2b5ef06034e85fd7b0310711269ee2c64bae99d3abb169964999f6d6ba27916b

Sharing

Copy URL Twitter E-mail

General

Target

2b5ef06034e85fd7b0310711269ee2c64bae99d3abb169964999f6d6ba27916b
Size

1.1MB
MD5

3ae7ab7fa9cca28699e9f813fc634ef0
SHA1

f94dea51d9889c0aadbf2a63f9f3b65061a0ff1c
SHA256

2b5ef06034e85fd7b0310711269ee2c64bae99d3abb169964999f6d6ba27916b
SHA512

ff400f4cb6b649462d15439317e4bdbc557293c0e94d380e0f354712813054588998e99c2a332927487d40c86c6007f40ee9c35074b381a5cec0d9d92bae2f65
SSDEEP

24576:8u59F55A+NU3DlFN2BLwwZKEp5x5Wi2UJ/LOfQbSpHs5H0ZP:tbvQDl+TZzZbsM5H

Score

N/A

Malware Config

Signatures

Files

2b5ef06034e85fd7b0310711269ee2c64bae99d3abb169964999f6d6ba27916b
.dll regsvr32 windows x86

149776f70879ca89db3d3ca0a446a5c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_ultow_s
isalpha
_ui64tow_s
_i64tow_s
_wtoi
wcsstr
_purecall
wcschr
_vsnwprintf
wcsncmp
_vsnprintf
??_U@YAPAXI@Z
_wcsicmp
swscanf_s
wcstok_s
wcstoul
wcsrchr
malloc
free
bsearch
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
_except_handler4_common
__CxxFrameHandler3
iswalpha
wcstol
fgets
_wfopen
fclose
towlower
strchr
_wcsnicmp
memcpy_s
memcpy
memcmp
??_V@YAXPAX@Z
memset

kernel32

LocalReAlloc
RaiseException
DuplicateHandle
OpenMutexW
DeviceIoControl
SetErrorMode
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
GetFileSize
GetFileTime
GetCurrentThread
GetFileAttributesExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
LocalAlloc
LocalFree
GetLastError
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
InterlockedCompareExchange
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
lstrcmpA
MultiByteToWideChar
TlsGetValue
HeapAlloc
TlsSetValue
HeapFree
GetProcessHeap
TlsAlloc
TlsFree
GetModuleFileNameA
GetSystemTimeAsFileTime
CompareFileTime
GetCurrentThreadId
GetCurrentProcessId
AddAtomW
GetModuleHandleExW
GetModuleFileNameW
FindAtomW
CloseHandle
GetACP
InterlockedExchange
CompareStringW
lstrcmpW
DeleteFileW
GetFileAttributesW
CreateFileW
GetFileSizeEx
FindFirstFileW
FindClose
ReadFile
SetFilePointer
GetCurrentProcess
GetProcAddress
LoadLibraryA
IsWow64Process
SetLastError
GetSystemTime
GlobalSize
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
GetVersionExA
GetFullPathNameW
GetDriveTypeA
QueryDosDeviceW
IsDBCSLeadByte
GetCPInfo
EncodePointer
GetSystemInfo
GetShortPathNameW
GetWindowsDirectoryA
LoadLibraryExA
GetFileAttributesA
CreateDirectoryA
GetTempPathA
DecodePointer
GetShortPathNameA
GetThreadLocale
LoadLibraryW
GetLongPathNameA
GetLongPathNameW
CreateFileA
SetFileAttributesA
WriteFile
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
DeleteFileA
GetSystemDefaultLCID
GetUserDefaultLCID
GetSystemDirectoryA
CopyFileA
CreateThread
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
ExitThread
TerminateThread
TerminateProcess
RemoveDirectoryA
FindFirstFileA
FindNextFileA
SearchPathA
SystemTimeToFileTime
GetLocalTime
FindAtomA
AddAtomA
DeleteAtom
GetPrivateProfileStringA
GetPrivateProfileIntA
FormatMessageA
FileTimeToSystemTime
GetTempPathW
GetTempFileNameW
CreateDirectoryW
GetFullPathNameA
GetLocaleInfoA
GetModuleHandleW
ExpandEnvironmentStringsA
GetTimeFormatA
GetModuleHandleA
RtlMoveMemory
LoadLibraryExW
GetDriveTypeW
CreateMutexA
WritePrivateProfileStringW
GetExitCodeThread
GetPrivateProfileIntW
CompareStringA
InitOnceExecuteOnce
CreateMutexW
OpenProcess
OpenFileMappingW
ReleaseMutex
TryEnterCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount

api-ms-win-downlevel-ole32-l1-1-0

CoInitializeEx
CLSIDFromString
CoGetTreatAsClass
CoGetClassObject
CoCreateInstance
CoUnmarshalInterface
StringFromCLSID
CoSetProxyBlanket
CoFreeUnusedLibraries
CoCreateGuid
CoGetMarshalSizeMax
CoMarshalInterface
CLSIDFromProgID
FreePropVariantArray
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize

api-ms-win-downlevel-shlwapi-l1-1-0

PathGetDriveNumberW
StrCmpNW
StrCmpICA
StrCmpNCW
StrCmpNA
StrStrIA
StrCmpIW
StrToInt64ExW
StrChrNW
SHRegGetBoolUSValueW
QISearch
ParseURLW
StrToIntExW
StrCmpNICW
StrDupA
PathIsRootW
UrlCanonicalizeW
UrlGetPartW
UrlUnescapeW
UrlEscapeW
PathCreateFromUrlW
UrlCreateFromPathW
UrlGetLocationW
SHRegDeleteUSValueW
StrRChrW
UrlIsW
PathStripToRootW
SHRegEnumUSKeyW
SHRegQueryUSValueW
SHRegCloseUSKey
PathIsUNCServerShareW
StrTrimW
SHRegOpenUSKeyW
PathIsPrefixW
PathRemoveFileSpecW
PathUnquoteSpacesW
StrToIntW
SHRegGetUSValueW
PathRemoveExtensionW
UrlCombineW
PathFindExtensionA
StrCmpW
StrChrW
StrStrW
StrStrA
SHRegGetUSValueA
PathIsPrefixA
PathFindFileNameW
PathFindExtensionW
StrCmpNCA
StrCmpNICA
StrCmpICW
StrCmpCA
StrChrA
StrDupW
StrCmpCW
StrToIntA
StrStrIW
StrChrIW
PathIsUNCServerW
SHRegGetBoolUSValueA
PathFileExistsA
StrCmpNIA
PathIsUNCW

api-ms-win-downlevel-advapi32-l1-1-0

RegEnumValueW
GetTraceLoggerHandle
RegSetValueExW
RegEnumValueA
TraceMessageVa
GetTraceEnableLevel
RegQueryInfoKeyA
RegGetValueW
GetTraceEnableFlags
UnregisterTraceGuids
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExA
RegQueryValueExW
RegDeleteValueA
OpenThreadToken
DuplicateToken
OpenProcessToken
GetTokenInformation
CreateWellKnownSid
CheckTokenMembership
RegCloseKey
RegOpenKeyExW
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyExA
RegGetValueA
RegCreateKeyExW

api-ms-win-downlevel-user32-l1-1-0

CharPrevA
CharNextA
CharLowerW
CharUpperBuffA
CharNextW
CharPrevW
CharLowerA

api-ms-win-downlevel-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-downlevel-normaliz-l1-1-0

IdnToAscii

ole32

StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
StgOpenStorage
OleGetAutoConvert
ReleaseStgMedium
MonikerRelativePathTo
CreateGenericComposite
GetClassFile
CreateBindCtx
MkParseDisplayName
CoInitialize
CoGetObject

shlwapi

UrlGetPartA
ord1
ShellMessageBoxA
PathCreateFromUrlA
UrlCompareW
SHRegEnumUSValueW
SHRegQueryInfoUSKeyW
SHRegWriteUSValueW
SHRegDeleteEmptyUSKeyW
SHRegCreateUSKeyW

user32

GetDoubleClickTime
ReleaseDC
MapWindowPoints
GetClientRect
DrawTextW
GetWindowDC
GetWindowRect
RegisterWindowMessageW
DestroyIcon
GetDC
SystemParametersInfoW
LoadImageW
SendDlgItemMessageW
EnumWindows
GetClassNameW
FindWindowExW
SendMessageTimeoutW
GetSystemMetrics
GetWindowLongW
IsDlgButtonChecked
IsWindowVisible
SetWindowPos
EnableWindow
ShowWindow
CheckDlgButton
SetWindowLongW
SetWindowTextW
DispatchMessageW
PeekMessageW
GetUserObjectInformationW
GetThreadDesktop
GetProcessWindowStation
GetAsyncKeyState
AllowSetForegroundWindow
SetTimer
KillTimer
SendNotifyMessageA
FindWindowA
GetLastActivePopup
GetParent
GetClipboardFormatNameA
MsgWaitForMultipleObjects
PostQuitMessage
PeekMessageA
DispatchMessageA
TranslateMessage
CreateWindowExA
UnregisterClassA
RegisterClassA
DialogBoxParamW
EndDialog
SetForegroundWindow
SendMessageA
GetDlgItem
SetDlgItemTextW
LoadStringW
GetWindowLongA
SendMessageW
LoadStringA
DestroyWindow
PostMessageA
DefWindowProcA
SetWindowLongA
SendDlgItemMessageA
RegisterClipboardFormatA
SystemParametersInfoA
SetPropA
GetPropA
PostMessageW

