EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
c1f4279e3de0ed6c8412dfd6218702ef1332e825b45c07e069c7976e17461ce7.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c1f4279e3de0ed6c8412dfd6218702ef1332e825b45c07e069c7976e17461ce7.dll
Resource
win10v2004-20220812-en
General
-
Target
c1f4279e3de0ed6c8412dfd6218702ef1332e825b45c07e069c7976e17461ce7
-
Size
238KB
-
MD5
65b3ceac895b5603239a7079366e5832
-
SHA1
b5e18630661ebe05749bf0611792675e8f7881ce
-
SHA256
c1f4279e3de0ed6c8412dfd6218702ef1332e825b45c07e069c7976e17461ce7
-
SHA512
489534715396f2d30d06c10cdd3231667c50834a9b42bef0f6033abaddfbe6440d7994b22298ba5e9bb9582d971bd294338d66cf680c10cad4c2bb7c5578ab89
-
SSDEEP
6144:TnZasW1UPlmdDW6fWtnltY2tiS9RS3SW8VRblQBHJds:gV1UPlmDWwWtltY89RS3eVll40
Malware Config
Signatures
Files
-
c1f4279e3de0ed6c8412dfd6218702ef1332e825b45c07e069c7976e17461ce7.dll windows x86
b8c3110172097a2dba08ab259ec50381
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreate
xprt5
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
??0TPtrArray@XPRT@@QAE@XZ
?Lock@TSpinLock@XPRT@@QAEXXZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
_XprtUninitialize@0
_XprtInitialize@8
xprt_strlen
xprt_memcpy
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
xprt_iswdigit
?GetLength@TBstr@XPRT@@QBEHXZ
??0TBstr@XPRT@@QAE@ABV01@@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
_XprtAtomicDecrement@4
_XprtMemAlloc@4
xprt_memmove
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
??0TBstr@XPRT@@QAE@PBDPBG@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
xprt_strcmp
kSystemEncoding
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
_XprtAtomicIncrement@4
xprt_memset
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBG@Z
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
??0TBstr@XPRT@@QAE@XZ
??1TBstr@XPRT@@QAE@XZ
_XprtMemFree@4
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
aolidlemon
ord2
ord3
ord1
msvcrt
memset
strcmp
qsort
_purecall
_snwprintf
_except_handler3
__dllonexit
_onexit
_initterm
_adjust_fdiv
strstr
malloc
free
_strlwr
_stricmp
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
strncmp
_mbstrlen
_mbschr
_mbsstr
_mbscmp
?terminate@@YAXXZ
strncpy
wcsrchr
strcat
printf
fopen
fwrite
fclose
tolower
getenv
time
strrchr
_getpid
_vsnprintf
_beginthreadex
sprintf
_snprintf
__CxxFrameHandler
_EH_prolog
memcpy
strcpy
strlen
atoi
kernel32
VirtualQuery
SuspendThread
GetThreadContext
GlobalAlloc
GlobalFree
GetCurrentProcessId
GetEnvironmentVariableA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetCurrentThread
GetVersion
ReadFile
WriteFile
HeapFree
HeapAlloc
CreateDirectoryA
MoveFileA
GetFileAttributesA
GetProcessHeap
IsBadWritePtr
OpenProcess
GetExitCodeProcess
OutputDebugStringA
Sleep
GetCurrentProcess
GetVersionExA
ResumeThread
WaitForMultipleObjects
TerminateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
CreateSemaphoreA
WaitForSingleObject
CreateEventA
CreateProcessA
SetLastError
GetLastError
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
InterlockedExchange
ExitProcess
OpenEventA
CompareStringA
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
GetSystemPowerStatus
FreeLibrary
GetTickCount
advapi32
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
user32
DispatchMessageA
GetMessageA
PostMessageA
DefWindowProcA
CreateWindowExA
SetTimer
KillTimer
TranslateMessage
MsgWaitForMultipleObjects
DestroyWindow
wsprintfA
UnregisterClassA
RegisterClassA
GetKeyState
ole32
CoCreateInstance
CreateBindCtx
CoUninitialize
CoRegisterMessageFilter
CoInitializeEx
CoTaskMemFree
StringFromCLSID
oleaut32
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayUnlock
SafeArrayCreate
SafeArrayLock
SafeArrayCopy
SafeArrayDestroy
VariantClear
VariantInit
VariantChangeType
SysAllocString
VariantCopy
Exports
Exports
Sections
.text Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 62KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE