DllRegisterServer
Behavioral task
behavioral1
Sample
dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a.dll
Resource
win7-en-20211208
General
-
Target
dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a
-
Size
187KB
-
MD5
133b1861b3590bf00308509227f82872
-
SHA1
eb6f12759da7aa84077143e3e2694b6fda3d5631
-
SHA256
dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a
-
SHA512
f541c46522cd6aaf52983fd8f28798550416aedd984b9de139521e89094db06a112add90079dec18b0eb0f90a556451d820bde8081af8eee6f676a0f6a260b34
-
SSDEEP
3072:O8mB2nsJqJ5HPF0ld+Y07jvOdhw1qw7Q6xqazzEuE5FHX4paSq0Dx1CP9MOoMuo:OnidJ5t0l/+vOU7Q6xNzTE5FINRx1CP
Malware Config
Extracted
zloader
miguel
20/04
https://dcaiqjgnbt.icu/wp-config.php
https://nmttxggtb.press/wp-config.php
-
build_id
165
Signatures
-
Zloader family
Files
-
dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a.dll regsvr32 windows x86
fb137f28693ffcbb13d636260b46a068
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CompareFileTime
CompareStringW
CreateEventW
CreateFileW
DeleteCriticalSection
EnterCriticalSection
EnumSystemLocalesW
ExitThread
ExpandEnvironmentStringsW
FileTimeToSystemTime
FlushFileBuffers
FormatMessageW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetFileType
GetLastError
GetLocalTime
GetModuleHandleW
GetOEMCP
GetProcAddress
GetStdHandle
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTimeFormatW
GetUserDefaultLCID
GetUserDefaultLangID
GetVersion
HeapAlloc
HeapCreate
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LocalAlloc
LocalFree
MultiByteToWideChar
ReadFile
SetEndOfFile
SetFilePointer
SetHandleCount
SetStdHandle
WriteFile
lstrcmpiW
advapi32
GetTokenInformation
shlwapi
PathAddBackslashW
shell32
CommandLineToArgvW
user32
CallWindowProcW
CharNextA
CheckMenuItem
CheckMenuRadioItem
ClientToScreen
CopyRect
CreatePopupMenu
DefWindowProcW
DestroyIcon
DestroyWindow
DialogBoxIndirectParamW
DialogBoxParamW
DispatchMessageW
DrawIconEx
DrawMenuBar
DrawTextW
EnableMenuItem
EnableWindow
EndDialog
FillRect
GetClassNameW
GetClientRect
GetDlgItem
GetDlgItemInt
GetFocus
GetMenuState
GetMessageA
GetMessageW
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
InflateRect
InsertMenuItemW
InsertMenuW
IntersectRect
InvalidateRect
IsDialogMessageW
IsDlgButtonChecked
IsIconic
IsWindowEnabled
IsZoomed
KillTimer
LoadAcceleratorsW
LoadCursorW
LoadIconA
LoadMenuA
LoadStringW
MapWindowPoints
MessageBeep
MessageBoxW
MoveWindow
RedrawWindow
RegisterClassExW
ReleaseCapture
ReleaseDC
RemoveMenu
ScreenToClient
SendDlgItemMessageW
SetCapture
SetCursor
SetFocus
SetMenuItemInfoW
SetPropW
SetWindowPlacement
SetWindowPos
SetWindowTextW
ShowWindow
TrackPopupMenu
TranslateAcceleratorW
TranslateMessage
gdi32
CombineRgn
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectW
CreatePatternBrush
DeleteDC
DeleteObject
EndDoc
EndPage
EqualRgn
ExtCreatePen
GetBkColor
GetDeviceCaps
GetObjectA
GetObjectW
GetRgnBox
GetStockObject
GetTextExtentPoint32W
GetTextExtentPointW
GetTextMetricsA
GetTextMetricsW
LineTo
MoveToEx
SelectObject
SetBkColor
SetRectRgn
StartPage
ole32
CoCreateInstance
Exports
Exports
Sections
.text Size: 171KB - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