00213ea5814b39a2cbef2886231a1cc2e10fcf7e419e0521473400d8d58ba9be

Sharing

Copy URL

Twitter E-mail

General

Target

00213ea5814b39a2cbef2886231a1cc2e10fcf7e419e0521473400d8d58ba9be
Size

229KB
MD5

6408a168ff378aa3932703feff197a26
SHA1

6cd1d0697599b03806e5d5d822f79eddf417fc91
SHA256

00213ea5814b39a2cbef2886231a1cc2e10fcf7e419e0521473400d8d58ba9be
SHA512

d9642c5c08c70ee08478549da177cb3896da86e1cb61b427cda4229a8fea92eb61db316ebedeb7ae9c16d4f07854e1ac45a180dee395f490bd9c51a1c3ca76b7
SSDEEP

6144:p+QbUupSFdOeA8Y7fb5CWv9rOJdCefZA3:pPbUuL/ef4

Score

N/A

Malware Config

Signatures

Files

00213ea5814b39a2cbef2886231a1cc2e10fcf7e419e0521473400d8d58ba9be
.dll regsvr32 windows x86

d6c8a101b7a4766e85ac0ec81074a364

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenProcessToken
GetTokenInformation
GetLengthSid
CopySid
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
QueryServiceStatus
StartServiceA
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceConfigA
LockServiceDatabase
ChangeServiceConfigA
UnlockServiceDatabase
StartServiceW
CloseServiceHandle
EqualSid
CryptAcquireContextA
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegDeleteValueA
RegEnumValueW
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExW
RegSetValueExW
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptSetProvParam
CryptReleaseContext
RegEnumValueA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
FreeSid
OpenThreadToken
AllocateAndInitializeSid

crypt32

CryptEnumOIDInfo
I_CryptFreeLruCache
I_CryptCreateLruEntry
I_CryptReleaseLruEntry
I_CryptInsertLruEntry
I_CryptFindLruEntryData
I_CryptFlushLruCache
I_CryptCreateLruCache
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertDeleteCertificateFromStore
CryptMsgGetParam
CertGetNameStringW
CertSetCertificateContextProperty
CertCreateCertificateContext
CertOpenSystemStoreA
CryptExportPublicKeyInfo
CertRDNValueToStrW
CertFindRDNAttr
CryptSIPLoad
CryptSIPRetrieveSubjectGuid
CryptMsgUpdate
CryptMsgOpenToDecode
CertGetSubjectCertificateFromStore
CryptMsgControl
CryptMsgVerifyCountersignatureEncodedEx
CryptEncodeObjectEx
CertFindAttribute
CryptSIPRemoveProvider
CryptSIPAddProvider
CryptEncodeObject
CryptStringToBinaryW
CertAlgIdToOID
CryptSIPRetrieveSubjectGuidForCatalogFile
CertFindSubjectInSortedCTL
CertCreateContext
CryptMsgEncodeAndSignCTL
CryptMsgClose
CertOIDToAlgId
CertFindCertificateInStore
CertGetCertificateContextProperty
I_CryptReadTrustedPublisherDWORDValueFromRegistry
I_CryptGetDefaultCryptProv
CertCompareCertificateName
CertCloseStore
CertCreateCertificateChainEngine
CertOpenStore
CertDuplicateStore
CertAddStoreToCollection
CertComparePublicKeyInfo
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertGetCertificateChain
CertGetEnhancedKeyUsage
CertFreeCTLContext
CertFreeCertificateContext
CertDuplicateCertificateContext
I_CryptGetAsn1Encoder
I_CryptGetAsn1Decoder
CryptRegisterOIDFunction
CryptUnregisterOIDFunction
I_CryptUninstallAsn1Module
I_CryptInstallAsn1Module
CertControlStore
CertVerifySubjectCertificateContext
CryptDecodeObject
CertCompareIntegerBlob
CertFindExtension
CertVerifyValidityNesting
CertVerifyTimeValidity
CertGetIssuerCertificateFromStore

imagehlp

ImageGetCertificateData
ImageAddCertificate
ImageRemoveCertificate
ImageEnumerateCertificates

