57cb5306ddb5c140d5300800bccef4770f6390cb9d40cb5f2f5be19542365a68

Sharing

Copy URL Twitter E-mail

General

Target

57cb5306ddb5c140d5300800bccef4770f6390cb9d40cb5f2f5be19542365a68
Size

51KB
MD5

ec59e92130ce4d3ffb236c40b340e6a9
SHA1

2de6aa2a2af5a22b2b92bc4f71e65c5e75328d5f
SHA256

57cb5306ddb5c140d5300800bccef4770f6390cb9d40cb5f2f5be19542365a68
SHA512

6d66529448575acdb91505096b87ea37ea52d70ae01431582591e5fd90d0711f36244cb7ccb2e8653da2ed495575f7583a8110b4a3b440af87d989d65c20e4a0
SSDEEP

768:7WU3p/9r1naLLyFGywehO8CNlhKy2A4nMzxbuCiHd2cnlxB70wDX3m:7WEp/9r1mLywywOvShK8XGgkjB7VTm

Score

N/A

Malware Config

Signatures

Files

57cb5306ddb5c140d5300800bccef4770f6390cb9d40cb5f2f5be19542365a68
.dll windows x64

680e288cde4311a74a7990a22c04483d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntdll

NtQueryDirectoryFile
NtReleaseSemaphore
NtOpenSemaphore
NtOpenSection

user32

GetClassInfoExW
GetWindowLongW
LoadAcceleratorsW
LoadIconW
SetWindowsHookExW
SetWindowTextW
DrawTextExW
DrawTextW
IsWindowVisible
GetClientRect
EndDialog
GetMessagePos
BeginPaint
RegisterWindowMessageW
GetMonitorInfoW
GetActiveWindow
OffsetRect
UnregisterClassA
MonitorFromPoint
ReleaseCapture
InvalidateRgn
MapDialogRect
SetFocus
GetKeyState
GetMenuItemCount
GetWindowRect
SetCursor
SetProcessDefaultLayout
InflateRect
PtInRect
LoadMenuW
CreateDialogParamW
EnableMenuItem
PeekMessageW
IsMenu
GetSubMenu

kernel32

GetVolumePathNamesForVolumeNameW
WaitForSingleObject
FindNextFileW
GetVersionExA
GetTickCount
GlobalLock
GetCurrentThreadId
FlushInstructionCache
FindNextVolumeW
GetShortPathNameW
RaiseException
Sleep
CompareStringW
GetProcessHeap
FindClose
GetUserDefaultLCID
GetLastError
GetStartupInfoA
HeapSetInformation
lstrlenA
VirtualAlloc
lstrcmpiW
CreateEventW
UnhandledExceptionFilter

kbddch40

_LDenorm
_Stod
_Denorm
_LPoly
_Dnorm
_Exp
_Poly
_LInf
_FRteps
_Cosh
_Toupper
_Sinh

Exports

Exports

SdbUnregisterDatabase
CreateProcessNotify
FileSaveMarkNotExist
PathIsExe
FileSaveRestoreOnINF
DbgkLkmdRegisterCallback
GetVersionFromFile
TracePrintfW
ShimDumpCache
TracePrintfExA
DoInfInstall
SetPermLayers
RegisterOCX
DbgBreakPointWithStatus
PathQualify
TraceRegisterExA
PathIsSlowA
ApphelpCheckExe
TraceDumpExA
RegSaveRestore
OpenINFEngine
RegRestoreAll
EtwWriteEx
LaunchINFSectionEx
EtwEnableTrace
TranslateInfStringEx
DbgPrintReturnControlC
TraceDeregisterExW
EmProviderDeregisterEntry
ExtractFiles
TracePutsExA
TraceDeregisterA
DbgPrompt
IsNTAdmin
RebootCheckOnInstall
TracePrintfExW
EtwActivityIdControl
EtwProviderEnabled
PathResolve
ExecuteCab
EtwSendTraceBuffer
EtwWriteEndScenario
EmProviderDeregister
DbgPrint
TranslateInfString
TraceDeregisterW
TracePrintfA
ApphelpCheckIME
DwCloneEntry
EtwWriteStartScenario
UserUnInstStubWrapper
TracePutsExW
EmpProviderRegister
EtwWriteTransfer
EtwEventEnabled
EtwUnregister
DwEnumEntriesForAllUsers
EtwRegister
BerBvFree
NeedRebootInit
TraceGetConsoleA
AddDelBackupEntry
EmClientQueryRuleState
DbgkLkmdUnregisterCallback
ShimFlushCache
EmProviderRegisterEntry
AllowPermLayer
TraceDeregisterExA
EmProviderRegister
DbgBreakPoint
DbgQueryDebugFilterState
PathCleanupSpec
RegSaveRestoreOnINF
SetPerUserSecValues
TraceGetConsoleW
CloseINFEngine
LaunchINFSection
GetVersionFromFileEx
TraceRegisterExW
TraceVprintfExA
EmClientRuleDeregisterNotification
NeedReboot
DelNodeRunDLL32
EtwWrite
AllocADsStr
RegInstall
DwRasRefreshKerbScCreds
TraceDumpExW
DbgSetDebugFilterState
SdbTagToString
EmClientRuleRegisterNotification
DwDeleteSubEntry
DDMGetPhonebookInfo
PathMakeUniqueName
PathIsSlowW
FileSaveRestore
DbgSetDebugPrintCallback
RunSetupCommand
DbgCommandString

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

680e288cde4311a74a7990a22c04483d

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

user32

kernel32

kbddch40

Exports

Exports

Sections

.text Size: 19KB - Virtual size: 19KB

.data Size: 29KB - Virtual size: 29KB

.rsrc Size: 1024B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 12KB

.text
Size: 19KB - Virtual size: 19KB

.data
Size: 29KB - Virtual size: 29KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 12KB