessWithLogonW FreeSid GetTokenInformation GetUserNameW LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW OpenThreadToken QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegGetValueA RegGetValueW RegOpenKeyA RegOpenKeyExA RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueA RegQueryValueExA RegQueryValueExW RegQueryValueW RegSetValueExW StartServiceW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject Ellipse ExtTextOutW GdiGetCharDimensions GetDIBits GetDeviceCaps GetObjectW GetStockObject GetTextExtentPoint32W GetTextMetricsW LineTo MaskBlt MoveToEx Pie RoundRect SelectObject SetBkColor SetBkMode SetDIBits SetPixel SetTextColor StretchBlt

user32

AdjustWindowRect AllowSetForegroundWindow AppendMenuW BeginDeferWindowPos BeginPaint BringWindowToTop CallNextHookEx CallWindowProcW ChangeClipboardChain CharLowerBuffW CharLowerW CharNextA CharNextW CharPrevW CharUpperW CheckDlgButton CheckMenuItem CheckMenuRadioItem CheckRadioButton ClientToScreen CloseClipboard CopyIcon CopyImage CreateDialogParamW CreateIconIndirect CreateMenu CreatePopupMenu CreateWindowExW DdeAccessData DdeClientTransaction DdeConnect DdeCreateStringHandleW DdeDisconnect DdeFreeDataHandle DdeFreeStringHandle DdeGetLastError DdeInitializeA DdeInitializeW DdeNameService DdeQueryStringW DdeUnaccessData DdeUninitialize DefWindowProcW DeferWindowPos DeleteMenu DeregisterShellHookWindow DestroyIcon DestroyMenu DestroyWindow DialogBoxIndirectParamW DialogBoxParamW DispatchMessageW DrawFocusRect DrawIconEx DrawTextExW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDeferWindowPos EndDialog EndPaint EnumDisplaySettingsW EnumWindows EqualRect ExitWindowsEx FillRect FindWindowExW FindWindowW FrameRect GetAncestor GetAsyncKeyState GetCapture GetClassInfoExW GetClassInfoW GetClassNameW GetClientRect GetClipboardData GetClipboardFormatNameA GetComboBoxInfo GetCursorPos GetDC GetDesktopWindow GetDlgCtrlID GetDlgItem GetDlgItemInt GetDlgItemTextW GetFocus GetForegroundWindow GetIconInfo GetKeyState GetLastActivePopup GetMenuDefaultItem GetMenuInfo GetMenuItemCount GetMenuItemID GetMenuItemInfoW GetMenuItemRect GetMessagePos GetMessageW GetParent GetPropW GetScrollPos GetShellWindow GetSubMenu GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetTopWindow GetWindow GetWindowDC GetWindowLongA GetWindowLongPtrW GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InflateRect InsertMenuA InsertMenuItemW InsertMenuW InvalidateRect InvertRect IsChild IsDlgButtonChecked IsRectEmpty IsWindow IsWindowEnabled IsWindowUnicode IsWindowVisible KillTimer LoadAcceleratorsW LoadBitmapW LoadCursorW LoadIconW LoadImageW LoadMenuW LoadStringA LoadStringW MapWindowPoints MessageBeep MessageBoxA MessageBoxW MonitorFromWindow MoveWindow OffsetRect OpenClipboard PaintDesktop PostMessageW PostQuitMessage PrivateExtractIconsW PtInRect RedrawWindow RegisterClassExW RegisterClassW RegisterClipboardFormatA RegisterClipboardFormatW RegisterShellHookWindow ReleaseCapture ReleaseDC RemoveMenu RemovePropW ScreenToClient SendDlgItemMessageW SendMessageTimeoutW SendMessageW SendNotifyMessageW SetCapture SetClipboardData SetClipboardViewer SetCursor SetDlgItemInt SetDlgItemTextA SetDlgItemTextW SetFocus SetForegroundWindow SetMenuDefaultItem SetMenuInfo SetMenuItemInfoW SetParent SetPropW SetRect SetRectEmpty SetShellWindowEx SetTaskmanWindow SetTimer SetWindowLongA SetWindowLongPtrW SetWindowLongW SetWindowPos SetWindowTextW SetWindowsHookExW ShowWindow SwitchToThisWindow SystemParametersInfoW TrackPopupMenu TrackPopupMenuEx TranslateAcceleratorW TranslateMessage UnhookWindowsHookEx UpdateWindow WaitForInputIdle WinHelpW WindowFromPoint wsprintfW

comctl32

ord167 ord401 ord71 ord400 CreatePropertySheetPageW ord328 ord337 ord336 ord329 ord386 ord332 ord334 ord339 ord335 ord338 ord320 ord327 ord321 ord388 ord387 ord323 ord324 DestroyPropertySheetPage ord403 ord169 ord73 ord152 ImageList_AddMasked ImageList_BeginDrag ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_Draw ImageList_EndDrag ImageList_GetIcon ImageList_GetIconSize ImageList_GetImageCount ImageList_Remove ImageList_ReplaceIcon InitCommonControls InitCommonControlsEx PropertySheetW

comdlg32

GetFileTitleW GetOpenFileNameW

shlwapi

AssocCreate AssocGetPerceivedType AssocQueryStringByKeyW AssocQueryStringW ord448 ord316 ord317 ord164 ord175 ord256 ord172 ord481 ord509 ord176 ord484 ord536 ord163 ord174 ord478 ord479 ord437 ord2 PathAddBackslashW PathAddExtensionW PathAppendA PathAppendW PathBuildRootW PathCombineW PathCommonPrefixW PathCreateFromUrlW PathFileExistsA ord446 ord511 ord4 PathFileExistsW PathFindExtensionA PathFindExtensionW PathFindFileNameW ord6 PathFindOnPathW PathGetArgsW PathGetCharTypeA PathGetCharTypeW PathGetDriveNumberW PathIsDirectoryEmptyW PathIsDirectoryW PathIsFileSpecW PathIsNetworkPathW PathIsRelativeW PathIsRootA PathIsRootW PathIsSameRootW PathIsUNCW PathIsURLW ord456 PathMatchSpecW PathParseIconLocationW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW PathRemoveBlanksW PathRemoveExtensionW PathRemoveFileSpecA PathRemoveFileSpecW PathSearchAndQualifyW PathSetDlgItemPathW PathStripPathW PathStripToRootW PathUnExpandEnvStringsW PathUnquoteSpacesA PathUnquoteSpacesW QISearch ord544 ord20 ord7 ord215 SHAutoComplete SHCopyKeyW ord12 ord477 ord471 SHCreateStreamOnFileEx SHCreateStreamOnFileW ord16 ord278 SHDeleteKeyW SHDeleteValueW ord464 ord460 ord197 ord22 ord545 ord19 ord10 ord461 ord193 ord348 ord192 ord476 ord271 ord491 SHGetValueW ord515 ord222 ord223 ord224 ord540 ord487 ord8 ord510 ord179 SHOpenRegStream2W ord535 ord507 ord531 ord508 ord532 SHQueryValueExW ord18 SHRegDuplicateHKey SHRegGetBoolUSValueW ord344 SHRegGetUSValueW SHRegGetValueW SHRegSetUSValueW ord21 ord384 ord266 ord433 SHSetValueW ord165 ord186 SHSkipJunction SHStrDupW ord24 ord217 ord9 ord560 ord17 ord516 ord517 ShellMessageBoxW StrCSpnW StrCatBuffW StrChrW StrCmpIW StrCmpLogicalW StrCmpNA StrCmpNIW StrCmpNW StrCmpW StrCpyNW ord400 StrDupW StrFormatByteSize64A StrFormatByteSizeW StrFormatKBSizeW StrPBrkW StrRChrW StrRetToBSTR StrRetToBufW StrRetToStrW StrStrIW StrToIntA StrToIntExW StrToIntW StrTrimW UrlIsW wnsprintfW

kernel32

AcquireSRWLockExclusive ActivateActCtx CancelIo CloseHandle CompareFileTime CompareStringW CopyFileExW CopyFileW CreateActCtxW CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateProcessW DeactivateActCtx DeleteCriticalSection DeleteFileW DeviceIoControl DisableThreadLibraryCalls DosDateTimeToFileTime EnterCriticalSection EnumResourceNamesW ExitProcess ExpandEnvironmentStringsA ExpandEnvironmentStringsW FileTimeToDosDateTime FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsGetValue FlsSetValue FlushInstructionCache FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetBinaryTypeW GetComputerNameW GetCurrentDirectoryA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeA GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetFileAttributesExW GetFileAttributesW GetFileSize GetFileTime GetFullPathNameW GetLastError GetLocaleInfoW GetLogicalDrives GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNumberFormatW GetPrivateProfileIntW GetPrivateProfileStringW GetProcAddress GetProcessHeap GetProfileStringW GetShortPathNameA GetShortPathNameW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemWow64DirectoryW GetTempPathW GetThreadId GetThreadLocale GetTickCount GetTimeFormatW GetVersion GetVolumeInformationA GetVolumeInformationW GetWindowsDirectoryW GlobalAddAtomW GlobalAlloc GlobalDeleteAtom GlobalFindAtomW GlobalFree GlobalGetAtomNameW GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSection IsBadCodePtr IsBadReadPtr LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LocalReAlloc LockResource MapViewOfFile MoveFileW MoveFileWithProgressW MulDiv MultiByteToWideChar OutputDebugStringA ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency QueueUserAPC RaiseException ReadDirectoryChangesW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW RestoreLastError RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlRaiseException RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SearchPathW SetCurrentDirectoryA SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetLastError SetUnhandledExceptionFilter SetVolumeLabelW SizeofResource Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpyA lstrcpyW lstrcpynA lstrcpynW lstrlenA lstrlenW

ntdll

DbgPrint NtQueryInformationFile NtQueryObject NtQueryVolumeInformationFile RtlAllocateHeap RtlAnsiStringToUnicodeString RtlAssert RtlCreateUnicodeStringFromAsciiz RtlFreeHeap RtlFreeUnicodeString RtlGUIDFromString RtlInitAnsiString RtlInitUnicodeString vDbgPrintExWithPrefix

