matanbuchus | a789b89f0da4794a2299e49e6dc1c1bf9d6790bcc9e1bb9cc87e77116715e7af

Resubmissions

04/08/2022, 15:52

220804-ta325shfap

24/05/2022, 17:22

220524-vxll2sbac210

Sharing

Copy URL Twitter E-mail

General

Target
a789b89f0da4794a2299e49e6dc1c1bf9d6790bcc9e1bb9cc87e77116715e7af
Size 972KB
Sample220524-vxll2sbac2
SHA256 a789b89f0da4794a2299e49e6dc1c1bf9d6790bcc9e1bb9cc87e77116715e7af
MD5 ac7d3097d9eb62d00766bb5414e21d92
SHA1 aee97872aa6f88225ba12d01cc0e426b89a688ec
SHA512 f610cba495a34a66753e50c89fa62801b54416a126d3a154fb970b383592838bfc0f451c89d69c4c8aaf3fde54332cf0cd8d480b41d68a9daf7c1bf5f231c2ed
SSDEEP 24576:n/9WGtBFV4aFt7u70p71YF73bPI4yXhecIWqHcI0FbbJgxkWo:nntJ42t80y73bJy8cIWq+FbbJIo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

matanbuchus

Malware Config

Signatures

Matanbuchus family
matanbuchus

File Explorer

a789b89f0da4794a2299e49e6dc1c1bf9d6790bcc9e1bb9cc87e77116715e7af

.cab 972KB
lib1

.dll 394KB
lib2

.dll 787KB
lib3

101KB
main

.dll 990KB

a789b89f0da4794a2299e49e6dc1c1bf9d6790bcc9e1bb9cc87e77116715e7af

SHA256 a789b89f0da4794a2299e49e6dc1c1bf9d6790bcc9e1bb9cc87e77116715e7af
MD5 ac7d3097d9eb62d00766bb5414e21d92
SHA1 aee97872aa6f88225ba12d01cc0e426b89a688ec
SHA512 f610cba495a34a66753e50c89fa62801b54416a126d3a154fb970b383592838bfc0f451c89d69c4c8aaf3fde54332cf0cd8d480b41d68a9daf7c1bf5f231c2ed
SSDEEP 24576:n/9WGtBFV4aFt7u70p71YF73bPI4yXhecIWqHcI0FbbJgxkWo:nntJ42t80y73bJy8cIWq+FbbJIo
MD5 SHA1 SHA512 SSDEEP

lib1

IMPHASH 14f1f87964e32217f3ffa025ed4b902c
SHA256 e79f95d218aacbdcb35c4a843d999f8a642111fae72f7f20534c36a339580db0
MD5 00d8bba1b87c9ad7a19e843f17bd0398
SHA1 a1c70baaf38dc9641b7feb211d8cbedeae1f1908
SHA512 8513c2f0ccf88977cb1ea8ad2f97d5d73eb25ecc3fe061f56aa80a76fe4dd29e47601960007bc5fdc40a26225d260846443246e0a489f9fccb40d34291389ff7
SSDEEP 12288:0eBq0PztVQn24OlnIXHv4kEevjRwHiRJXb1IO4a4e1rF3R4xqffGd3vqAIaRSMOc:3PztVQn2vcv4SqeforS5JK
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

176192

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment _o__initialize_onexit_table _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__register_onexit_function _o__seh_filter_dll _o__wcsicmp memmove _o__wtoi _o__wtoi64 _o_ceil _o_free _o_iswspace _o_malloc _o_memcpy_s _o_realloc _o_terminate _o_toupper _o_wcscpy_s _o_wmemcpy_s _except_handler4_common _o__execute_onexit_table _o__errno _o__crt_atexit _o__configure_narrow_argv _o__cexit _o___stdio_common_vswprintf_s _o___stdio_common_vswprintf _o___stdio_common_vsprintf _o___stdio_common_vsnprintf_s _o___std_type_info_destroy_list _o___std_exception_destroy _o___std_exception_copy wcschr __std_terminate __CxxFrameHandler3 _CxxThrowException memcmp memcpy

api-ms-win-crt-string-l1-1-0

wcsnlen memset wcsncmp

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW GetModuleHandleExW GetProcAddress GetModuleFileNameW GetModuleFileNameA FreeLibrary GetModuleHandleW DisableThreadLibraryCalls

api-ms-win-core-heap-l1-1-0

HeapReAlloc GetProcessHeap HeapFree HeapAlloc

api-ms-win-core-processthreads-l1-1-0

TlsSetValue GetCurrentThreadId TerminateThread SuspendThread OpenThread TerminateProcess GetCurrentProcess GetThreadId OpenProcessToken InitializeProcThreadAttributeList GetExitCodeProcess ResumeThread UpdateProcThreadAttribute CreateThread CreateProcessW OpenThreadToken CreateProcessAsUserW TlsGetValue TlsFree TlsAlloc DeleteProcThreadAttributeList GetCurrentProcessId GetCurrentThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent DebugBreak

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore InitializeCriticalSectionEx ReleaseMutex EnterCriticalSection AcquireSRWLockExclusive TryEnterCriticalSection AcquireSRWLockShared ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx DeleteCriticalSection InitializeSRWLock LeaveCriticalSection WaitForSingleObject OpenEventW CreateEventW SetEvent TryAcquireSRWLockExclusive CreateSemaphoreExW CreateMutexExW CreateEventExW OpenSemaphoreW InitializeCriticalSection ResetEvent

userenv

GetAppContainerRegistryLocation CreateAppContainerProfile DeriveAppContainerSidFromAppContainerName

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

api-ms-win-core-errorhandling-l1-1-0

GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter RaiseException SetLastError

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-security-base-l1-1-0

GetSidIdentifierAuthority DeleteAce AddAccessAllowedAceEx GetSidSubAuthorityCount DuplicateTokenEx SetTokenInformation GetSidSubAuthority GetTokenInformation InitializeSid GetSidLengthRequired CopySid GetLengthSid GetSecurityDescriptorSacl GetAce EqualSid SetSecurityDescriptorSacl FreeSid IsValidSid InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl AllocateAndInitializeSid AddMandatoryAce SetKernelObjectSecurity GetKernelObjectSecurity InitializeAcl AddAce

api-ms-win-eventing-provider-l1-1-0

EventSetInformation EventUnregister EventRegister EventProviderEnabled EventWriteTransfer

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-atoms-l1-1-0

FindAtomW DeleteAtom AddAtomW

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-processthreads-l1-1-1

OpenProcess GetThreadContext IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64 GetTickCount GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetVersionExA

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW QISearch StrCmpICW

api-ms-win-core-com-l1-1-0

CoImpersonateClient CoTaskMemAlloc CoTaskMemFree CoInitializeEx CoGetApartmentType CoInitializeSecurity CoWaitForMultipleHandles CoCreateFreeThreadedMarshaler StringFromGUID2 CoCreateInstance CoUninitialize CoReleaseMarshalData CoGetInterfaceAndReleaseStream CreateStreamOnHGlobal CoGetMarshalSizeMax CoUnmarshalInterface CoMarshalInterface CoRevertToSelf

api-ms-win-core-file-l1-1-0

FindFirstFileExW FindNextFileW FindClose

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString WindowsCreateString WindowsDeleteString WindowsCreateStringReference WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoActivateInstance RoGetActivationFactory

api-ms-win-core-memory-l1-1-0

MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW VirtualQuery MapViewOfFileEx

api-ms-win-core-namespace-l1-1-0

AddSIDToBoundaryDescriptor CreatePrivateNamespaceW DeleteBoundaryDescriptor CreateBoundaryDescriptorW ClosePrivateNamespace OpenPrivateNamespaceW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize InitOnceComplete Sleep InitOnceExecuteOnce

api-ms-win-core-job-l1-1-0

IsProcessInJob

api-ms-win-core-job-l2-1-0

AssignProcessToJobObject SetInformationJobObject CreateJobObjectW

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject UnregisterWait

ntdll

RtlQueryTokenHostIdAsUlong64 RtlReportExceptionEx RtlQueryPackageClaims RtlImageDirectoryEntryToData NtQueryVirtualMemory RtlGetSuiteMask NtQuerySystemInformation

api-ms-win-core-windowserrorreporting-l1-1-0

WerUnregisterMemoryBlock WerRegisterMemoryBlock

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo RoTransformError RoOriginateErrorW GetRestrictedErrorInfo RoOriginateError

api-ms-win-core-com-private-l1-1-0

CoGetErrorInfo CoSetErrorInfo

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-security-base-l1-2-0

CheckTokenCapability

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem UnregisterWaitEx

oleaut32

SafeArrayCreate SysAllocString SafeArrayUnlock SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim VariantCopyInd VariantClear SysAllocStringByteLen

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo IsErrorPropagationEnabled RoReportFailedDelegate

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask SHTaskPoolAllowThreadReuse

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegGetValueW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegCloseKey

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW Process32NextW CreateToolhelp32Snapshot

wintrust

WTGetSignatureInfo

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

Name

.text

Size

360KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

lib2

IMPHASH 2df2d8e7248cf7b1ef44002b7b574de4
SHA256 478e529502c02404206e62f2b4f7be100b3cfaa0b87fc3da92e2aead56807a99
MD5 0155faf1c0c82f1ccc5d4e0e37c08358
SHA1 4f3088c636f78bc4130099a7225d8697438e2da2
SHA512 333aa010cc1b2aba3a8b58cda93608ce609d64bde5d4bf4ea9f618e8cddf988f5423aca0db7e9f812e92afcdd445c0ce48733a8569fd6d308adce5dd3796c64b
SSDEEP 24576:/4MWy40w4cqRQuH1cuYtMJfL70orGrXD:wMW8w4cqR2tMJfMtT
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x86

Minor OS version

Major OS version

Entry point

131952

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcp_win

??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z ?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z ?uncaught_exception@std@@YA_NXZ ?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ ?width@ios_base@std@@QAE_J_J@Z ?id@?$ctype@G@std@@2V0locale@2@A ?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z ?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ ?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z ?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ ?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ ??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z ??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z ?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A ?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?width@ios_base@std@@QBE_JXZ ?flags@ios_base@std@@QBEHXZ ?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?good@ios_base@std@@QBE_NXZ ?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?widen@?$ctype@G@std@@QBEGD@Z ??Bid@locale@std@@QAEIXZ ??1_Lockit@std@@QAE@XZ ?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UAEXXZ ?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ??0_Lockit@std@@QAE@H@Z ??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ ?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ ?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ ?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ ??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z ?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ ?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ ?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z ?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z ?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z ?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ ?_Xinvalid_argument@std@@YAXPBD@Z ?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z ?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ

api-ms-win-crt-string-l1-1-0

memset wcspbrk

api-ms-win-crt-math-l1-1-0

_finite

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment _o__initialize_onexit_table _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__itow_s _o__ltow_s _o__purecall _o__recalloc _o__register_onexit_function _o__seh_filter_dll memmove _o__wtof _o__wtol _o_ceil _o_floor _o_free _o_isalpha _o_isdigit _o_isxdigit _o_malloc _o_realloc _o_strtol _o_terminate _o_toupper _o_wcscat_s _o_wcscpy_s _o_wcsncpy_s _o_wcstod _o_wcstok_s _o_wcstol _o_wmemcpy_s wcschr wcsstr _except_handler4_common _CxxThrowException memcpy _o___stdio_common_vswprintf_s _o___stdio_common_vswprintf _o___stdio_common_vsnprintf_s _o___std_type_info_destroy_list _o___std_exception_destroy _o___std_exception_copy _o__crt_atexit _o__configure_narrow_argv __std_terminate __CxxFrameHandler3 _o__execute_onexit_table _o__errno _o__cexit memcmp _o__callnewh

dcomp

ord1038

iertutil

ord594 ord650 ord870 ord902 ord597 ord398 ord305 ord799 ord797 ord301 ord791 ord795 ord793 ord140 ord300 ord144 ord792 ord794 CreateUri

urlmon

CoInternetCombineUrl UrlMkGetSessionOption

api-ms-win-core-localregistry-l1-1-0

RegDeleteValueW RegSetValueExW RegGetValueW RegCloseKey RegQueryInfoKeyW RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-rtcore-ntuser-window-l1-1-0

PostThreadMessageW DefWindowProcW GetWindowLongW DestroyWindow PostMessageW GetMessageW PostQuitMessage RegisterWindowMessageW SetWindowLongW GetWindowThreadProcessId CreateWindowExW RegisterClassExW SendMessageW IsWindow RemovePropW SetPropW DispatchMessageW TranslateMessage SendMessageTimeoutW PeekMessageW

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentApplicationUserModelId GetCurrentPackageFamilyName

oleaut32

SysFreeString LoadTypeLi SafeArrayAccessData RegisterTypeLi SafeArrayUnaccessData VariantInit SafeArrayGetLBound SafeArrayGetUBound BSTR_UserSize BSTR_UserFree UnRegisterTypeLi SysAllocString SysStringLen SafeArrayCreate BSTR_UserUnmarshal SysAllocStringLen VarUI4FromStr BSTR_UserMarshal

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW FreeLibrary GetModuleHandleW FindResourceExW LoadStringW LoadResource GetModuleFileNameW GetModuleHandleExW LockResource SizeofResource GetModuleFileNameA GetProcAddress

api-ms-win-core-synch-l1-2-0

WaitOnAddress Sleep WakeByAddressAll InitOnceExecuteOnce

api-ms-win-core-heap-l1-1-0

HeapFree HeapAlloc HeapSize HeapReAlloc GetProcessHeap HeapDestroy

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsDuplicateString WindowsIsStringEmpty WindowsStringHasEmbeddedNull WindowsCompareStringOrdinal WindowsGetStringRawBuffer WindowsDeleteString WindowsCreateStringReference WindowsGetStringLen

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW InitializeSRWLock SetEvent CreateEventExW WaitForSingleObject WaitForMultipleObjectsEx ReleaseMutex DeleteCriticalSection AcquireSRWLockShared ReleaseSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockExclusive OpenSemaphoreW CreateMutexExW InitializeCriticalSection LeaveCriticalSection InitializeCriticalSectionEx EnterCriticalSection CreateEventW InitializeCriticalSectionAndSpinCount OpenEventW TryEnterCriticalSection ReleaseSemaphore WaitForSingleObjectEx ResetEvent

api-ms-win-eventing-provider-l1-1-0

EventRegister EventSetInformation EventUnregister EventWriteEx EventWriteTransfer EventProviderEnabled

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-processthreads-l1-1-0

TerminateProcess OpenProcessToken GetCurrentProcess GetCurrentThreadId GetCurrentProcessId CreateThread

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

FormatMessageW LCMapStringEx

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError UnhandledExceptionFilter GetLastError RaiseException

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent DebugBreak OutputDebugStringW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount GetTickCount64

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock GlobalSize

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-winrt-l1-1-0

RoActivateInstance RoGetActivationFactory

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW GetEnvironmentVariableW

api-ms-win-core-file-l1-1-0

ReadFile CreateFileW CreateDirectoryW

ntdll

NtQueryInformationProcess RtlNtStatusToDosError ZwQueryWnfStateData

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpCW StrCmpNICW StrCmpICW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-base-l1-2-0

CheckTokenCapability

api-ms-win-security-base-l1-1-0

GetTokenInformation CopySid GetLengthSid

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse SHTaskPoolQueueTask

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW FindResourceW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CreateThreadpoolTimer CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer

api-ms-win-core-namespace-l1-1-0

CreatePrivateNamespaceW ClosePrivateNamespace DeleteBoundaryDescriptor OpenPrivateNamespaceW CreateBoundaryDescriptorW

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Process32NextW Process32FirstW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient6 ObjectStublessClient3 ObjectStublessClient4 ObjectStublessClient7 ObjectStublessClient5

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

shcore

ord230 ord232 ord233 SHCreateMemStream

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

715KB

Virtual Size

715KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

444B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

main

IMPHASH f5873173aed94fc96f286ce8b792b943
SHA256 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2
MD5 e0ecf5e7d2a4656457fabeee2918ef38
SHA1 ca05587d9bd333a62735705ba6b3f919ea7d6d17
SHA512 f2dc88e57feab0dcc8ad36dd313413d4735350343573f6c8721b5cae48a8ceff393dfd9bcf327d9eb4114347ad704de6dbcfffc42aa53876ba0b017011ac9ddc
SSDEEP 12288:gIgN+FmwpyU8PWyHc80gNO9kA5kA5kA5kAxMaskAZpq:gIgyp+WZ8zOtMHA
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x86

Minor OS version

Major OS version

Entry point

41443

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep ExitProcess GetPriorityClass DisableThreadLibraryCalls GlobalFree LocalAlloc LocalReAlloc InitOnceExecuteOnce GetConsoleCP CreateFileW CloseHandle GetStringTypeW SetFilePointerEx SetStdHandle DeleteCriticalSection GetProcessHeap InitializeCriticalSectionEx HeapSize HeapFree HeapReAlloc HeapAlloc GetLastError UnhandledExceptionFilter RaiseException LocalFree DecodePointer GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType GetStdHandle LCMapStringW WriteConsoleW IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess OutputDebugStringW EnterCriticalSection LeaveCriticalSection RtlUnwind InterlockedFlushSList SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleExW GetModuleFileNameW

user32

LoadStringW GetMessageTime DestroyWindow ShowWindow DefWindowProcW

gdi32

CreateFontIndirectW GetStockObject

advapi32

LookupAccountNameW CveEventWrite RevertToSelf IsValidSid IsValidAcl IsTokenRestricted InitializeAcl ImpersonateLoggedOnUser AllocateAndInitializeSid

shell32

SHFileOperationW ExtractIconExW SHSetLocalizedName

ole32

CoTaskMemAlloc CoCancelCall

shlwapi

SHStrDupA SHStrDupW SHGetValueW SHGetThreadRef SHSetValueW

rpcrt4

RpcExceptionFilter UuidCreate

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty WindowsGetStringRawBuffer WindowsCreateString WindowsCreateStringReference

setupapi

SetupCloseInfFile SetupOpenInfFileW SetupOpenAppendInfFileW

version

GetFileVersionInfoSizeW GetFileVersionInfoW