FunDLLData
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Behavioral task
behavioral1
Sample
c8f1ec2ef618dfcd254f5a9e397b70644b3ba070f0c327bae20a3054df0021c0.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c8f1ec2ef618dfcd254f5a9e397b70644b3ba070f0c327bae20a3054df0021c0.dll
Resource
win10v2004-20220901-en
Target
c8f1ec2ef618dfcd254f5a9e397b70644b3ba070f0c327bae20a3054df0021c0
Size
6.4MB
MD5
37280de8b448ed3a4358120a40b42872
SHA1
b05209c3bcaac611763369416a18c4b8406c4fa1
SHA256
c8f1ec2ef618dfcd254f5a9e397b70644b3ba070f0c327bae20a3054df0021c0
SHA512
807ba5962fd16b0700121f70a948257e8602a2b7f15f74e871253fc8571e36900915eeecdddab2a3c26364ab9369b2c4386fbb7e2f3135641ef8f1df4784d74c
SSDEEP
98304:zG5fSXz5F5x+3rUQ4Qljsq75Pm9tli8VSP6W:zKfSlLsVPm9tlJW
danabot
1765
3
192.236.146.203:443
192.161.48.5:443
192.236.162.42:443
192.3.26.98:443
B2585F6479280F48B64C99F950BBF36D
main
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
CreateErrorInfo
GetErrorInfo
SetErrorInfo
SysFreeString
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetThreadToken
SetSecurityDescriptorDacl
ReportEventA
RegisterEventSourceA
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegEnumValueW
RegEnumKeyW
RegEnumKeyExW
RegCloseKey
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
LookupAccountSidW
LookupAccountNameW
IsValidSid
IsTextUnicode
InitializeSecurityDescriptor
GetUserNameW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityDescriptorSacl
GetCurrentHwProfileW
FreeSid
EqualSid
DuplicateToken
DeregisterEventSource
AllocateAndInitializeSid
AdjustTokenPrivileges
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
LsaFreeMemory
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
ConvertSidToStringSidA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptSignHashA
CryptVerifySignatureW
CryptDecrypt
CryptImportKey
CryptEncrypt
CryptDeriveKey
CryptDestroyKey
CryptExportKey
CryptGenKey
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextA
CharNextW
LoadStringW
SetWindowLongA
GetWindowLongA
CreateWindowExW
wvsprintfW
mouse_event
keybd_event
WindowFromPoint
UpdateWindow
TranslateMessage
SystemParametersInfoW
ShowWindow
SetWindowPos
SetThreadDesktop
SetClipboardData
SendMessageA
SendMessageW
ScreenToClient
ReleaseDC
RegisterClassW
RealGetWindowClassW
PtInRect
PostMessageA
PostMessageW
PeekMessageW
OpenDesktopW
OpenClipboard
MsgWaitForMultipleObjects
MoveWindow
MessageBoxA
MessageBoxW
MenuItemFromPoint
LoadStringW
LoadIconW
LoadCursorW
IsWindowVisible
InvalidateRect
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowInfo
GetUserObjectInformationW
GetTopWindow
GetThreadDesktop
GetSystemMetrics
GetProcessWindowStation
GetWindow
GetMessageW
GetMenuItemID
GetKeyboardLayoutList
GetForegroundWindow
GetDesktopWindow
GetDC
GetCursorInfo
GetClipboardData
GetClassNameW
GetAncestor
FrameRect
FindWindowExW
FindWindowA
FindWindowW
EnumDesktopWindows
EndDeferWindowPos
DrawIcon
DispatchMessageW
DeferWindowPos
DefWindowProcW
CreateDesktopW
CloseDesktop
CloseClipboard
ChildWindowFromPoint
CharUpperBuffW
CharUpperW
CharLowerBuffW
BeginDeferWindowPos
PrintWindow
PrintWindow
Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
SetCurrentDirectoryW
GetCurrentDirectoryW
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
lstrlenW
lstrcpyA
lstrcmpW
lstrcatW
WriteProcessMemory
WritePrivateProfileStringW
WriteFile
WideCharToMultiByte
WaitForSingleObjectEx
WaitForSingleObject
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFreeEx
VirtualFree
VirtualAllocEx
VirtualAlloc
VerSetConditionMask
VerifyVersionInfoW
UnmapViewOfFile
UnlockFileEx
UnlockFile
TryEnterCriticalSection
TerminateThread
TerminateProcess
SystemTimeToFileTime
SwitchToThread
SuspendThread
Sleep
SetThreadPriority
SetPriorityClass
SetLastError
SetFileTime
SetFilePointerEx
SetFilePointer
SetFileAttributesW
SetEvent
SetEndOfFile
SetCurrentDirectoryW
ResumeThread
ResetEvent