AppCompat_RunDLLW AssocCreateForClasses AssocGetDetailsOfPropKey CDefFolderMenu_Create CDefFolderMenu_Create2 CallCPLEntry16 CheckEscapesW CommandLineToArgvW Control_RunDLL Control_RunDLLA Control_RunDLLAsUserW Control_RunDLLW DAD_AutoScroll DAD_DragEnterEx DAD_DragEnterEx2 DAD_DragLeave DAD_DragMove DAD_SetDragImage DAD_ShowDragImage DllCanUnloadNow DllGetClassObject DllGetVersion DllInstall DllRegisterServer DllUnregisterServer DoEnvironmentSubstA DoEnvironmentSubstW DragAcceptFiles DragFinish DragQueryFile DragQueryFileA DragQueryFileAorW DragQueryFileW DragQueryPoint DriveType DuplicateIcon ExtractAssociatedIconA ExtractAssociatedIconExA ExtractAssociatedIconExW ExtractAssociatedIconW ExtractIconA ExtractIconEx ExtractIconExA ExtractIconExW ExtractIconW FindExecutableA FindExecutableW FreeIconList GetCurrentProcessExplicitAppUserModelID GetFileNameFromBrowse ILAppendID ILClone ILCloneFirst ILCombine ILCreateFromPath ILCreateFromPathA ILCreateFromPathW ILFindChild ILFindLastID ILFree ILGetNext ILGetSize ILIsEqual ILIsParent ILLoadFromStream ILLoadFromStreamEx ILRemoveLastID ILSaveToStream InitNetworkAddressControl InternalExtractIconListA InternalExtractIconListW IsLFNDrive IsLFNDriveA IsLFNDriveW IsNetDrive IsUserAnAdmin OpenAs_RunDLL OpenAs_RunDLLA OpenAs_RunDLLW OpenRegStream Options_RunDLL Options_RunDLLA Options_RunDLLW PathCleanupSpec PathGetShortPath PathIsExe PathIsSlowA PathIsSlowW PathMakeUniqueName PathProcessCommand PathQualify PathResolve PathYetAnotherMakeUniqueName PickIconDlg PifMgr_CloseProperties PifMgr_GetProperties PifMgr_OpenProperties PifMgr_SetProperties PrepareDiscForBurnRunDllW PrintersGetCommand_RunDLL PrintersGetCommand_RunDLLA PrintersGetCommand_RunDLLW ReadCabinetState RealDriveType RealShellExecuteA RealShellExecuteExA RealShellExecuteExW RealShellExecuteW RegenerateUserEnvironment RestartDialog RestartDialogEx SHAddDefaultPropertiesByExt SHAddFromPropSheetExtArray SHAddToRecentDocs SHAlloc SHAllocShared SHAppBarMessage SHAssocEnumHandlers SHAssocEnumHandlersForProtocolByApplication SHBindToFolderIDListParent SHBindToFolderIDListParentEx SHBindToObject SHBindToParent SHBrowseForFolder SHBrowseForFolderA SHBrowseForFolderW SHCLSIDFromString SHChangeNotification_Lock SHChangeNotification_Unlock SHChangeNotify SHChangeNotifyDeregister SHChangeNotifyRegister SHChangeNotifyRegisterThread SHChangeNotifySuspendResume SHCloneSpecialIDList SHCoCreateInstance SHCreateAssociationRegistration SHCreateDataObject SHCreateDefaultContextMenu SHCreateDefaultExtractIcon SHCreateDefaultPropertiesOp SHCreateDirectory SHCreateDirectoryExA SHCreateDirectoryExW SHCreateFileExtractIconW SHCreateItemFromIDList SHCreateItemFromParsingName SHCreateItemFromRelativeName SHCreateItemInKnownFolder SHCreateItemWithParent SHCreateLocalServerRunDll SHCreateProcessAsUserW SHCreatePropSheetExtArray SHCreateQueryCancelAutoPlayMoniker SHCreateShellFolderView SHCreateShellFolderViewEx SHCreateShellItem SHCreateShellItemArray SHCreateShellItemArrayFromDataObject SHCreateShellItemArrayFromIDLists SHCreateShellItemArrayFromShellItem SHCreateStdEnumFmtEtc SHDefExtractIconA SHDefExtractIconW SHDestroyPropSheetExtArray SHDoDragDrop SHEmptyRecycleBinA SHEmptyRecycleBinW SHEnableServiceObject SHEnumerateUnreadMailAccountsW SHEvaluateSystemCommandTemplate SHExtractIconsW SHFileOperation SHFileOperationA SHFileOperationW SHFindFiles SHFind_InitMenuPopup SHFlushClipboard SHFlushSFCache SHFormatDrive SHFree SHFreeNameMappings SHFreeShared SHGetDataFromIDListA SHGetDataFromIDListW SHGetDesktopFolder SHGetDiskFreeSpaceA SHGetDiskFreeSpaceExA SHGetDiskFreeSpaceExW SHGetDriveMedia SHGetFileInfo SHGetFileInfoA SHGetFileInfoW SHGetFolderLocation SHGetFolderPathA SHGetFolderPathAndSubDirA SHGetFolderPathAndSubDirW SHGetFolderPathEx SHGetFolderPathW SHGetIDListFromObject SHGetIconOverlayIndexA SHGetIconOverlayIndexW SHGetImageList SHGetInstanceExplorer SHGetItemFromObject SHGetKnownFolderIDList SHGetKnownFolderItem SHGetKnownFolderPath SHGetLocalizedName SHGetMalloc SHGetNameFromIDList SHGetNewLinkInfo SHGetNewLinkInfoA SHGetNewLinkInfoW SHGetPathFromIDList SHGetPathFromIDListA SHGetPathFromIDListEx SHGetPathFromIDListW SHGetPropertyStoreForWindow SHGetPropertyStoreFromIDList SHGetPropertyStoreFromParsingName SHGetRealIDL SHGetSetFolderCustomSettingsW SHGetSetSettings SHGetSettings SHGetSpecialFolderLocation SHGetSpecialFolderPathA SHGetSpecialFolderPathW SHGetStockIconInfo SHGetTemporaryPropertyForItem SHGetUnreadMailCountW SHHandleUpdateImage SHHelpShortcuts_RunDLL SHHelpShortcuts_RunDLLA SHHelpShortcuts_RunDLLW SHILCreateFromPath SHInvokePrinterCommandA SHInvokePrinterCommandW SHIsFileAvailableOffline SHLimitInputEdit SHLoadInProc SHLoadNonloadedIconOverlayIdentifiers SHLoadOLE SHLockShared SHMapIDListToImageListIndexAsync SHMapPIDLToSystemImageListIndex SHMultiFileProperties SHObjectProperties SHOpenFolderAndSelectItems SHOpenPropSheetW SHOpenWithDialog SHParseDisplayName SHPathPrepareForWriteA SHPathPrepareForWriteW SHPropStgCreate SHPropStgReadMultiple SHPropStgWriteMultiple SHQueryRecycleBinA SHQueryRecycleBinW SHQueryUserNotificationState SHRemoveLocalizedName SHReplaceFromPropSheetExtArray SHRestricted SHRunControlPanel SHSetDefaultProperties SHSetInstanceExplorer SHSetKnownFolderPath SHSetLocalizedName SHSetTemporaryPropertyForItem SHSetUnreadMailCountW SHShellFolderView_Message SHSimpleIDListFromPath SHStartNetConnectionDialogW SHTestTokenMembership SHUnlockShared SHUpdateImageA SHUpdateImageW SHUpdateRecycleBinIcon SHValidateUNC SetCurrentProcessExplicitAppUserModelID SheChangeDirA SheChangeDirExW SheGetDirA SheSetCurDrive ShellAboutA ShellAboutW ShellExec_RunDLL ShellExec_RunDLLA ShellExec_RunDLLW ShellExecuteA ShellExecuteEx ShellExecuteExA ShellExecuteExW ShellExecuteW ShellHookProc ShellMessageBoxA ShellMessageBoxW Shell_GetCachedImageIndex Shell_GetCachedImageIndexA Shell_GetCachedImageIndexW Shell_GetImageLists Shell_MergeMenus Shell_NotifyIcon Shell_NotifyIconA Shell_NotifyIconGetRect Shell_NotifyIconW SignalFileOpen StrChrA StrChrIA StrChrIW StrChrW StrCmpNA StrCmpNIA StrCmpNIW StrCmpNW StrNCmpA StrNCmpIA StrNCmpIW StrNCmpW StrRChrA StrRChrIA StrRChrIW StrRChrW StrRStrA StrRStrIA StrRStrIW StrRStrW StrStrA StrStrIA StrStrIW StrStrW WOWShellExecute WaitForExplorerRestartW Win32DeleteFile WriteCabinetState

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

457KB

Virtual Size

457KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ATL

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ATL

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7.3MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c02b827e2f35ac8776c5d06c34b5786581da93daaa7e63edd691c4bbb9dfb7d5

msvcrt

advapi32

gdi32

user32

comctl32

comdlg32

shlwapi

kernel32

ntdll

generic