de90ff76dc7cfeac247b3522576241406045c5b8f20088497b001e7fe6a7434f

Sharing

Copy URL

Twitter E-mail

General

Target

de90ff76dc7cfeac247b3522576241406045c5b8f20088497b001e7fe6a7434f
Size

213KB
MD5

f2ac112f91721ffda97a8313d4c8445c
SHA1

9f9f463f846ee6387d6dc10d835f046a8b7d5ea6
SHA256

de90ff76dc7cfeac247b3522576241406045c5b8f20088497b001e7fe6a7434f
SHA512

b8d4026ac672488f65ec558e83eb2812d6338b2ff61368444479869ba1b1089169eee8cec08613a11982dfd7ca0170b7a189deed9cb887e895ef884a712eeb29
SSDEEP

3072:Dg+ThQhVQqz2yQePYQEpHy6oG+RDqmRpsZF1THdImjYhiFx0oO0csr3Jm:DZihVQg2WPY1HypqooFSC05CrM

Score

N/A

Malware Config

Signatures

Files

de90ff76dc7cfeac247b3522576241406045c5b8f20088497b001e7fe6a7434f
.dll windows x86

7d029af85f9ff9f3614f80e0dc0cc648

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
LocalFree
VirtualProtect
ResetEvent
VirtualAlloc
GetCurrentDirectoryW
GetTempPathW
FlushFileBuffers
VirtualFree
LCMapStringW
LCMapStringA
GetStringTypeW
LocalAlloc
MultiByteToWideChar
CreateDirectoryW
FindFirstChangeNotificationW
GetEnvironmentVariableW
GetLastError
HeapFree
HeapAlloc
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA

ole32

CoInitialize
OleUninitialize
OleInitialize
OleSetContainedObject
CoUninitialize
CoRevokeClassObject

advapi32

RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
ControlService
RegisterServiceCtrlHandlerW
RegOpenKeyExW
FreeSid
SetEntriesInAclW
SetServiceStatus
AllocateAndInitializeSid
LookupPrivilegeValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
RegEnumKeyW
GetTokenInformation
StartServiceCtrlDispatcherW
CreateServiceW
CloseServiceHandle
OpenProcessToken
DeleteService

comctl32

ImageList_GetBkColor
ImageList_GetImageCount
ImageList_GetDragImage
ImageList_Create
ImageList_EndDrag

aclui

ord1
ord2

Exports

Exports

Blackbreak
Eye
Figcome
Leadthan
Shellclaim
SixPlace
Streamvalue
Toolpoor

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7d029af85f9ff9f3614f80e0dc0cc648

Code Sign

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

advapi32

comctl32

aclui

Exports

Exports

Sections

.text Size: 121KB - Virtual size: 120KB

.rdata Size: 69KB - Virtual size: 68KB

.data Size: 3KB - Virtual size: 97KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 121KB - Virtual size: 120KB

.rdata
Size: 69KB - Virtual size: 68KB

.data
Size: 3KB - Virtual size: 97KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 7KB - Virtual size: 7KB