EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
24cc5c4a092f6be638527aafd7b2338fa941315071efa41405862c5ff6c9707c.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
24cc5c4a092f6be638527aafd7b2338fa941315071efa41405862c5ff6c9707c.dll
Resource
win10v2004-20220812-en
General
-
Target
24cc5c4a092f6be638527aafd7b2338fa941315071efa41405862c5ff6c9707c
-
Size
236KB
-
MD5
4f790d0d9c72a1910eb83a8b0293d9f0
-
SHA1
ef8f549d5241474f2c50876ac4cd91a4e296f2e7
-
SHA256
24cc5c4a092f6be638527aafd7b2338fa941315071efa41405862c5ff6c9707c
-
SHA512
92d1bd94643f49eabd9063678169c057f6ef44981d12dcb18c7ab1ce6959c70085ac548a511c581e12394d424b14868d03cc2c31e8a39cc56cf72139458c8fa0
-
SSDEEP
3072:g9uEzOn/Qsgpn2DcDjHoYGq8nv7vAqHlqLtbaOb8JtlOao08a7vVBKrSyu9Ew4Z1:fjgpn2DcDjIPvp83w7Oao0R79Ef9
Malware Config
Signatures
Files
-
24cc5c4a092f6be638527aafd7b2338fa941315071efa41405862c5ff6c9707c.dll windows x86
94113205e1b36dec06802af345446344
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
GetModuleHandleA
GetLastError
SetLastError
DisableThreadLibraryCalls
InterlockedExchange
CompareStringA
ExitProcess
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
FreeLibrary
GlobalAlloc
GetSystemDefaultLCID
GlobalLock
GlobalUnlock
LoadLibraryA
GlobalFree
user32
SetTimer
KillTimer
TranslateMessage
MsgWaitForMultipleObjects
gdi32
SetMapMode
SelectObject
GetDeviceCaps
AbortDoc
Polyline
EndDoc
StartPage
DeleteDC
SetBkMode
EndPage
DeleteObject
GetCurrentObject
winspool.drv
ClosePrinter
comdlg32
CommDlgExtendedError
ole32
CoCreateInstance
CoUninitialize
CoRegisterMessageFilter
CoInitializeEx
CreateBindCtx
oleaut32
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
SafeArrayCopy
VariantInit
VariantChangeType
SysAllocString
VariantCopy
VariantClear
SafeArrayDestroy
xprt5
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?CompareNormal@TBstr@XPRT@@QBEHPBG@Z
?AddTail@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?RemoveHead@TPtrList@XPRT@@QAEPAXXZ
??0TPtrList@XPRT@@QAE@H@Z
??1TPtrList@XPRT@@QAE@XZ
_XprtAtomicIncrement@4
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
xprt_memmove
_XprtMemAlloc@4
_XprtAtomicDecrement@4
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?Lock@TSpinLock@XPRT@@QAEXXZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
xprt_iswdigit
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
_XprtInitialize@8
_XprtUninitialize@0
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?Copy@TBstr@XPRT@@QBEPAGXZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??0TBstr@XPRT@@QAE@XZ
kSystemEncoding
??0TBstr@XPRT@@QAE@PBDPBG@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
??1TBstr@XPRT@@QAE@XZ
?Compare@TBstr@XPRT@@QBEHPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?Normalize@TBstr@XPRT@@QAEAAV12@XZ
_XprtGenerateRandom@8
_XprtMemFree@4
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
xprt_memset
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
msvcrt
??2@YAPAXI@Z
_adjust_fdiv
_initterm
_onexit
__dllonexit
??3@YAXPAX@Z
malloc
_except_handler3
_purecall
qsort
strcmp
_snwprintf
wcstok
free
memcpy
towupper
isspace
wcslen
swprintf
wcscmp
swscanf
memset
tolower
isupper
Exports
Exports
Sections
.text Size: 80KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE