EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
b1ccfe890c092b584c735f46b9ca7c54ebe0c40256f57bc2432bf0c4b0de26a9.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b1ccfe890c092b584c735f46b9ca7c54ebe0c40256f57bc2432bf0c4b0de26a9.dll
Resource
win10v2004-20220812-en
General
-
Target
b1ccfe890c092b584c735f46b9ca7c54ebe0c40256f57bc2432bf0c4b0de26a9
-
Size
572KB
-
MD5
46d3749a0d5b4b073aa3c403d1e669ae
-
SHA1
807e2c30747de571fdc364c879833838e99855af
-
SHA256
b1ccfe890c092b584c735f46b9ca7c54ebe0c40256f57bc2432bf0c4b0de26a9
-
SHA512
a2167000090ebed1a8f02275a1b9237164ed8072a736f1de87edeb2a069aee00ec4bcd4c6fe085b2b02bf7ce75aafb973c7db00998be2725c6244b81fac9f6a2
-
SSDEEP
12288:ybHvVKjkN8Oi3C0eYAwXropcHkV4/1CAU4O/STw:yb9+e0eYlXroL4/1LdTw
Malware Config
Signatures
Files
-
b1ccfe890c092b584c735f46b9ca7c54ebe0c40256f57bc2432bf0c4b0de26a9.dll windows x86
f6714160eafb12bdbf43fb71a32ee376
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
DeleteCriticalSection
DisableThreadLibraryCalls
FreeLibrary
CompareStringA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
GetLastError
SetLastError
ExitProcess
ResetEvent
GetModuleHandleA
InterlockedExchange
GetVersionExA
CloseHandle
ReleaseMutex
OpenMutexW
CreateMutexW
GetVersion
OutputDebugStringW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetTickCount
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
InterlockedCompareExchange
SetEvent
ole32
CoRegisterMessageFilter
CoUninitialize
CreateBindCtx
CoCreateInstance
CoInitializeEx
oleaut32
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayUnlock
SafeArrayCreate
SafeArrayLock
SafeArrayCopy
SafeArrayDestroy
VariantInit
VariantChangeType
SysAllocString
VarCmp
VariantCopy
VariantClear
xprt5
_XprtCreateThread@8
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
?Replace@TBstr@XPRT@@QAEHGG@Z
?Normalize@TBstr@XPRT@@QAEAAV12@XZ
?MakeUpper@TBstr@XPRT@@QAEAAV12@XZ
_XprtHexToBin@16
_XprtMemAlloc@4
??0TAesCipher@XPRT@@QAE@W4ECipherOp@TCipher@1@PBEH@Z
?SetMode@TBlockCipher@XPRT@@QAEXW4ECipherMode@12@@Z
?SetIv@TBlockCipher@XPRT@@QAEXPBE@Z
?ProcessData@TBlockCipher@XPRT@@UAEHPAEH_N@Z
??1TAesCipher@XPRT@@UAE@XZ
??0TMd5Digest@XPRT@@QAE@H@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
?Empty@TBstr@XPRT@@QAEXXZ
xprt_snprintf
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?GetTickCount@TTime@XPRT@@SA?AV12@XZ
?GetSecond@TTime@XPRT@@QBEHXZ
?GetMinute@TTime@XPRT@@QBEHXZ
?GetHour@TTime@XPRT@@QBEHXZ
?GetYear@TTime@XPRT@@QBEHXZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?GetMonth@TTime@XPRT@@QBEHXZ
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Find@TBstr@XPRT@@QBEHPBGH@Z
xprt_memset
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Format@TBstr@XPRT@@QAAXPBGZZ
?GetLength@TBstr@XPRT@@QBEHXZ
_XprtMemFree@4
_XprtCompareString@8
_XprtFreeString@4
_XprtAllocString@4
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?RemoveAt@TPtrArray@XPRT@@QAEXHH@Z
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
??0TBstr@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
??0TPtrArray@XPRT@@QAE@XZ
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??0TBstr@XPRT@@QAE@PBG@Z
??0TFile@XPRT@@QAE@XZ
??1TFile@XPRT@@UAE@XZ
?IsOpen@TFile@XPRT@@QBE_NXZ
?Open@TFile@XPRT@@QAE_NPBGI_N@Z
_XprtUninitialize@0
_XprtInitialize@8
xprt_strlen
xprt_memcpy
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
??0TMessageDigest@XPRT@@QAE@XZ
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
??0TBstr@XPRT@@QAE@PBDPBG@Z
kSystemEncoding
??1TBstr@XPRT@@QAE@XZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
_XprtAtomicDecrement@4
xprt_memmove
xprt_strcmp
_XprtAtomicIncrement@4
_XprtMemRealloc@8
?Assign@TBstr@XPRT@@QAEAAV12@PBGH@Z
?Replace@TBstr@XPRT@@QAEHPBG0@Z
??0TBstr@XPRT@@QAE@PBDHPBG@Z
?Left@TBstr@XPRT@@QBE?AV12@H@Z
_XprtStringUtf8ByteLen@8
_XprtStringToUtf8@16
?Find@TBstr@XPRT@@QBEHGH@Z
_XprtStringByteLen@8
?ReverseFind@TBstr@XPRT@@QBEHG@Z
?TrimRight@TBstr@XPRT@@QAEAAV12@G@Z
?GetTime64@TTime@XPRT@@QBE_JXZ
?Right@TBstr@XPRT@@QBE?AV12@H@Z
?CompareNoCase@TBstr@XPRT@@QBEHPBG@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
_XprtBinToBase64@16
_XprtBase64ToBin@12
?GetDay@TTime@XPRT@@QBEHXZ
xprt_iswdigit
msvcrt
_itoa
_adjust_fdiv
_initterm
_onexit
__dllonexit
_snwprintf
qsort
realloc
abort
calloc
rand
strtok
strchr
sscanf
strcmp
fflush
gmtime
fprintf
printf
isprint
exit
strncpy
malloc
memcmp
strcat
strcpy
memcpy
_iob
sprintf
strlen
_purecall
wcscpy
difftime
wcslen
isalpha
memmove
_vsnprintf
time
srand
_tzset
_ftime
getenv
atoi
??3@YAXPAX@Z
free
??2@YAPAXI@Z
memset
_except_handler3
_strdup
ws2_32
ntohs
WSAStartup
WSAGetLastError
gethostname
inet_ntoa
WSACleanup
gethostbyname
htonl
inet_addr
wininet
InternetCrackUrlW
InternetSetOptionW
InternetCloseHandle
HttpQueryInfoA
InternetConnectW
InternetOpenW
InternetQueryDataAvailable
InternetReadFileExA
HttpSendRequestW
HttpOpenRequestW
HttpAddRequestHeadersW
InternetSetStatusCallbackW
InternetInitializeAutoProxyDll
user32
DestroyWindow
MsgWaitForMultipleObjects
TranslateMessage
SetTimer
KillTimer
advapi32
RegCloseKey
Exports
Exports
Sections
.text Size: 288KB - Virtual size: 286KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 100KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