General

Malware Config

Signatures

Files

• b3cb381f114ec9c163335509a217bbe1c6baa8d2cf5655b5ff84fd8d0a28dc9a

  .dll windows x86

  a08dce0026507dbbea3298c97e8be273

  
  

  Code Sign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  CheckTokenMembership

  LookupPrivilegeValueW

  MD5Final

  RegEnumKeyW

  CloseServiceHandle

  SetThreadToken

  ImpersonateLoggedOnUser

  OpenServiceW

  CryptGetProvParam

  BuildExplicitAccessWithNameW

  BuildTrusteeWithObjectsAndSidW

  RegDeleteValueW

  LsaEnumerateAccountRights

  GetTokenInformation

  RegisterEventSourceW

  SetServiceStatus

  LsaGetUserName

  GetSecurityInfo

  ConvertSidToStringSidW

  LookupAccountSidW

  RegEnumKeyExA

  QueryServiceStatus

  SetEntriesInAclW

  ConvertStringSecurityDescriptorToSecurityDescriptorA

  GetSidIdentifierAuthority

  RegOpenKeyA

  CryptImportKey

  LsaNtStatusToWinError

  SetSecurityDescriptorDacl

  LsaFreeMemory

  QueryServiceConfigW

  RegDeleteKeyA

  MD5Init

  RegSetValueExW

  SetSecurityDescriptorOwner

  DeregisterEventSource

  CryptGetUserKey

  CopySid

  RegDeleteValueA

  CreateProcessAsUserW

  RegQueryValueExW

  AdjustTokenPrivileges

  NotifyBootConfigStatus

  GetLengthSid

  GetSidSubAuthorityCount

  LsaQueryInformationPolicy

  RegDeleteKeyW

  RegisterServiceCtrlHandlerExW

  InitializeSecurityDescriptor

  IsValidSid

  RegSetValueExA

  LookupAccountNameW

  GetUserNameW

  SetTokenInformation

  InitializeAcl

  RegEnumValueW

  RevertToSelf

  RegCreateKeyExW

  LsaClose

  ReportEventW

  AllocateAndInitializeSid

  RegQueryValueExA

  RegCloseKey

  StartServiceW

  RegUnLoadKeyA

  LsaOpenPolicy

  GetSidSubAuthority

  RegCreateKeyW

  MD5Update

  RegEnumKeyExW

  DuplicateToken

  CryptGenKey

  GetSidLengthRequired

  LsaStorePrivateData

  DuplicateTokenEx

  OpenSCManagerW

  OpenThreadToken

  LsaRetrievePrivateData

  OpenEventLogW

  OpenProcessToken

  CryptAcquireContextA

  FreeSid

  CryptDestroyKey

  GetEventLogInformation

  RegOpenKeyExW

  RegOpenKeyW

  ControlService

  SetSecurityInfo

  LogonUserW

  RegOpenKeyExA

  GetAce

  AddAccessAllowedAceEx

  IsValidSecurityDescriptor

  RegQueryInfoKeyW

  AddAccessAllowedAce

  CryptReleaseContext

  RegCreateKeyA

  GetSecurityDescriptorDacl

  CloseEventLog

  RegCreateKeyExA

  EqualSid

  comctl32

  _TrackMouseEvent

  ImageList_GetIcon

  CreatePropertySheetPageW

  ImageList_SetBkColor

  InitCommonControlsEx

  ImageList_Draw

  ImageList_GetImageInfo

  ImageList_ReplaceIcon

  ImageList_GetBkColor

  crypt32

  CertStrToNameW

  CertOpenStore

  CertAddEncodedCertificateToStore

  CertSetCertificateContextProperty

  CryptExportPublicKeyInfo

  CryptAcquireContextU

  CertFreeCertificateContext

  CryptSignAndEncodeCertificate

  CertComparePublicKeyInfo

  CertGetCertificateContextProperty

  CryptDecodeObject

  CertCreateCertificateContext

  CertDeleteCertificateFromStore

  CertEnumCertificatesInStore

  CertCloseStore

  CryptEncodeObject

  gdi32

  GetTextMetricsW

  CreatePalette

  SetBkMode

  GetTextMetricsA

  MoveToEx

  PtVisible

