27e3d850e46733710499f6a5e1366a54d419f57a0389c3a0e68fc9457e963065

Sharing

Copy URL Twitter E-mail

General

Target

27e3d850e46733710499f6a5e1366a54d419f57a0389c3a0e68fc9457e963065
Size

2.0MB
MD5

250878dc13e4411542f023ac80008b60
SHA1

8448cf8e071a4f8890897e0c6805e1edea248d28
SHA256

27e3d850e46733710499f6a5e1366a54d419f57a0389c3a0e68fc9457e963065
SHA512

8aaf527ed55fd3ad06234ca6fba67dfab0da020389f622dc2f362f502e6aa6d397a35c7f80b1ad3da8fcd4c518293d3ccd0b7733e5bb429bc75d07c80c1995be
SSDEEP

49152:IQUD/2pZfoIPKLrVVAi4fj/yfhthGOTKJl5klOBsduj7vsq0c8PW5OG:IVDSve/AiOkG6IBWu

Score

N/A

Malware Config

Signatures

Files

27e3d850e46733710499f6a5e1366a54d419f57a0389c3a0e68fc9457e963065
.dll regsvr32 windows x86

72c52f56c2404c90c7f5415c31ef69c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFileTime
GlobalFlags
GetCurrentDirectoryW
CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetSystemTimeAsFileTime
RtlUnwind
CreateThread
ExitThread
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
GetCommandLineA
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapQueryInformation
IsValidCodePage
GetOEMCP
GetCPInfo
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetErrorMode
UnhandledExceptionFilter
TerminateProcess
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetStdHandle
GetFileType
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetConsoleCtrlHandler
SetFilePointerEx
SetStdHandle
WriteConsoleW
OutputDebugStringW
GetExitCodeProcess
CreateProcessA
GetDriveTypeW
SetEnvironmentVariableA
GetFileInformationByHandle
FindFirstFileExW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
SetConsoleMode
ReadConsoleInputA
GetSystemTime
FlushConsoleInputBuffer
GlobalMemoryStatus
lstrlenA
SetUnhandledExceptionFilter
TlsSetValue
TlsGetValue
TlsAlloc
GlobalFindAtomW
GetSystemDirectoryW
GlobalAddAtomW
GetPrivateProfileIntW
lstrcmpW
GlobalDeleteAtom
GetVersionExW
GetCurrentThread
SystemTimeToFileTime
FileTimeToLocalFileTime
ResumeThread
SuspendThread
SetThreadPriority
GetCurrentProcessId
lstrcmpA
GetStringTypeExW
LoadLibraryA
DuplicateHandle
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
GetModuleHandleA
SetLastError
OutputDebugStringA
GetACP
SetThreadLocale
GetThreadLocale
GetModuleHandleW
LoadLibraryExW
lstrcmpiW
EncodePointer
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
DecodePointer
ResetEvent
QueryPerformanceCounter
GetComputerNameW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetStartupInfoW
CreateProcessW
GetModuleFileNameW
LoadLibraryW
CreatePipe
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCurrentThreadId
GetCurrentProcess
LocalFree
GetProcAddress
FreeLibrary
InterlockedExchange
FormatMessageW
GetFileSize
LocalAlloc
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSectionAndSpinCount
GetLastError
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
CreateEventW
GetTickCount
SetLocalTime
Sleep
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSection
FindFirstFileW
DeleteFileW
CreateFileW
lstrlenW
GetLocalTime
CloseHandle
FindClose
ReadFile
WriteFile
WideCharToMultiByte
MultiByteToWideChar
CreateDirectoryW
FindResourceW
SizeofResource
LoadResource
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
LockResource
PeekNamedPipe
LoadLibraryA
FreeLibrary
TerminateProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GetLocalTime
LocalAlloc
LocalFree
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
FlushFileBuffers
GetCurrentProcessId
GetLastError
GetModuleFileNameW
CreateEventA
GetModuleHandleA
GetSystemTimeAsFileTime
ExitProcess
VirtualQuery
CreateFileA
ReadFile
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA

user32

CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
GetWindow
KillTimer
SetTimer
SetCursor
PostQuitMessage
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
GetWindowTextW
GetSysColor
ScreenToClient
ClientToScreen
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
CallNextHookEx
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
RedrawWindow
GetLastActivePopup
GetWindowLongW
IsWindowEnabled
EnableWindow
CharUpperW
SendMessageW
IsWindow
GetSystemMetrics
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetParent
CharNextW
UnregisterClassW
GetWindowThreadProcessId
GetWindowRect
SetForegroundWindow
GetForegroundWindow
DestroyWindow
GetDlgItem
GetDlgCtrlID
GetCapture
GetMenu
SetMenu
UpdateWindow
SetWindowsHookExW
GetDC
ReleaseDC
GetClientRect
MessageBoxW
LoadStringW
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
PostMessageW
AttachThreadInput
ShowWindow
SetWindowPos
BringWindowToTop
SetPropW
GetPropW
RemovePropW
AdjustWindowRectEx
MapWindowPoints
CopyRect
PtInRect
SetWindowLongW
GetClassLongW
GetClassNameW
GetTopWindow
LoadIconW
WinHelpW
MonitorFromWindow
GetMonitorInfoW
DestroyMenu
InvalidateRect
RealChildWindowFromPoint
LoadCursorW
GetSysColorBrush
SetWindowTextW
UnhookWindowsHookEx
CharUpperBuffW
MessageBoxW

gdi32

CreateBitmap
Escape
GetClipBox
PtVisible
RectVisible
RestoreDC
SaveDC
SetBkColor
SetMapMode
SetBrushOrgEx
GetObjectW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
SetStretchBltMode
TextOutW
SetDIBColorTable
GetDIBColorTable
CreateDIBSection
SetTextColor
StretchBlt
GetStockObject
GetDeviceCaps
GetCurrentObject
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

ReportEventA
DeregisterEventSource
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegisterEventSourceA
RegQueryValueExA
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

ShellExecuteW
ShellExecuteExW

shlwapi

PathFindExtensionW
PathIsUNCW
PathStripToRootW
PathFindFileNameW

ole32

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateGuid
OleRun
CoCreateInstance
CoInitialize
CreateStreamOnHGlobal
CoUninitialize

oleaut32

SysAllocStringLen
LoadRegTypeLi
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
VarUdateFromDate
VariantInit
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysFreeString
SysAllocString
VariantClear
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
SafeArrayCreate
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantChangeType
GetErrorInfo

ws2_32

socket
gethostbyname
WSAGetLastError
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAWaitForMultipleEvents
shutdown
ntohs
GetAddrInfoW
inet_ntoa
setsockopt
WSAStartup
WSACleanup
WSASetLastError
inet_addr
send
select
connect
recv
htons
getsockopt
ioctlsocket
__WSAFDIsSet
closesocket

gdiplus

GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

oleacc

LresultFromObject
CreateStdAccessibleObject

wtsapi32

WTSSendMessageW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 429KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.va0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.va1
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72c52f56c2404c90c7f5415c31ef69c9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

ws2_32

gdiplus

version

oleacc

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 1.5MB

.rdata Size: - Virtual size: 429KB

.data Size: - Virtual size: 76KB

.va0 Size: - Virtual size: 1.3MB

.va1 Size: 1.9MB - Virtual size: 1.9MB

.reloc Size: 512B - Virtual size: 152B

.rsrc Size: 6KB - Virtual size: 6KB

.text
Size: - Virtual size: 1.5MB

.rdata
Size: - Virtual size: 429KB

.data
Size: - Virtual size: 76KB

.va0
Size: - Virtual size: 1.3MB

.va1
Size: 1.9MB - Virtual size: 1.9MB

.reloc
Size: 512B - Virtual size: 152B

.rsrc
Size: 6KB - Virtual size: 6KB