a92a643ad0d5cefd4d922720e9a24570c54168143da0da2447edbddd7e1e233f

Sharing

Copy URL

Twitter E-mail

General

Target

a92a643ad0d5cefd4d922720e9a24570c54168143da0da2447edbddd7e1e233f
Size

391KB
MD5

61706b402aea755ea6588f3794637fe9
SHA1

0c3ec40e7d05066caa54bd76ca155ce1d04fdf81
SHA256

a92a643ad0d5cefd4d922720e9a24570c54168143da0da2447edbddd7e1e233f
SHA512

3b74f25fff5e8ff244593383f0b073e8f3d3600b5600f887fb5210961c5c4dc4965368b3079e5d5bb30dd3cac1d42acbbf733f8e63a3f9c3c979f7704309dab8
SSDEEP

3072:80QXXzUY3z5Volw9sShsB1NJt8TBg7R7A+aMk6/WbM6o2FrMKhmvSIinUqezz:80sVj/ol8YLL6+aMk6/GM6LGKZnUD

Score

N/A

Malware Config

Signatures

Files

a92a643ad0d5cefd4d922720e9a24570c54168143da0da2447edbddd7e1e233f
.dll regsvr32 windows x86

9b81137a1352701b5991fbab2173284c

Code Sign

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetTraceEnableFlags
UnregisterTraceGuids
GetTraceEnableLevel
RegisterTraceGuidsW
OpenProcessToken
GetTraceLoggerHandle
TraceMessage

gdi32

DeleteObject
DeleteDC
CreateCompatibleDC
CreateDIBSection
SelectObject

kernel32

GetModuleHandleExW
GetCurrentProcess
CreateDirectoryW
SetLastError
Sleep
GetCurrentProcessId
FreeLibrary
SetUnhandledExceptionFilter
FormatMessageW
GetCommandLineA
HeapAlloc
HeapFree
SetFileAttributesW
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
GlobalAlloc
VirtualProtectEx
SetEvent
GetModuleHandleA
QueryPerformanceCounter
WritePrivateProfileStringW
GetLastError
CloseHandle
GetCurrentThreadId
QueueUserWorkItem
GetModuleFileNameW
TerminateProcess
LoadLibraryExW
UnhandledExceptionFilter
GetSystemDirectoryW
GetProcAddress
GetProcessHeap
LoadLibraryA
LocalFree
LoadLibraryW
GetModuleHandleW
CreateEventW
GetTempPathW
RemoveDirectoryW
OutputDebugStringA
DeleteFileW
GetTickCount

msvcrt

_amsg_exit
_vsnwprintf
wcschr
_lock
memset
_initterm
_unlock
_onexit
malloc
_XcptFilter
free
_purecall
_callnewh
_CxxThrowException
__dllonexit
memcpy

ntdll

NtQueryInformationToken

ole32

CoGetInterfaceAndReleaseStream
CoTaskMemAlloc
CoCreateInstance
FreePropVariantArray
CoInitializeEx
CoInitialize
CoUninitialize
CoTaskMemFree
CLSIDFromString
PropVariantCopy
StringFromGUID2
CoMarshalInterThreadInterfaceInStream
CoCreateGuid
PropVariantClear

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetCustomDevicePropertyW
SetupDiEnumDeviceInfo

shell32

CommandLineToArgvW
SHInvokePrinterCommandW
SHGetFolderLocation
ShellExecuteExW

shlwapi

StrCmpNIW

user32

ReleaseDC
SetFocus
SendMessageW
DestroyIcon
GetDC
DispatchMessageW
DialogBoxParamW
GetMenuDefaultItem
ShowWindow
SetTimer
LoadStringW
CreatePopupMenu
GetSystemMetrics
EnableWindow
EndDialog
MsgWaitForMultipleObjects

Exports

Exports

DllUnregisterServer
DllRegisterServer
DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 106KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b81137a1352701b5991fbab2173284c

Code Sign

Headers

File Characteristics

Imports

advapi32

gdi32

kernel32

msvcrt

ntdll

ole32

setupapi

shell32

shlwapi

user32

Exports

Exports

Sections

.text Size: 73KB - Virtual size: 72KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 106KB - Virtual size: 110KB

.rsrc Size: 169KB - Virtual size: 169KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 73KB - Virtual size: 72KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 106KB - Virtual size: 110KB

.rsrc
Size: 169KB - Virtual size: 169KB

.reloc
Size: 7KB - Virtual size: 7KB