ntdll

RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW

iertutil

PrivateCoInternetCombineIUri
PrivateCoInternetParseIUri
PrivateCoInternetCanonicalizeIUri
ord298
ord151
ord443
ord32
ord526
ord9
ord25
ord701
IsStringProperty
IsDWORDProperty
IntlPercentEncodeNormalize
GetPropertyName
GetPropertyFromName
GetPortFromUrlScheme
GetIUriPriv2
GetIUriPriv
CreateUriWithFragment
CreateUriPriv
CreateStringHashN
CreateUri
CreateIUriBuilder
ord654
ord665
ord675
ord672
ord17
ord750
ord230
ord700
UriFromHostAndScheme
ord398
ord460
ord519
ord518
ord751
ord121
FastMimeLookupKnownType
ord386
ord453
ord340
FastMimeSetIsMimeFilterEnabled
ord457
ord516
ord403
ord463
ord541
ord404
ord35
ord61
ord64
ord520
ord425
ord527
ord528
GetIDNSettingsForIE
ord16
ord68
ord58
ord45
ord325
ord42
ord281
ord282
ord65
ord71
ord86
ord306
ord88
ord110
ord318
ord683
ord76
ord111
ord81
ord681
ord85
ord74
ord79
ord707
ord706
ord57
ord399
ord134
ord466
ord682
ord50
ord166
IUriBuilderInternalCreateDomain
ord172
ord159
ord158
ord150
ord54
ord201
ord63
ord200
ord28
ord70
ord20
ord209
ord43
ord205
ord321
ord458
FastMimeGetIsMimeFilterEnabled
ord309
ord89
ord72
ord56
CreateUriFromMultiByteString
ord44
ord62
ord173
ord655
ord651
ord657
ord658
ord650
ord664
ord667
ord656

wininet

AppCacheCloseHandle
InternetSetOptionA
GetUrlCacheEntryInfoExW
HttpQueryInfoW
HttpAddRequestHeadersW
InternetLockRequestFile
InternetQueryOptionA
HttpQueryInfoA
InternetOpenW
InternetSetStatusCallbackA
InternetConnectW
InternetSetOptionW
InternetQueryOptionW
InternetCreateUrlA
InternetInitializeAutoProxyDll
InternetQueryDataAvailable
InternetReadFile
InternetErrorDlg
RetrieveUrlCacheEntryFileW
UnlockUrlCacheEntryFileW
InternetUnlockRequestFile
ResumeSuspendedDownload
InternetSetFilePointer
InternetReadFileExW
HttpPushClose
HttpCloseDependencyHandle
AppCacheDuplicateHandle
HttpDuplicateDependencyHandle
HttpOpenRequestW
HttpOpenDependencyHandle
AppCacheLookup
HttpSendRequestExW
HttpSendRequestW
AppCacheGetFallbackUrl
HttpPushWait
HttpPushEnable
GetUrlCacheEntryInfoW
DeleteUrlCacheEntryW
InternetWriteFile
HttpEndRequestA
InternetOpenUrlW
FtpGetFileSize
GetUrlCacheEntryInfoA
CreateUrlCacheEntryA
CommitUrlCacheEntryA
InternetTimeToSystemTimeA
InternetCrackUrlA
DeleteUrlCacheEntryA
InternetTimeFromSystemTimeA
InternetCanonicalizeUrlA
FindNextUrlCacheContainerA
FindCloseUrlCache
GetUrlCacheEntryInfoExA
FindFirstUrlCacheContainerA
GetUrlCacheConfigInfoW
IsHostInProxyBypassList
CommitUrlCacheEntryW
DeleteUrlCacheContainerW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryExW
UrlCacheCreateContainer
CreateUrlCacheContainerW
InternetCloseHandle

