d3255ed380e290f4992701d1c10a3f65580b5e0aff384ab4308a8202d71f38a8

Sharing

Copy URL

Twitter E-mail

General

Target

d3255ed380e290f4992701d1c10a3f65580b5e0aff384ab4308a8202d71f38a8
Size

275KB
MD5

39cb3387dedf5568efeb8ae071e9006e
SHA1

9e9005fe8e8817c87e8f55bb5ba41f12ec7724b0
SHA256

d3255ed380e290f4992701d1c10a3f65580b5e0aff384ab4308a8202d71f38a8
SHA512

ef496ca7b6aaa85df502a6eccc7fa1758b9bcc14ec194b451660444b4d8e23c3e67353432a3d653bf3936f0cf18df2abe239e7b4e5adb6eb8260aea07c1ca299
SSDEEP

6144:t5OBcubisy1HOB+i8fTdCzNkef99nqJMpvhbNnsUo8o:P1HcoyXzuu5Nn3o8

Score

N/A

Malware Config

Signatures

Files

d3255ed380e290f4992701d1c10a3f65580b5e0aff384ab4308a8202d71f38a8
.dll windows x86

47cd0a369d779933e1b94f9cb8489b3c

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
TraceMessage
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
GetTokenInformation
RegQueryInfoKeyW
EqualSid
RegCreateKeyExW
RegDeleteKeyW
RegCreateKeyW
RegDeleteValueW
AllocateAndInitializeSid
FreeSid
RegDeleteValueA
RegCreateKeyExA
OpenSCManagerW
RegQueryValueExA
RegOpenKeyExA
GetUserNameW
RegOpenKeyA
GetServiceDisplayNameW
OpenProcessToken
RegSetValueExA
RegCloseKey
CloseServiceHandle
RegSetValueExW

comctl32

CreatePropertySheetPageA
ImageList_SetBkColor

gdi32

EndDoc
CreateDCW
CreateFontIndirectW
EndPage
SetAbortProc
SelectClipRgn
LPtoDP
StretchBlt
DPtoLP
SaveDC
CreateSolidBrush
ModifyWorldTransform
Rectangle
SelectPalette
SetMapMode
CreateFontIndirectA
SetViewportOrgEx
CreateRectRgnIndirect
CreateCompatibleDC
CreateDIBSection
RestoreDC
SetICMMode
DeleteDC
SetGraphicsMode
SetROP2
SetLayout
SetBrushOrgEx
SetBkColor
StartPage
AbortDoc
SetWindowOrgEx
GetObjectW
CreateHalftonePalette
SetStretchBltMode
DeleteObject
GetStockObject
ExtTextOutW
TextOutW
Polyline
GetTextMetricsW
CreatePen
SetBkMode
SetViewportExtEx
GetObjectA
SetWindowExtEx
SetTextColor
StartDocW
GetDeviceCaps
SetWorldTransform
GetTextExtentPoint32W
RealizePalette
SetTextAlign
TranslateCharsetInfo
SelectObject

