d04049718876e8342c130dbbd2d2fc919ecb877e451ce7a0cde92bcfe48165b3

Sharing

Copy URL Twitter E-mail

General

Target

d04049718876e8342c130dbbd2d2fc919ecb877e451ce7a0cde92bcfe48165b3
Size

5.8MB
MD5

92f4ec0d8079c1914cf9aebe5036b4b9
SHA1

a4559358ec7a934ff3d048d6f6699226fcc48c90
SHA256

d04049718876e8342c130dbbd2d2fc919ecb877e451ce7a0cde92bcfe48165b3
SHA512

625ada042beb46ec73a11c357ff84313ee04e90540eca9cf4b19ca334fca4da6126d3722a19f2106337744cdae8b6627125b05a36fc305901effd7af288ca4eb
SSDEEP

98304:ycia5RaqMnwrrDXnqOXGQMKro5Gf5ZEtG0n3PN3Sshcb0Oy2jajoKLkcoaukxUzT:y9aPaqQwr/XnJ8KTGtGw/NnOp2jowOk1

Score

N/A

Malware Config

Signatures

Files

d04049718876e8342c130dbbd2d2fc919ecb877e451ce7a0cde92bcfe48165b3
.dll regsvr32 windows x86

69e1ca30b4f400787bf61c129278efa7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpReceiveResponse

kernel32

CloseHandle
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

MessageBoxExA
CharUpperBuffW

advapi32

OpenProcessToken
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

msvcp140

?uncaught_exception@std@@YA_NXZ

concrt140

??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ

ntdll

RtlCompareMemory

vcruntime140

__vcrt_InitializeCriticalSectionEx

api-ms-win-crt-stdio-l1-1-0

fwrite

api-ms-win-crt-string-l1-1-0

wcsnlen

api-ms-win-crt-runtime-l1-1-0

_cexit

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-heap-l1-1-0

_aligned_free

api-ms-win-crt-math-l1-1-0

_except1

crypt32

CryptUnprotectMemory

bcrypt

BCryptFinishHash

wtsapi32

WTSSendMessageW

Exports

Exports

DirectInput8Create
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: - Virtual size: 886KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69e1ca30b4f400787bf61c129278efa7

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

kernel32

user32

advapi32

msvcp140

concrt140

ntdll

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

crypt32

bcrypt

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 886KB

.rdata Size: - Virtual size: 187KB

.data Size: - Virtual size: 64KB

.gfids Size: - Virtual size: 56B

.tls Size: 512B - Virtual size: 9B

.detourc Size: - Virtual size: 4KB

.detourd Size: - Virtual size: 12B

.vmp0 Size: - Virtual size: 5.2MB

.vmp1 Size: 5.8MB - Virtual size: 5.8MB

.reloc Size: 512B - Virtual size: 288B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 886KB

.rdata
Size: - Virtual size: 187KB

.data
Size: - Virtual size: 64KB

.gfids
Size: - Virtual size: 56B

.tls
Size: 512B - Virtual size: 9B

.detourc
Size: - Virtual size: 4KB

.detourd
Size: - Virtual size: 12B

.vmp0
Size: - Virtual size: 5.2MB

.vmp1
Size: 5.8MB - Virtual size: 5.8MB

.reloc
Size: 512B - Virtual size: 288B

.rsrc
Size: 1KB - Virtual size: 1KB