a919e54d2963ffe70773c3f4f9f08bc84c2e1f0eaa55126152fc42f73a57cf6a

Sharing

Copy URL Twitter E-mail

General

Target

a919e54d2963ffe70773c3f4f9f08bc84c2e1f0eaa55126152fc42f73a57cf6a
Size

955KB
MD5

cb30d1de23ea6323b71f22c048f758aa
SHA1

8c96983f7d885e4c46649b5b8e07ea867211c7c5
SHA256

a919e54d2963ffe70773c3f4f9f08bc84c2e1f0eaa55126152fc42f73a57cf6a
SHA512

b841bf52a85d4b837615eeb65f0d0a4ad92b0d84b8b2f4745e5f0cbcbd3f15004d41824e3071cb0da6533c635261ac26232e3f87005ed28dc261006250f696dd
SSDEEP

24576:qDaP2R8k1jpEPNJt8232tx5ZNYNeyahmtKlS3fjmck6pUA:qDoaNAJtTePYNeyahmQlSScvT

Score

N/A

Malware Config

Signatures

Files

a919e54d2963ffe70773c3f4f9f08bc84c2e1f0eaa55126152fc42f73a57cf6a
.zip
tapiperf.dll
.dll windows x86

7eb8d07db0a2f9df993efa91ace46d58

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
memmove

advapi32

OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

kernel32

GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
Sleep
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedCompareExchange
GetProcAddress
LoadLibraryA
GlobalFree
GlobalAlloc
InterlockedExchange

Exports

Exports

CloseTapiPerformanceData
CollectTapiPerformanceData
OpenTapiPerformanceData

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 482B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
themecpl.dll
.dll windows x86

9e23b0b3a0f61ffcc25cd63ec6b98d2a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_ftol2
floor
free
_ftol2_sse
memcpy
_vsnwprintf
_itow_s
qsort
_XcptFilter
malloc
_initterm
_amsg_exit
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_wcsicmp
memset
memmove
_purecall
_CIsqrt

atl

ord30

kernel32

LocalAlloc
TlsFree
SetLastError
TlsAlloc
DisableThreadLibraryCalls
DelayLoadFailureHook
GetProcAddress
InterlockedCompareExchange
LoadLibraryExA
InterlockedExchange
Sleep
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WaitForSingleObject
CompareStringW
GetLastError
CompareStringOrdinal
ReleaseMutex
CloseHandle
InterlockedIncrement
MulDiv
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
lstrlenW
FreeLibrary
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThreadId
TlsGetValue
lstrcmpA
MultiByteToWideChar
WideCharToMultiByte
FindResourceW
lstrlenA
GetModuleFileNameW
TlsSetValue
GetCurrentProcessId
ProcessIdToSessionId
WriteProfileStringW
InitializeCriticalSection
DeleteCriticalSection
ExpandEnvironmentStringsW
LocalFree
FormatMessageW
CreateFileW
CreateMutexW
ActivateActCtx
ReleaseActCtx
CreateActCtxW
LoadLibraryW
FindResourceExW
LoadResource
LockResource
SizeofResource
GetModuleHandleW
InterlockedDecrement
DeactivateActCtx

advapi32

RegEnumKeyExW
EventEnabled
RegSetKeyValueW
RegCloseKey
RegEnumValueW
EventUnregister
EventRegister
RegCreateKeyExW
RegSetValueExW
RegGetValueW
RegOpenKeyExW
EventWrite

shlwapi

ord538
ord494
SHRegQueryInfoUSKeyW
SHRegEnumUSKeyW
SHRegOpenUSKeyW
SHRegQueryUSValueW
SHRegCloseUSKey
SHRegGetValueW
ord168
ord174
PathCanonicalizeW
PathRemoveFileSpecW
SHDeleteValueW
ord199
ord487
PathRemoveExtensionW
ord256
ord176
ord24
ord514
ord164
ord278
ord260
ord177
ord493
ord618
ord637
ord172
ord219
PathFindFileNameW
StrRStrIW
ord437
ord460
PathAddBackslashW
StrToIntExW
StrTrimW
StrStrW
SHSetValueW
PathCombineW
StrCmpW
ord204
SHStrDupW
ord158
PathAppendW
ord215
ord12
ord217
ord213
StrChrW
StrPBrkW
ord156

powrprof

GetPwrCapabilities
PowerGetActiveScheme
PowerReadDCValueIndex
PowerReadACValueIndex
PowerWriteDCValueIndex
PowerWriteACValueIndex
PowerSetActiveScheme

ole32

CreateBindCtx
CoUninitialize
CoInitializeEx
PropVariantClear
CoGetMalloc
CoTaskMemFree
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