RemoveDirectoryW
ReleaseSemaphore
ReleaseMutex
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
QueryDosDeviceW
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
OpenProcess
OpenEventW
MultiByteToWideChar
MapViewOfFile
LockFileEx
LockFile
LocalFree
LocalAlloc
LoadLibraryA
LoadLibraryW
LeaveCriticalSection
LCMapStringW
IsValidLocale
IsBadReadPtr
InitializeCriticalSection
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapCompact
HeapAlloc
GlobalUnlock
GlobalSize
GlobalMemoryStatusEx
GlobalMemoryStatus
GlobalLock
GlobalFree
GlobalAlloc
GetWindowsDirectoryW
GetVolumeInformationW
GetVersionExA
GetVersionExW
GetVersion
GetUserDefaultLangID
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetTempPathA
GetTempPathW
GetTempFileNameW
GetSystemTimeAsFileTime
GetSystemTime
GetSystemPowerStatus
GetSystemInfo
GetSystemDirectoryW
GetSystemDefaultLangID
GetStdHandle
GetLongPathNameW
GetShortPathNameW
GetProcessHeap
GetProcAddress
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameW
GetLogicalDrives
GetLogicalDriveStringsW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameA
GetFullPathNameW
GetFileType
GetFileSize
GetFileAttributesExW
GetFileAttributesA
GetFileAttributesW
GetExitCodeThread
GetExitCodeProcess
GetEnvironmentVariableW
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetComputerNameExW
GetComputerNameW
GetCPInfoExW
GetCPInfo
GetBinaryTypeW
GetACP
FreeLibrary
FormatMessageA
FormatMessageW
FlushViewOfFile
FlushInstructionCache
FlushFileBuffers
FlushConsoleInputBuffer
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitThread
EnumSystemLocalesW
EnumCalendarInfoW
EnterCriticalSection
DisconnectNamedPipe
DeleteFileA
DeleteFileW
DeleteCriticalSection
CreateThread
CreateSemaphoreA
CreateRemoteThread
CreateProcessW
CreateNamedPipeW
CreateMutexW
CreateFileMappingW
CreateFileA
CreateFileW
CreateEventA
CreateEventW
CreateDirectoryW
CopyFileW
ConnectNamedPipe
CompareStringW
CloseHandle
AreFileApisANSI
Sleep
Wow64EnableWow64FsRedirection
Wow64DisableWow64FsRedirection
StretchBlt
SetStretchBltMode
SelectObject
Rectangle
GetStockObject
GetPixel
GetObjectA
GetDeviceCaps
GetDIBits
DeleteObject
DeleteDC
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
NetApiBufferFree
NetWkstaGetInfo
Netbios
OleInitialize
CreateBindCtx
MkParseDisplayName
CoTaskMemFree
CLSIDFromProgID
StringFromCLSID
CoCreateInstance
CoUninitialize
CoInitialize
WSAIoctl
WSAEventSelect
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
getservbyname
gethostbyname
socket
shutdown
setsockopt
send
select
recv
ntohs
ntohl
listen
inet_addr
htons
htonl
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
ShellExecuteExW
SHAppBarMessage
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
InternetCrackUrlW
realloc
_ftol
memmove
memcmp
free
malloc
strncmp
memset
strlen
memcpy
localtime
_errno
memchr
strcmp
strerror
realloc
_ftol
strncpy
strcat
isdigit
isxdigit
memmove
printf
tolower
isupper
isspace
memcmp
free
malloc
atol
_stricmp
strchr
strncmp
memset
strlen
memcpy
toupper
abort
signal
_getch
setvbuf
getenv
strstr
sprintf
_exit
raise
_vsnprintf
wcsstr
strtol
fflush
fputs
time
fwrite
strrchr
strtoul
sscanf
fprintf
_stat
ftell
fread
fopen
_lseek
_write
_read
_close
wcslen
_getpid
isalnum
localtime
gmtime
calloc
_chmod
_fdopen
_open
fclose
qsort
fseek
_strnicmp
fgets
_setmode
_wfopen
memset
memmove
memcpy
_beginthreadex
JetIndexRecordCount
JetMove
JetRetrieveColumns
JetOpenTableW
JetOpenDatabaseW
JetGetColumnInfoW
JetAttachDatabaseW
JetEndSession
JetBeginSessionW
JetSetSystemParameterW
JetTerm
JetCreateInstanceW
JetInit
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CryptBinaryToStringA
CryptStringToBinaryA
GetAdaptersInfo
GetDefaultPrinterW
RasGetEntryDialParamsA
RasEnumEntriesA
StrStrW
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
RtlAllocateHeap
RtlDecompressBuffer
FunDLLData
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