  CreateRectRgnIndirect

  GetStockObject

  RoundRect

  GetLayout

  Rectangle

  BitBlt

  GetObjectA

  GetTextExtentPoint32W

  SetLayout

  GetBkMode

  SetTextColor

  FloodFill

  SetBkColor

  CreatePen

  PatBlt

  GetTextColor

  GetObjectW

  RectVisible

  CreateFontW

  SetBoundsRect

  GetCurrentObject

  ExtTextOutW

  RealizePalette

  GetDeviceCaps

  GetCharacterPlacementA

  DeleteDC

  CreateCompatibleDC

  CreateSolidBrush

  CreateRectRgn

  ExtTextOutA

  UpdateColors

  PlgBlt

  GetFontLanguageInfo

  TextOutW

  SetMapMode

  GetGlyphOutlineA

  DeleteObject

  Escape

  CreateFontIndirectW

  CreateCompatibleBitmap

  SetPixel

  SelectObject

  Polygon

  GetTextExtentPointW

  SetTextAlign

  CreateFontIndirectA

  CreatePatternBrush

  SelectPalette

  GetCharacterPlacementW

  GetDIBColorTable

  SetStretchBltMode

  CreateDIBSection

  CreateRoundRectRgn

  TranslateCharsetInfo

  GetPixel

  StretchBlt

  CreateBitmap

  GetBkColor

  imm32

  ImmDisableIME

  iphlpapi

  NotifyAddrChange

  kernel32

  GetModuleFileNameW

  GetTempPathA

  GetTickCount

  CreateFileA

  FindResourceExW

  UnmapViewOfFile

  GetModuleHandleA

  GetDriveTypeA

  GetFileAttributesA

  EnumUILanguagesW

  IsProcessorFeaturePresent

  GetStringTypeW

  Sleep

  VirtualAlloc

  GetFileTime

  GetCurrentThreadId

  SetLocalTime

  VirtualProtectEx

  VirtualFreeEx

  IsBadReadPtr

  FormatMessageW

  UnhandledExceptionFilter

  GetNumberFormatW

  GetShortPathNameW

  SetFilePointer

  OpenMutexW

  QueueUserWorkItem

  GetStringTypeA

  FileTimeToSystemTime

  CreateThread

  SetEvent

  CreateSemaphoreA

  TlsGetValue

  GetEnvironmentStrings

  ExitThread

  GetEnvironmentVariableA

  ExpandEnvironmentStringsW

  GetOEMCP

  SetInformationJobObject

  WideCharToMultiByte

  DeviceIoControl

  PulseEvent

  GetEnvironmentVariableW

  SetUnhandledExceptionFilter

  ResetEvent

  GetDateFormatW

  GetCPInfo

  SetFileTime

  IsDebuggerPresent

  GetFileType

  HeapDestroy

  InterlockedCompareExchange

  GetFullPathNameA

  CompareFileTime

  GetEnvironmentStringsW

  GlobalHandle

  GetExitCodeThread

  SetHandleCount

  FindResourceA

  OpenProfileUserMapping

  FindClose

  VerSetConditionMask

  GetQueuedCompletionStatus

  HeapFree

  GetTempFileNameA

  LoadLibraryExA

  WaitForMultipleObjects

  SetTimeZoneInformation

  GetProcAddress

  InitializeCriticalSectionAndSpinCount

  DelayLoadFailureHook

  TlsFree

  GlobalAlloc

  GetComputerNameW

  GetCurrentProcess

  PostQueuedCompletionStatus

  ResumeThread

  GetFileAttributesW

  GetVersionExA

  OutputDebugStringW

  FindNextFileA

  GetProcessAffinityMask

  lstrlenW

  lstrcatA

  FatalAppExitA

  CreateDirectoryA

  GetProfileIntW

  MulDiv

  CreateFileW

  GetTimeFormatW

  lstrcpyA

  IsBadCodePtr

  GetPrivateProfileStringW

  TlsAlloc

  SizeofResource

  LocalFree

  DuplicateHandle

  CreateMutexW

  WaitForSingleObject

  InterlockedExchange

  MoveFileW

  WinExec

  LoadLibraryExW

  AssignProcessToJobObject

  TerminateProcess

  lstrcmpiW

  InterlockedExchangeAdd

  GetCommandLineA

  HeapCreate

  WaitForSingleObjectEx

  GetACP

  GetLocalTime

  FreeResource

  GlobalUnlock

  FindResourceW

  DisconnectNamedPipe

  GetCurrentDirectoryW

  GetStartupInfoA

  GetVersion

  LeaveCriticalSection

  GetStartupInfoW

  GetProfileStringW

  OutputDebugStringA

  GetProcessHeap

  RaiseException

  DeleteCriticalSection

  ReleaseSemaphore

  CreateDirectoryW

  lstrcpynW

  ExpandEnvironmentStringsA

  InterlockedDecrement

  lstrcpyW

  FreeLibrary

  CreateMutexA

  GetModuleFileNameA

  RtlUnwind

  InterlockedIncrement

  TlsSetValue

  WriteProcessMemory

  lstrcpynA

  SetConsoleCtrlHandler

  LoadLibraryA

  GetVolumeInformationW

  FindFirstFileA

  GetCurrentThread

  HeapSize

  lstrcmpiA

  CreateProcessW

  DeleteFileA

  VirtualAllocEx

  LCMapStringW

  GetSystemTimeAsFileTime

  GetLastError

  CloseHandle

  WriteProfileStringW

  QueryPerformanceCounter

  CompareStringW

  CreateJobObjectW

  HeapReAlloc

  QueryInformationJobObject

  SetFileAttributesW

  GetFileSize

  GetLocaleInfoW

  ReadProcessMemory

  lstrcmpW

  CreateEventW

  GetDriveTypeW

  CopyFileW

  SetProcessShutdownParameters

  FreeEnvironmentStringsA

  VerifyVersionInfoW

  LocalAlloc

  SetLastError

  UnregisterWait

  CloseProfileUserMapping

  LocalSize

  OpenThread

  LoadResource

  lstrcatW

  SetErrorMode

  WritePrivateProfileStringW

  WriteFile

  GlobalLock

  HeapAlloc

  SetCurrentDirectoryW

  SystemTimeToFileTime

  GetExitCodeProcess

  MultiByteToWideChar

  GetStdHandle

  DebugBreak

  SetProcessWorkingSetSize

  CreateIoCompletionPort

  GetVersionExW

  CreateEventA

  ReleaseMutex

  DeleteFileW

  GetUserDefaultUILanguage

  GetPrivateProfileIntW

  GetSystemDirectoryW

  VirtualFree

  LoadLibraryW

  SetThreadPriority

  GetFileSizeEx

  VirtualLock

  LockResource

  ExitProcess

  FreeEnvironmentStringsW

  WriteFileEx

  OpenProcess

  DefineDosDeviceW

  GetWindowsDirectoryW

  InitializeCriticalSection

  MapViewOfFile

  CreateProcessA

  RegisterWaitForSingleObject

  GlobalFree

  CreateNamedPipeW

  GetCurrentProcessId

  GetUserDefaultLCID

  FlushViewOfFile

  GetModuleHandleW

  OpenEventW

  EnterCriticalSection

  ConnectNamedPipe

  QueueUserAPC

  TerminateThread

  SetEnvironmentVariableW

  LocalReAlloc

  lstrlenA

  GetBinaryTypeA

  ReadFile

  FreeLibraryAndExitThread

  IsBadWritePtr

  GetSystemTime

  CreateFileMappingA

  GetComputerNameExW

  LCMapStringA

  msvcrt

  _wtoi

  sprintf

  qsort

  _wcsicmp

  wcstoul

  _snprintf

  malloc

  _wcsnicmp

  _strcmpi

  iswpunct

  floor

  _initterm

  _onexit

  __dllonexit

  wcsrchr

  strncpy

  tolower

  _controlfp

  _lock

  memcpy

  _purecall

  _isnan

  wcsncat

  wcscpy

  strtoul

  iswalpha

  _XcptFilter

  _snwprintf

  free

  isdigit

  memmove

  __CxxFrameHandler

  wcslen

  _wtol

  wcsncpy

  _amsg_exit

  _finite

  wcscat

  vsprintf

  atoi

  _strnicmp

  wcspbrk

  _stricmp

  ?terminate@@YAXXZ

  wcsstr

  isupper

  iswdigit

  wcschr

  _wcsdup

  _unlock

  strncmp

  memset

  _vsnwprintf

  wcscmp

  wcstok

  _CxxThrowException

  strtok

  iswspace

  strstr

  _vsnprintf

  netapi32

  NetUserModalsGet

  NetQueryDisplayInformation

  NetUserGetInfo

  NetUserGetLocalGroups

  NetUserChangePassword

  DsEnumerateDomainTrustsW

  I_NetLogonControl2

  DsGetDcNameW

  NetUserEnum

  NetApiBufferFree

  NetMessageNameDel

  ntdll

  RtlAnsiStringToUnicodeString

  NtRequestWaitReplyPort

  RtlAdjustPrivilege

  RtlFreeSid

  RtlEraseUnicodeString

  NtSetInformationProcess

  RtlGetNtProductType

  RtlExpandEnvironmentStrings_U

  NtPowerInformation

  RtlEqualUnicodeString

  RtlGetVersion

  NtDeviceIoControlFile

  RtlInitializeSid

  RtlAddAce

  NtOpenProcessToken

  RtlQueryEnvironmentVariable_U

  RtlLeaveCriticalSection

  NtFilterToken

  RtlCopySid

  RtlTimeToTimeFields

  RtlAddAccessAllowedAce

  NtDuplicateObject

  RtlFreeUnicodeString

  RtlRunDecodeUnicodeString

  RtlCreateSecurityDescriptor

  NtSetInformationThread

  RtlSetDaclSecurityDescriptor

  RtlCreateUnicodeString

  RtlSystemTimeToLocalTime

  RtlAllocateHeap

  NtClose

  RtlDeleteCriticalSection

  NtOpenEvent

  RtlCompareUnicodeString

  RtlInitString

  RtlInitializeCriticalSectionAndSpinCount

  NtQueryInformationProcess

  RtlLengthSid

  RtlAllocateAndInitializeSid

  RtlEnterCriticalSection

  NtShutdownSystem

  NtAllocateLocallyUniqueId

  NtDuplicateToken

  RtlNtStatusToDosError

  RtlEqualSid

  NtOpenFile

  NtQuerySystemInformation

  VerSetConditionMask

  RtlInitializeCriticalSection

  RtlSubAuthoritySid

  NtConnectPort

  RtlInitUnicodeString

  RtlTimeToSecondsSince1980

  NtSetInformationToken

  RtlSetEnvironmentVariable

  RtlCreateAcl

  RtlLengthRequiredSid

  RtlOpenCurrentUser

  RtlConvertSidToUnicodeString

  RtlRunEncodeUnicodeString

  NtQueryInformationToken

  DbgPrintEx

  ole32

  CoTaskMemAlloc

  CoCreateInstance

  CreateStreamOnHGlobal

  CoInitializeEx

  CoUninitialize

  CoCreateGuid

  CoTaskMemFree

  rasapi32

  RasConnectionNotificationW

  rpcrt4

  RpcBindingFree

  UuidFromStringW

  RpcBindingFromStringBindingW

  NdrClientCall2

  RpcStringFreeW

  RpcStringBindingComposeW

  RpcEpResolveBinding

  setupapi

  SetupDiEnumDeviceInterfaces

  SetupDiDestroyDeviceInfoList

  SetupDiGetDeviceInterfaceDetailW

  SetupDiGetClassDevsW

  SetupGetIntField

  SetupFindFirstLineW

  shell32

  ShellExecuteExW

  SHGetSpecialFolderPathW

  SHGetFileInfoW

  shlwapi

  PathIsRelativeA

  SHCreateShellPalette

  StrStrIW

  tapi32

  lineNegotiateAPIVersion

  lineGetCountryW

  lineGetDevCapsW

  lineShutdown

  lineInitializeExW

  user32

  GetKeyState

  CharNextA

  GetCapture

  SetForegroundWindow

  DrawFocusRect

  PtInRect

  WinHelpW

  GetMessageA

  EnableMenuItem

  IsWindow

  ReleaseDC

  CreateDialogParamW

  GetWindowTextW

  DialogBoxParamW

  SetCursor

  ReasonCodeNeedsBugID

  TrackMouseEvent

  OpenDesktopW

  LoadIconA

  GetWindowLongW

  LoadCursorW

  TabbedTextOutW

  GetAsyncKeyState

  TranslateAcceleratorW

  SetDlgItemTextW

  SendDlgItemMessageW

  SetThreadDesktop

  SystemParametersInfoW

  SetWindowRgn

  GetFocus

  GetKeyboardLayout