VariantClear
SysStringLen
SysFreeString
SysAllocString
SafeArrayGetElement

propsys

PropVariantChangeType
PropVariantToBSTR
PSGetPropertyKeyFromName
PSCreateMemoryPropertyStore
PropVariantToStringAlloc
PropVariantToGUID
PropVariantToBooleanWithDefault
PropVariantToBoolean

gdi32

GetTextExtentPoint32W
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
CreateSolidBrush
GetDeviceCaps
CreateDIBSection
DeleteObject
GetObjectW

user32

EnumWindows
GetMenuItemInfoW
GetClassNameW
FindWindowW
DestroyWindow
GetSysColor
GetSystemMetrics
SendMessageW
EndDialog
EnableWindow
GetDlgItem
GetDlgItemTextW
LoadStringW
GetWindowLongW
SetWindowLongW
SetCursor
LoadImageW
TrackPopupMenu
DestroyMenu
SetWindowPos
GetAncestor
SendNotifyMessageW
SetWindowsHookExW
FillRect
IsChild
CallNextHookEx
UnhookWindowsHookEx
SetSysColors
GetParent
GetDC
ReleaseDC
MessageBoxW
GetClassInfoExW
RegisterClassExW
CreateWindowExW
LoadCursorW
UpdateWindow
DefWindowProcW
DialogBoxParamW
FindWindowExW
PostMessageW
GetMenuItemCount
GetFocus
DestroyIcon
GetWindowRect
IsProcessDPIAware
DeleteMenu

duser

AttachWndProcW
ForwardGadgetMessage

uxtheme

IsThemeActive
SetWindowTheme
IsCompositionActive
GetCurrentThemeName
ord1

dwmapi

ord131
ord107
ord106
ord127

slc

SLGetWindowsInformationDWORD

shell32

SHBrowseForFolderW
SHCreateShellItemArrayFromIDLists
ord19
SHBindToParent
ShellExecuteW
SHParseDisplayName
ord25
SHBindToObject
ord152
ord21
ord95
ord850
SHGetPathFromIDListW
SHGetKnownFolderIDList
ord24
ord704
SHCreateDirectoryExW
SHGetKnownFolderPath
ord27
SHGetIDListFromObject
SHCreateItemFromIDList
ord16
SHGetKnownFolderItem
SHGetNameFromIDList
ord28
ord155
ord846
ord18
SHGetFolderPathEx
ShellExecuteExW
SHCreateItemFromParsingName
ord100
ord901

ntdll

EtwLogTraceEvent
WinSqmAddToStream

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
thumbcache.dll
.dll regsvr32 windows x86

e5eaff1962425a3aca603c3b2517684e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memcpy
_ui64tow_s
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
_amsg_exit
_initterm
malloc
_XcptFilter
??_V@YAXPAX@Z
??_U@YAPAXI@Z
free
realloc
_ultow_s
_vsnwprintf
memset
_ftol2

advapi32

LsaOpenPolicy
LsaLookupNames2
GetLengthSid
CopySid
LsaFreeMemory
LsaClose
EqualSid
IsValidSid
OpenProcessToken
EventRegister
EventUnregister
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventWrite
RegOpenKeyExW
TraceEvent
RegCloseKey
RegQueryValueExW
GetNamedSecurityInfoW
GetSecurityDescriptorControl
GetAce
GetAclInformation
GetTokenInformation

user32

ReleaseDC
GetDC
LoadStringW
CopyImage

gdi32

DeleteDC
CreateDIBSection
SelectObject
GetObjectW
DeleteObject
CreateCompatibleDC
GetBitmapBits
BitBlt

shell32

SHGetTemporaryPropertyForItem
ord155
ord850
SHChangeNotify
ord165
SHGetFolderPathAndSubDirW

shlwapi

StrCmpNIW
SHStrDupW
PathIsUNCW
PathIsRootW
SHGetValueW
PathAppendW
ord158
PathSkipRootW
PathStripToRootW
PathIsNetworkPathW
PathRemoveFileSpecW
PathCombineW
ord184
ord212
ord199
ord618
ord213
PathFindExtensionW
ord174
SHRegGetValueW
ord632
SHCreateStreamOnFileW

comctl32

ord332
ord328
ord386
ord334
ord329
ord324
ord326
ord323
ord320
ord388

oleaut32

SysFreeString
SysStringLen
VariantClear
VariantTimeToSystemTime
SysAllocStringLen
SysAllocString