iphlpapi

IcmpSendEcho2
IcmpCloseHandle
IcmpCreateFile

kernel32

WaitForMultipleObjects
FlushInstructionCache
SizeofResource
FindResourceA
GetEnvironmentStringsW
GetTickCount
GetFileSizeEx
GetLastError
lstrcpynW
LoadResource
GetStringTypeExW
InterlockedDecrement
WriteConsoleW
TlsGetValue
FindResourceExW
GetUserDefaultLCID
InterlockedExchange
LCMapStringW
LoadLibraryExA
GetCurrentThread
GetPrivateProfileIntA
WaitNamedPipeW
GetStringTypeW
GetFileAttributesW
GetVersion
GetTempFileNameW
VirtualQuery
GetStartupInfoA
QueryPerformanceFrequency
Sleep
MultiByteToWideChar
GetUserDefaultUILanguage
DeviceIoControl
FileTimeToLocalFileTime
GlobalLock
lstrlenW
GetExitCodeThread
WritePrivateProfileStringA
LocalReAlloc
CreateProcessW
LCMapStringA
CloseHandle
lstrcpyA
GetSystemDirectoryW
RaiseException
OutputDebugStringW
LocalFree
ReadFile
GetOEMCP
TlsSetValue
VirtualFree
lstrcatA
FreeResource
CreateSemaphoreW
TlsFree
GetSystemInfo
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
GetComputerNameExW
SetCurrentDirectoryW
GetCurrentThreadId
GetACP
lstrcmpiA
FindResourceW
lstrcpynA
TlsAlloc
FreeEnvironmentStringsW
GetPrivateProfileIntW
VirtualAlloc
CreateFileMappingW
GetVolumeNameForVolumeMountPointW
VerifyVersionInfoW
FileTimeToSystemTime
FormatMessageW
lstrcmpA
CompareStringW
FreeLibrary
GetPrivateProfileStringA
CreateEventW
OpenEventW
GetProcessHeap
HeapReAlloc
GetNumberFormatW
GlobalUnlock
WriteFile
TerminateProcess
HeapAlloc
GetEnvironmentStrings
SetEndOfFile
GetSystemWindowsDirectoryW
GetTimeFormatW
UnhandledExceptionFilter
lstrcmpW
EnterCriticalSection
SearchPathW
SetHandleCount
MapViewOfFile
ReadConsoleW
InitializeCriticalSection
GetThreadLocale
GetCurrentProcess
ExpandEnvironmentStringsW
InterlockedIncrement
GetModuleFileNameA
GetStringTypeExA
InterlockedCompareExchange
GetStringTypeA
HeapDestroy
SetLastError
GetCPInfo
LocalAlloc
GetTempPathW
lstrcmpiW
IsDBCSLeadByte
GetCommandLineA
VirtualProtectEx
DeleteFileW
WritePrivateProfileStringW
GetFileTime
RtlUnwind
CreateFileA
SetThreadPriority
GetSystemTimeAsFileTime
CreateDirectoryW
MulDiv
GetLocaleInfoA
DelayLoadFailureHook
CreateEventA
LoadLibraryA
GetWindowsDirectoryW
SetFilePointer
GetCurrentProcessId
DeleteCriticalSection
VerSetConditionMask
DebugBreak
SetStdHandle
GetDateFormatW
ReleaseSemaphore
CreateMutexW
SuspendThread
SystemTimeToFileTime
CreateFileW
FreeEnvironmentStringsA
QueryPerformanceCounter
LeaveCriticalSection
FreeLibraryAndExitThread
GetLocaleInfoW
lstrcpyW
lstrcatW
UnmapViewOfFile
LockResource
HeapCreate
ResetEvent
LoadLibraryExW
SetConsoleMode
GetProcAddress
WaitForSingleObject
ExitThread
SetUnhandledExceptionFilter
GetConsoleMode
GetVersionExA
CreateThread
HeapFree
SetEvent
GetModuleHandleA
IsProcessorFeaturePresent
GetFileSize
GetModuleHandleW
ResumeThread
GetStdHandle
WideCharToMultiByte
ExitProcess
lstrlenA
OpenFileMappingW
VirtualProtect
GetModuleFileNameW
GetVersionExW
GetPrivateProfileStringW
LoadLibraryW
GetFileType

mpr

WNetAddConnection2W
WNetCancelConnection2W
WNetGetLastErrorW

msvcp60

?_Xlen@std@@YAXXZ
?_Xran@std@@YAXXZ

msvcrt

srand
__winitenv
exit
_amsg_exit
?terminate@@YAXXZ
mbstowcs
calloc
_strnicmp
wcslen
wcstod
_iob
wcscat
wcstol
_finite
_errno
__set_app_type
floor
_vsnprintf
_wcsdup
realloc
free
fprintf
rand
wcstombs
_onexit
memset
wcspbrk
wcscpy
malloc
_exit
_vsnwprintf
_wcsicmp
_wtoi
_wcsnicmp
swprintf
_stricmp
wcschr
towlower
__dllonexit
_wcsnset
__wgetmainargs
_c_exit
__CxxFrameHandler
vswprintf
time
wcsstr
_XcptFilter
wcsncmp
_cexit
__setusermatherr
_ltow
_controlfp
strtok
_CxxThrowException
memcpy
iswdigit
localtime
_initterm
wcstok
_wsetlocale
_purecall
fflush
isdigit

netapi32

NetServerGetInfo
NetApiBufferFree

ntdll

RtlUnwind
NtQuerySystemInformation

ole32

CoMarshalInterThreadInterfaceInStream
CoInitializeSecurity
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoInitialize
CoRevertToSelf
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoImpersonateClient
ReleaseStgMedium
CoTaskMemFree

rpcrt4

NdrDllUnregisterProxy
NdrOleFree
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
IUnknown_QueryInterface_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Disconnect
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleAllocate
CStdStubBuffer_CountRefs
CStdStubBuffer_Invoke
IUnknown_Release_Proxy
NdrDllRegisterProxy
CStdStubBuffer_Connect