  RegisterWindowMessageW

  UpdateWindow

  SetWindowLongW

  DrawTextExW

  GetWindowRect

  DestroyIcon

  UnregisterDeviceNotification

  CloseDesktop

  GetDesktopWindow

  MapWindowPoints

  GrayStringW

  GetIconInfo

  DrawIconEx

  IsWindowVisible

  wsprintfW

  GetLastActivePopup

  RegisterClassExA

  SetWindowPos

  TranslateMessage

  DestroyWindow

  DestroyReasons

  BringWindowToTop

  GetDlgCtrlID

  GetWindowLongA

  IsDialogMessageW

  DefWindowProcA

  PostMessageA

  SendMessageTimeoutW

  BeginPaint

  GetDC

  MessageBeep

  SetRectEmpty

  AllowSetForegroundWindow

  LoadStringA

  GetSystemMenu

  CharNextW

  GetWindowThreadProcessId

  SetTimer

  CreateWindowExW

  RedrawWindow

  GetThreadDesktop

  EnableWindow

  IsRectEmpty

  DrawEdge

  GetSystemMetrics

  IsChild

  IsWindowEnabled

  GetWindow

  MsgWaitForMultipleObjectsEx

  SetWindowTextW

  KillTimer

  PostThreadMessageA

  GetNextDlgTabItem

  DrawStateW

  PostQuitMessage

  InvertRect

  GetKeyboardLayoutList

  SetScrollPos

  SetRect

  DispatchMessageA

  GetDlgItemTextW

  DefWindowProcW

  BuildReasonArray

  HideCaret

  EndDialog

  ShowWindow

  GetClientRect

  GetSysColor

  EndPaint

  InflateRect

  FindWindowW

  SetFocus

  InvalidateRect

  SendMessageW

  ReleaseCapture

  GetActiveWindow

  LoadImageW

  MoveWindow

  SendMessageA

  RecordShutdownReason

  SetCapture

  EnumWindows

  DisplayExitWindowsWarnings

  CharUpperA

  CreateWindowExA

  LoadIconW

  LoadStringW

  RegisterDeviceNotificationW

  DeleteMenu

  FrameRect

  MessageBoxW

  OpenInputDesktop

  CheckDlgButton

  RegisterClassExW

  SwitchDesktop

  wsprintfA

  GetForegroundWindow

  ScreenToClient

  IntersectRect

  DispatchMessageW

  OffsetRect

  GetWindowTextLengthW

  CheckRadioButton

  EqualRect

  ReasonCodeNeedsComment

  GetParent

  PostMessageW

  ClipCursor

  RegisterWindowMessageA

  MsgWaitForMultipleObjects

  CopyRect

  DrawTextW

  GetCursorPos

  FillRect

  IsDlgButtonChecked

  UnregisterClassW

  GetUserObjectInformationW

  CreateIconIndirect

  userenv

  GetUserProfileDirectoryW

  GetNextFgPolicyRefreshInfo

  RefreshPolicy

  version

  VerQueryValueW

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  winsta

  WinStationGetTermSrvCountersValue

  WinStationQueryInformationW

  _WinStationUpdateClientCachedCredentials

  WinStationDisconnect

  WinStationCloseServer

  WinStationOpenServerW

  WinStationConnectW

  WinStationIsHelpAssistantSession

  WinStationEnumerateW

  WinStationFreeMemory

  WinStationRegisterConsoleNotification

  WinStationUnRegisterConsoleNotification

  ws2_32

  WSAAddressToStringA

  getaddrinfo

  freeaddrinfo

  Exports

  Exports

  kiIPdHfESFw

  ErmQQkdaNNu

  IfOeCBmu

  HVKqKxs

  iJiyG

  ktefTe

  xcXVQsADLg

  wmqc

  ppHgoJQ

  ntXlQlMvu

  IrwUjs

  rUWvT

  rWABjJPfypD

  Dnnbwi

  pUbQuNKMgT

  iVmwyOsxjK

  qnqShwOWcw

  Sections

  .text

  Size: 42KB - Virtual size: 67KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 207KB - Virtual size: 207KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