kernel32

InterlockedDecrement
HeapAlloc
GetProcessHeap
HeapFree
DisableThreadLibraryCalls
LoadLibraryW
GetProcAddress
FreeLibrary
DelayLoadFailureHook
GetLastError
InterlockedCompareExchange
LoadLibraryExA
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
lstrlenW
LCMapStringW
GetCurrentThreadId
GetFileAttributesW
CreateDirectoryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
InterlockedIncrement
GetTempFileNameW
MoveFileExW
GetVolumeInformationW
MulDiv
CreateFileW
GetFileSize
RaiseException
InitializeSRWLock
SetFilePointer
WriteFile
SetEndOfFile
AcquireSRWLockShared
ReleaseSRWLockShared
SetFileAttributesW
LocalFree
UnmapViewOfFile
InterlockedExchange
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetDiskFreeSpaceExW
LocalAlloc
DuplicateHandle
GetModuleHandleW
SystemTimeToFileTime
OpenProcess
GetProcessId
CreateMutexW
CreateEventW
ReleaseMutex
SetEvent
ResetEvent
CreateFileMappingW
MapViewOfFile
GetFileInformationByHandleEx
SetFileInformationByHandle
WaitForSingleObject
GetSystemInfo
GetTickCount
GetDriveTypeW

ntdll

NtQueryInformationFile
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlMapGenericMask
RtlInitUnicodeString

psapi

QueryWorkingSetEx

propsys

PropVariantToUInt64

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ticrf.rat
timedate.cpl
.dll regsvr32 windows x86

ee8c760f6f2836fbdf3c279032717ba7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

wcschr
_wtoi
_itow_s
bsearch
_wcsnicmp
wcsncmp
??3@YAXPAX@Z
??2@YAPAXI@Z
_vsnwprintf
wcsstr
_wcsicmp
_XcptFilter
malloc
free
_initterm
_amsg_exit
_except_handler4_common
_unlock
__dllonexit
_lock
memset
_purecall
memcpy
_onexit

atl

ord21
ord15
ord32
ord16

ntdll

NtClose
WinSqmIsOptedIn
WinSqmSetString
WinSqmSetDWORD
EtwEventWrite
EtwEventUnregister
EtwEventRegister
NtOpenProcessToken
NtAdjustPrivilegesToken

api-ms-win-core-localregistry-l1-1-0

RegGetValueW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueExW
RegCloseKey

kernel32

GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
SearchPathW
GetSystemDefaultUILanguage
UnmapViewOfFile
LocalAlloc
LeaveCriticalSection
LocalFree
EnterCriticalSection
GetSystemTime
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetLocaleInfoW
GetDateFormatW
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
GetCalendarDateFormat
ConvertSystemTimeToCalDateTime
IsTimeZoneRedirectionEnabled
LoadLibraryA
GetTimeFormatW
FormatMessageW
GetVersionExW
GetLocalTime
CompareStringW
HeapAlloc
GetProcessHeap
HeapFree
GetSystemDirectoryW
lstrlenW
FreeLibrary
FileTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
ConvertCalDateTimeToSystemTime
UpdateCalendarDayOfWeek
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
DisableThreadLibraryCalls
CheckElevationEnabled
InterlockedExchange
InterlockedCompareExchange
SetLocalTime
Sleep
LocalFileTimeToFileTime
GetCurrentThreadId
DelayLoadFailureHook
LoadLibraryExA
QueryPerformanceCounter
FindResourceW
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateFileW
CreateFileMappingW
IsValidLocale
SetDynamicTimeZoneInformation
CompareFileTime
CompareStringOrdinal
GetDynamicTimeZoneInformation
GetTimeZoneInformation
LockResource
LoadResource
FindResourceExW
MulDiv
GetUserDefaultUILanguage
CloseHandle
MapViewOfFile
LoadLibraryExW
SizeofResource
GetCalendarInfoW
GetTickCount

dwmapi

DwmIsCompositionEnabled
DwmSetWindowAttribute

ole32

HWND_UserUnmarshal
HWND_UserMarshal
HWND_UserFree
CoCreateInstance
CoUninitialize
CoInitializeEx
CreateStreamOnHGlobal
CoGetObject
StringFromGUID2
HWND_UserSize

oleaut32

SysFreeString
SysAllocString

rpcrt4

NdrOleAllocate
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrOleFree
NdrDllRegisterProxy
NdrDllUnregisterProxy
IUnknown_QueryInterface_Proxy
NdrCStdStubBuffer_Release
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy

shlwapi

ord16
SHDeleteValueW
ord354
ord631
SHRegGetValueW
StrToIntW
StrStrW
StrCmpIW
ord630
SHGetValueW
ord158
StrStrIW
SHSetValueW
PathRemoveBlanksW
StrCmpW
ord278
StrChrW