Exports

Exports

AsyncGetClassBits
AsyncInstallDistributionUnit
BindAsyncMoniker
CDLGetLongPathNameA
CDLGetLongPathNameW
CORPolicyProvider
CoGetClassObjectFromURL
CoInstall
CoInternetCanonicalizeIUri
CoInternetCombineIUri
CoInternetCombineUrl
CoInternetCombineUrlEx
CoInternetCompareUrl
CoInternetCreateSecurityManager
CoInternetCreateZoneManager
CoInternetFeatureSettingsChanged
CoInternetGetProtocolFlags
CoInternetGetSecurityUrl
CoInternetGetSecurityUrlEx
CoInternetGetSession
CoInternetIsFeatureEnabled
CoInternetIsFeatureEnabledForIUri
CoInternetIsFeatureEnabledForUrl
CoInternetIsFeatureZoneElevationEnabled
CoInternetParseIUri
CoInternetParseUrl
CoInternetQueryInfo
CoInternetSetFeatureEnabled
CompareSecurityIds
CompatFlagsFromClsid
CopyBindInfo
CopyStgMedium
CreateAsyncBindCtx
CreateAsyncBindCtxEx
CreateFormatEnumerator
CreateIUriBuilder
CreateURLMoniker
CreateURLMonikerEx
CreateURLMonikerEx2
CreateUri
CreateUriFromMultiByteString
CreateUriPriv
CreateUriWithFragment
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Extract
FaultInIEFeature
FileBearsMarkOfTheWeb
FindMediaType
FindMediaTypeClass
FindMimeFromData
GetAddSitesFileUrl
GetClassFileOrMime
GetClassURL
GetComponentIDFromCLSSPEC
GetIDNFlagsForUri
GetIUriPriv
GetIUriPriv2
GetLabelsFromNamedHost
GetMarkOfTheWeb
GetPortFromUrlScheme
GetPropertyFromName
GetPropertyName
GetSoftwareUpdateInfo
GetUrlmonThreadNotificationHwnd
GetZoneFromAlternateDataStreamEx
HlinkGoBack
HlinkGoForward
HlinkNavigateMoniker
HlinkNavigateString
HlinkSimpleNavigateToMoniker
HlinkSimpleNavigateToString
IECompatLogCSSFix
IEDllLoader
IEInstallScope
IntlPercentEncodeNormalize
IsAsyncMoniker
IsDWORDProperty
IsIntranetAvailable
IsJITInProgress
IsLoggingEnabledA
IsLoggingEnabledW
IsStringProperty
IsValidURL
MkParseDisplayNameEx
ObtainUserAgentString
PrivateCoInstall
QueryAssociations
QueryClsidAssociation
RegisterBindStatusCallback
RegisterFormatEnumerator
RegisterMediaTypeClass
RegisterMediaTypes
RegisterWebPlatformPermanentSecurityManager
ReleaseBindInfo
RevokeBindStatusCallback
RevokeFormatEnumerator
SetSoftwareUpdateAdvertisementState
ShouldDisplayPunycodeForUri
ShouldShowIntranetWarningSecband
ShowTrustAlertDialog
URLDownloadA
URLDownloadToCacheFileA
URLDownloadToCacheFileW
URLDownloadToFileA
URLDownloadToFileW
URLDownloadW
URLOpenBlockingStreamA
URLOpenBlockingStreamW
URLOpenPullStreamA
URLOpenPullStreamW
URLOpenStreamA
URLOpenStreamW
UnregisterWebPlatformPermanentSecurityManager
UrlMkBuildVersion
UrlMkGetSessionOption
UrlMkSetSessionOption
UrlmonCleanupCurrentThread
WriteHitLogging
ZonesReInit

Sections

.text
Size: 716KB - Virtual size: 716KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wpp_sf
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

149776f70879ca89db3d3ca0a446a5c3

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

api-ms-win-downlevel-ole32-l1-1-0

api-ms-win-downlevel-shlwapi-l1-1-0

api-ms-win-downlevel-advapi32-l1-1-0

api-ms-win-downlevel-user32-l1-1-0

api-ms-win-downlevel-version-l1-1-0

api-ms-win-downlevel-normaliz-l1-1-0

ole32

shlwapi

user32

ntdll

iertutil

wininet

Exports

Exports

Sections

.text Size: 716KB - Virtual size: 716KB

.wpp_sf Size: 5KB - Virtual size: 5KB

.data Size: 11KB - Virtual size: 40KB

.idata Size: 14KB - Virtual size: 14KB

.rsrc Size: 319KB - Virtual size: 319KB

.reloc Size: 35KB - Virtual size: 35KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 716KB - Virtual size: 716KB

.wpp_sf
Size: 5KB - Virtual size: 5KB

.data
Size: 11KB - Virtual size: 40KB

.idata
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 319KB - Virtual size: 319KB

.reloc
Size: 35KB - Virtual size: 35KB

.rmnet
Size: 56KB - Virtual size: 60KB