2e0b4ea712972d936f05b315bb7bd211e262c07b0962c86b0f0a56b249e45276

Sharing

Copy URL Twitter E-mail

General

Target

2e0b4ea712972d936f05b315bb7bd211e262c07b0962c86b0f0a56b249e45276
Size

268KB
MD5

589781870808250603f098dbd5229040
SHA1

a8044a9c24890dfeff9ff2bf479d063bd7fd6c01
SHA256

2e0b4ea712972d936f05b315bb7bd211e262c07b0962c86b0f0a56b249e45276
SHA512

f0f0746a87d0d63b701f14d8d416f3e5f7ae4f6d177d7550a073f7abe7e09118fbb96dd1b6be1c8ec64f898b9ea4b95dd2cce230ce0fd2e387ba21f3139c3f8b
SSDEEP

6144:SurtZKPMdhSRDO34CwN1MZXLALZKwqgvDjLAaOGGASfzePD:F/3dhSBe6iXiZK/S/L3OGHVD

Score

N/A

Malware Config

Signatures

Files

2e0b4ea712972d936f05b315bb7bd211e262c07b0962c86b0f0a56b249e45276
.dll regsvr32 windows x86

6de9d32ae5f744740c3b6da11f25cee8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
CreateFileW
GetVersionExA
GetVersionExW
OutputDebugStringA
OutputDebugStringW
GetModuleHandleA
GetFileAttributesA
GetFileAttributesW
GetCPInfo
GetEnvironmentVariableA
GetEnvironmentVariableW
lstrcatW
GetCurrentProcessId
GetStdHandle
VirtualAlloc
VirtualQuery
GetCurrentProcess
RaiseException
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryExW
LoadLibraryExA
lstrlenW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
MultiByteToWideChar
CloseHandle
WriteFile
ReadFile
InterlockedDecrement
VirtualProtect
GlobalMemoryStatus
lstrcpyW
GetSystemInfo
FreeLibrary
SetLastError
LoadLibraryA
GetProcAddress
GetLastError
InterlockedIncrement
SetErrorMode
LocalFree
LocalAlloc
InterlockedExchange
GetModuleHandleW
Sleep
GetCommandLineA
HeapFree
HeapAlloc
RtlUnwind
HeapReAlloc
ExitProcess
TerminateProcess
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapSize
IsBadWritePtr
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
SetFilePointer
GetStringTypeA
GetStringTypeW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
IsDBCSLeadByteEx

advapi32

RegQueryValueExW
RegEnumValueW
RegEnumValueA
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegEnumKeyExW
RegEnumKeyExA
RegisterEventSourceA
DeregisterEventSource
RegCloseKey
ReportEventW

Exports

Exports

CallFunctionShim
CloseCtrs
ClrCreateManagedInstance
CoEEShutDownCOM
CoInitializeCor
CoInitializeEE
CoLogCurrentStack
CoUninitializeCor
CoUninitializeEE
CollectCtrs
CorBindToCurrentRuntime
CorBindToRuntime
CorBindToRuntimeByCfg
CorBindToRuntimeByPath
CorBindToRuntimeEx
CorBindToRuntimeHost
CorExitProcess
CorMarkThreadInThreadPool
CreateConfigStream
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EEDllGetClassObjectFromClass
EEDllRegisterServer
EEDllUnregisterServer
GetAssemblyMDImport
GetCORRequiredVersion
GetCORSystemDirectory
GetCORVersion
GetCompileInfo
GetGlobalContextsPerfCounters
GetHashFromAssemblyFile
GetHashFromAssemblyFileW
GetHashFromBlob
GetHashFromFile
GetHashFromFileW
GetHashFromHandle
GetHostConfigurationFile
GetMetaDataInternalInterface
GetMetaDataInternalInterfaceFromPublic
GetMetaDataPublicInterfaceFromInternal
GetPermissionRequests
GetPrivateContextsPerfCounters
GetRealProcAddress
GetStartupFlags
GetXMLElement
GetXMLElementAttribute
GetXMLObject
LoadLibraryShim
LoadLibraryWithPolicyShim
LogHelp_LogAssert
LogHelp_NoGuiOnAssert
LogHelp_TerminateOnAssert
MetaDataGetDispenser
ND_CopyObjDst
ND_CopyObjSrc
ND_RI2
ND_RI4
ND_RI8
ND_RU1
ND_WI2
ND_WI4
ND_WI8
ND_WU1
OpenCtrs
ReleaseFusionInterfaces
RunDll32ShimW
RuntimeImageType
RuntimeOSHandle
RuntimeOpenImage
RuntimeReleaseHandle
StrongNameCompareAssemblies
StrongNameErrorInfo
StrongNameFreeBuffer
StrongNameGetPublicKey
StrongNameHashSize
StrongNameKeyDelete
StrongNameKeyGen
StrongNameKeyInstall
StrongNameSignatureGeneration
StrongNameSignatureSize
StrongNameSignatureVerification
StrongNameSignatureVerificationEx
StrongNameSignatureVerificationFromImage
StrongNameTokenFromAssembly
StrongNameTokenFromAssemblyEx
StrongNameTokenFromPublicKey
TranslateSecurityAttributes
_CorDllMain
_CorExeMain
_CorExeMain2
_CorImageUnloading
_CorValidateImage

Sections

.text
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6de9d32ae5f744740c3b6da11f25cee8

Headers

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 100KB

.data Size: 8KB - Virtual size: 8KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 5KB

.text Size: 140KB - Virtual size: 140KB

.text
Size: 104KB - Virtual size: 100KB

.data
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 5KB

.text
Size: 140KB - Virtual size: 140KB