kernel32

LocalReAlloc
SystemTimeToFileTime
WaitForMultipleObjects
Sleep
OutputDebugStringA
GetLocalTime
GetCurrentThread
GetLastError
lstrcmpA
SetLastError
SetEvent
DisableThreadLibraryCalls
lstrlenW
FreeLibrary
GetProcAddress
WideCharToMultiByte
ResetEvent
WaitForSingleObject
LoadLibraryA
lstrlenA
MultiByteToWideChar
CreateMutexW
ReadFile
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
lstrcpyA
ExpandEnvironmentStringsA
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LocalFree
LocalAlloc
GetVersionExA
HeapFree
HeapAlloc
GetProcessHeap
WriteFile
GetDateFormatA
GetTimeFormatA
FileTimeToSystemTime
GetModuleHandleA
InterlockedIncrement
InterlockedDecrement
GetFileSize
SetEndOfFile
GetFileSizeEx
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
ReleaseMutex
MoveFileA
DeleteFileA
MoveFileExW
UnregisterWaitEx
RegisterWaitForSingleObject
CreateEventA
GetCurrentDirectoryW
GetSystemDirectoryW
FindClose
CreateFileA
CreateFileW
DeleteFileW
CopyFileA
CopyFileW
GetFileAttributesA
GetFileAttributesW
SetFileAttributesA
SetFileAttributesW
CreateDirectoryA
CreateDirectoryW
RemoveDirectoryW
GetTempFileNameA
GetTempFileNameW
LoadLibraryW
ExpandEnvironmentStringsW
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
CreateMutexA
CloseHandle

msasn1

ASN1_FreeEncoded
ASN1_SetEncoderOption
ASN1_Decode
ASN1_Encode
ASN1_FreeDecoded
ASN1Free
ASN1BERDecNotEndOfContents
ASN1DecRealloc
ASN1BERDecS32Val
ASN1BEREncS32
ASN1bitstring_free
ASN1BERDecBitString
ASN1bitstring_cmp
ASN1BEREncRemoveZeroBits
ASN1charstring_free
ASN1char16string_free
ASN1DecSetError
ASN1BERDecCharString
ASN1BERDecChar16String
ASN1BERDecOctetString2
ASN1BERDecExplicitTag
ASN1BERDecPeekTag
ASN1BERDecOpenType2
ASN1BERDecEndOfContents
ASN1BEREncExplicitTag
ASN1BEREncOpenType
ASN1BEREncEndOfContents
ASN1BERDecUTCTime
ASN1BERDecBool
ASN1BEREncBool
ASN1BERDecObjectIdentifier2
ASN1BEREncObjectIdentifier2
ASN1_CloseModule
ASN1_CreateModule
ASN1BEREncOctetString
ASN1BEREncBitString
ASN1BEREncChar16String
ASN1BEREncCharString
ASN1CEREncEndBlk
ASN1CEREncFlushBlkElement
ASN1CEREncNewBlkElement
ASN1CEREncBeginBlk
ASN1CEREncUTCTime

msvcrt

_onexit
__dllonexit
_adjust_fdiv
_initterm
wcslen
malloc
free
qsort
_stricmp
_ltoa
atol
_wcsnicmp
_itow
wcsrchr
_memicmp
wcstol
_strnicmp
vswprintf
wcschr
_wtol
towupper
_except_handler3
wcscmp
wcscpy
wcscat
_wcsicmp

rpcrt4

RpcStringFreeW
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall2
RpcBindingFree

user32

wsprintfA
wsprintfW
MessageBoxA
GetDesktopWindow

Exports

Exports

AddPersonalTrustDBPages
CatalogCompactHashDatabase
CryptCATAdminAcquireContext
CryptCATAdminAddCatalog
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
CryptCATAdminPauseServiceForBackup
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminRemoveCatalog
CryptCATAdminResolveCatalogPath
CryptCATCDFClose
CryptCATCDFEnumAttributes
CryptCATCDFEnumAttributesWithCDFTag
CryptCATCDFEnumCatAttributes
CryptCATCDFEnumMembers
CryptCATCDFEnumMembersByCDFTag
CryptCATCDFEnumMembersByCDFTagEx
CryptCATCDFOpen
CryptCATCatalogInfoFromContext
CryptCATClose
CryptCATEnumerateAttr
CryptCATEnumerateCatAttr
CryptCATEnumerateMember
CryptCATGetAttrInfo
CryptCATGetCatAttrInfo
CryptCATGetMemberInfo
CryptCATHandleFromStore
CryptCATOpen
CryptCATPersistStore
CryptCATPutAttrInfo
CryptCATPutCatAttrInfo
CryptCATPutMemberInfo
CryptCATStoreFromHandle
CryptCATVerifyMember
CryptSIPCreateIndirectData
CryptSIPGetInfo
CryptSIPGetRegWorkingFlags
CryptSIPGetSignedDataMsg
CryptSIPPutSignedDataMsg
CryptSIPRemoveSignedDataMsg
CryptSIPVerifyIndirectData
DllRegisterServer
DllUnregisterServer
DriverCleanupPolicy
DriverFinalPolicy
DriverInitializePolicy
FindCertsByIssuer
GenericChainCertificateTrust
GenericChainFinalProv
HTTPSCertificateTrust
HTTPSFinalProv
I_CryptCatAdminMigrateToNewCatDB
IsCatalogFile
MsCatConstructHashTag
MsCatFreeHashTag
OfficeCleanupPolicy
OfficeInitializePolicy
OpenPersonalTrustDBDialog
OpenPersonalTrustDBDialogEx
SoftpubAuthenticode
SoftpubCheckCert
SoftpubCleanup
SoftpubDefCertInit
SoftpubDllRegisterServer
SoftpubDllUnregisterServer
SoftpubDumpStructure
SoftpubFreeDefUsageCallData
SoftpubInitialize
SoftpubLoadDefUsageCallData
SoftpubLoadMessage
SoftpubLoadSignature
TrustDecode
TrustFindIssuerCertificate
TrustFreeDecode
TrustIsCertificateSelfSigned
TrustOpenStores
WTHelperCertCheckValidSignature
WTHelperCertFindIssuerCertificate
WTHelperCertIsSelfSigned
WTHelperCheckCertUsage
WTHelperGetAgencyInfo
WTHelperGetFileHandle
WTHelperGetFileHash
WTHelperGetFileName
WTHelperGetKnownUsages
WTHelperGetProvCertFromChain
WTHelperGetProvPrivateDataFromChain
WTHelperGetProvSignerFromChain
WTHelperIsInRootStore
WTHelperOpenKnownStores
WTHelperProvDataFromStateData
WVTAsn1CatMemberInfoDecode
WVTAsn1CatMemberInfoEncode
WVTAsn1CatNameValueDecode
WVTAsn1CatNameValueEncode
WVTAsn1SpcFinancialCriteriaInfoDecode
WVTAsn1SpcFinancialCriteriaInfoEncode
WVTAsn1SpcIndirectDataContentDecode
WVTAsn1SpcIndirectDataContentEncode
WVTAsn1SpcLinkDecode
WVTAsn1SpcLinkEncode
WVTAsn1SpcMinimalCriteriaInfoDecode
WVTAsn1SpcMinimalCriteriaInfoEncode
WVTAsn1SpcPeImageDataDecode
WVTAsn1SpcPeImageDataEncode
WVTAsn1SpcSigInfoDecode
WVTAsn1SpcSigInfoEncode
WVTAsn1SpcSpAgencyInfoDecode
WVTAsn1SpcSpAgencyInfoEncode
WVTAsn1SpcSpOpusInfoDecode
WVTAsn1SpcSpOpusInfoEncode
WVTAsn1SpcStatementTypeDecode
WVTAsn1SpcStatementTypeEncode
WinVerifyTrust
WinVerifyTrustEx
WintrustAddActionID
WintrustAddDefaultForUsage
WintrustCertificateTrust
WintrustGetDefaultForUsage
WintrustGetRegPolicyFlags
WintrustLoadFunctionPointers
WintrustRemoveActionID
WintrustSetRegPolicyFlags
mscat32DllRegisterServer
mscat32DllUnregisterServer
mssip32DllRegisterServer
mssip32DllUnregisterServer

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d6c8a101b7a4766e85ac0ec81074a364

Headers

File Characteristics

Imports

advapi32

crypt32

imagehlp

kernel32

msasn1

msvcrt

rpcrt4

user32

Exports

Exports

Sections

.text Size: 162KB - Virtual size: 161KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 5KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 162KB - Virtual size: 161KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 5KB

.rmnet
Size: 56KB - Virtual size: 60KB