rtutils

TracePrintfA
TraceDeregisterW
TraceRegisterExW

secur32

GetUserNameExW

setupapi

CM_Disconnect_Machine
CM_Locate_DevNode_ExW
CM_Open_DevNode_Key_Ex
CM_Locate_DevNodeW
CM_Get_Sibling_Ex
pSetupGuidFromString
SetupDiGetClassImageList
CM_Get_Parent_Ex
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_ID_ExW
CM_Request_Device_Eject_ExW
CM_Get_DevNode_Registry_PropertyW
SetupDiGetClassImageIndex
CM_Get_DevNode_Status_Ex
SetupDiDestroyClassImageList
CM_Connect_MachineW
CM_Get_Device_ID_List_Size_ExW
CMP_GetBlockedDriverInfo
CM_Is_Dock_Station_Present
CM_Get_Device_Interface_ListW
CM_Get_DevNode_Registry_Property_ExW
CM_Get_Class_Name_ExW
CM_Get_Child_Ex
CM_Get_Device_ID_List_ExW

shell32

SHGetFolderPathW
ShellExecuteW
SHGetFileInfoW
SHBindToParent
Shell_NotifyIconW
SHGetPathFromIDListW
SHGetDesktopFolder

shlwapi

StrToIntW
PathFileExistsW
StrChrW
wnsprintfW
StrCmpNW
StrRetToBufW

urlmon

CoInternetParseUrl
URLOpenBlockingStreamW

user32

DestroyMenu
RegisterClipboardFormatW
CharNextA
CreatePopupMenu
MessageBoxW
IsWindow
GetAsyncKeyState
SetWindowTextW
DrawFocusRect
DrawTextW
CharUpperA
LoadImageA
EnableWindow
SendMessageW
DestroyIcon
TranslateMessage
GetMonitorInfoW
CreateDialogParamW
ScreenToClient
MapWindowPoints
GetUpdateRect
SetWindowPos
SetFocus
InvalidateRect
CallNextHookEx
IsWindowEnabled
GetDlgItemTextW
SetCursor
DeferWindowPos
GetClassNameW
IsWindowUnicode
DrawTextExW
FillRect
GetDlgCtrlID
GetSysColor
GetClientRect
CharPrevW
SetRectEmpty
UnhookWindowsHookEx
UpdateWindow
SetRect
ShowWindow
DestroyWindow
EndPaint
CheckDlgButton
wsprintfW
GetIconInfo
LoadStringA
wsprintfA
WinHelpA
WinHelpW
PostMessageW
GetWindowLongW
BeginPaint
CharUpperW
PostQuitMessage
SetWindowsHookExW
CopyRect
LoadMenuW
RegisterClassW
GetClassLongW
DrawIconEx
EndDialog
GetMessagePos
wvsprintfA
InflateRect
MoveWindow
IsRectEmpty
CharNextW
BeginDeferWindowPos
DispatchMessageW
wvsprintfW
EndDeferWindowPos
TrackPopupMenu
RegisterWindowMessageW
LoadImageW
RedrawWindow
SetWindowLongA
SetDlgItemTextW
GetUserObjectInformationA
CharLowerW
GetThreadDesktop
FindWindowExW
GetMessageW
GetWindowTextW
SendDlgItemMessageW
DefWindowProcW
SendMessageA
OffsetRect
SetWindowLongW
EnumChildWindows
SetWindowTextA
ClientToScreen
GetDC
GetDlgItemInt
GetParent
GetWindowLongA
LoadStringW
CharPrevA
GetWindowRect
AppendMenuW
PostThreadMessageW
LoadIconW
UnregisterClassW
IsDialogMessageW
CreateWindowExW
FindWindowW
IsDlgButtonChecked
GetWindowTextLengthW
GetSystemMetrics
GetWindow
SystemParametersInfoW
DialogBoxParamW
SetDlgItemInt
SetTimer
MonitorFromWindow
MsgWaitForMultipleObjects
KillTimer
LoadCursorW
ReleaseDC
RegisterClassExW

version

GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoSizeW
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoA

winmm

timeEndPeriod
CloseDriver
timeSetEvent
timeGetTime
timeKillEvent
timeBeginPeriod
SendDriverMessage
OpenDriver
DriverCallback

winspool.drv

ClosePrinter
EnumPrintersW
DeviceCapabilitiesW
OpenPrinterW
DocumentPropertiesW
GetPrinterW

ws2_32

WSASocketW

Exports

Exports

CGDCtPIX
BcaoIq
uBtcn
fykiBTgjc

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 241KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47cd0a369d779933e1b94f9cb8489b3c

Code Sign

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

comctl32

gdi32

iphlpapi

kernel32

mpr

msvcp60

msvcrt

netapi32

ntdll

ole32

rpcrt4

rtutils

secur32

setupapi

shell32

shlwapi

urlmon

user32

version

winmm

winspool.drv

ws2_32

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 241KB - Virtual size: 241KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 241KB - Virtual size: 241KB

.reloc
Size: 2KB - Virtual size: 2KB