user32

IsWindow
SetProcessDPIAware
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowRgn
GetClientRect
CalculatePopupWindowPosition
FindWindowW
InflateRect
PtInRect
GetCursorPos
AdjustWindowRectEx
RegisterClassExW
GetClassInfoExW
SetForegroundWindow
PostThreadMessageW
SystemParametersInfoW
GetAncestor
PostMessageW
DestroyWindow
CreateWindowExW
SetWindowLongW
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextW
GetParent
SendDlgItemMessageW
GetWindowLongW
SetWindowTextW
SetFocus
GetSysColor
LoadCursorW
SetCursor
SetDlgItemTextW
ShowWindow
GetWindow
InvalidateRect
DialogBoxParamW
LoadStringW
GetWindowRect
MapWindowPoints
SetWindowPos
GetDlgItem
EnableWindow
SendMessageW
EndDialog
KillTimer
SetTimer
UpdateWindow
GetKeyState
MoveWindow
GetWindowTextLengthW
GetFocus
GetClassInfoW
RegisterClassW
BeginPaint
EndPaint
GetSystemMetrics
SetRect
GetWindowInfo
GetProcessDefaultLayout
IsProcessDPIAware
GetDC
ReleaseDC
GetWindowTextW

uxtheme

OpenThemeData
GetThemeBackgroundRegion
CloseThemeData

comctl32

InitCommonControlsEx

gdi32

GetDCBrushColor
CreateFontIndirectW
GetTextExtentPoint32W
SelectObject
DeleteObject
GetDeviceCaps
PtInRegion

gdiplus

GdipCloneBitmapAreaI
GdipCreateRegionPath
GdipDrawImageRectI
GdipGraphicsClear
GdipDrawLineI
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipSetCompositingMode
GdipGetImageGraphicsContext
GdipCreateFromHDC
GdipAddPathEllipseI
GdipBitmapSetPixel
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipGetRegionHRgn
GdipDeleteRegion
GdipCloneImage
GdipDeletePath
GdipCreatePath
GdipDeletePen
GdipCreatePen1
GdipAlloc
GdipFree
GdipDeleteGraphics

Exports

Exports

CPlApplet
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 51B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 307KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
udhisapi.dll
.dll windows x86

277ebb8d5c5b7a8e202043c1880b7732

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_XcptFilter
_vsnprintf
memset
_strcmpi
_stricmp
_vsnwprintf
strtoul
_except_handler4_common
_amsg_exit
_initterm
free
malloc
_strnicmp
strncmp
wcsstr
_wcsicmp
isupper
tolower
strstr
strtok
isdigit

ntdll

EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage

api-ms-win-core-localregistry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

kernel32

Sleep
InterlockedExchange
WideCharToMultiByte
SetUnhandledExceptionFilter
HeapFree
QueryPerformanceCounter
GetProcessHeap
HeapAlloc
LoadLibraryExA
FreeLibrary
GetProcAddress
DelayLoadFailureHook
MultiByteToWideChar
lstrcmpW
lstrlenW
GetTickCount
GetSystemTimeAsFileTime
UnhandledExceptionFilter
lstrlenA
InterlockedCompareExchange
GetLastError

rpcrt4

UuidFromStringW

Exports

Exports

GetExtensionVersion
HttpExtensionProc
TerminateExtension

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7eb8d07db0a2f9df993efa91ace46d58

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 482B

9e23b0b3a0f61ffcc25cd63ec6b98d2a

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

atl

kernel32

advapi32

shlwapi

powrprof

ole32

oleaut32

propsys

gdi32

user32

duser

uxtheme

dwmapi

slc

shell32

ntdll

Exports

Exports

Sections

.text Size: 177KB - Virtual size: 177KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 1.9MB - Virtual size: 1.9MB

.reloc Size: 22KB - Virtual size: 21KB

e5eaff1962425a3aca603c3b2517684e

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

user32

gdi32

shell32

shlwapi

comctl32

oleaut32

kernel32

ntdll

psapi

propsys

Exports

Exports

Sections

.text Size: 71KB - Virtual size: 71KB

.data Size: 2KB - Virtual size: 1KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 3KB - Virtual size: 2KB

ee8c760f6f2836fbdf3c279032717ba7

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

atl

.text
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 482B

.text
Size: 177KB - Virtual size: 177KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

.reloc
Size: 22KB - Virtual size: 21KB

.text
Size: 71KB - Virtual size: 71KB

.data
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 3KB - Virtual size: 2KB

.text
Size: 147KB - Virtual size: 147KB

.orpc
Size: 512B - Virtual size: 51B

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 307KB - Virtual size: 306KB

.reloc
Size: 10KB - Virtual size: 9KB

.text
Size: 37KB - Virtual size: 37KB

.data
Size: 512B - Virtual size: 988B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB