NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
f3ed050f17e2c63759339a65e9cedaa8791bd2c93f4a60c34c3618e2ff032c4d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f3ed050f17e2c63759339a65e9cedaa8791bd2c93f4a60c34c3618e2ff032c4d.dll
Resource
win10v2004-20220812-en
General
-
Target
f3ed050f17e2c63759339a65e9cedaa8791bd2c93f4a60c34c3618e2ff032c4d
-
Size
836KB
-
MD5
6b30339fe5cd89c7c3743bb6ead6b8d5
-
SHA1
eaf15f59be9397d742f627a07de19b25eced7e4d
-
SHA256
f3ed050f17e2c63759339a65e9cedaa8791bd2c93f4a60c34c3618e2ff032c4d
-
SHA512
0e7205e1d050c14cbe12ae7c61322b15c5ee995f31f48b9a321c13c49662129670cc109357cd76c610aea8ef4d94cdc2b98a543f69799008f0cf578238087ded
-
SSDEEP
12288:frlz0aa+BTkHoiM9c0YcVW1SSR6FY/1fV/66Sa0v12aow6Bej:frlrZcoiM91gP6KNfv2vxonw
Malware Config
Signatures
Files
-
f3ed050f17e2c63759339a65e9cedaa8791bd2c93f4a60c34c3618e2ff032c4d.dll windows x86
b74ebc4ddefc72c4cb8a827ed5c3a0de
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
xpcom_core
?Replace@nsSubstring@@QAEXIIPBGI@Z
?Replace@nsCSubstring@@QAEXIIPBDI@Z
?sEmptyBuffer@?$nsCharTraits@G@@2PBGB
?Adopt@nsSubstring@@QAEXPAGI@Z
?Assign@nsCSubstring@@QAEXABVnsCSubstringTuple@@@Z
?AssignWithConversion@nsString@@QAEXPBDH@Z
?assign_from_gs_cid@nsCOMPtr_base@@QAEXVnsGetServiceByCID@@ABUnsID@@@Z
?NS_NewAdoptingUTF8StringEnumerator@@YAIPAPAVnsIUTF8StringEnumerator@@PAVnsCStringArray@@@Z
?InsertCStringAt@nsCStringArray@@QAEHABVnsACString_internal@@H@Z
??0nsCStringArray@@QAE@XZ
?Clear@nsCStringArray@@UAEXXZ
?SizeTo@nsVoidArray@@UAEHH@Z
?Compact@nsCStringArray@@UAEXXZ
?GrowArrayBy@nsVoidArray@@MAEHH@Z
??1nsCStringArray@@UAE@XZ
?EmptyCString@@YAABVnsCString@@XZ
?NS_NewAtom@@YAPAVnsIAtom@@ABVnsAString_internal@@@Z
?CopyUTF16toUTF8@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?Assign@nsACString_internal@@QAEXABV1@@Z
??0nsCreateInstanceByCID@@QAE@ABUnsID@@PAVnsISupports@@PAI@Z
?ToNewCString@@YAPADABVnsACString_internal@@@Z
?Assign@nsACString_internal@@QAEXPBDI@Z
?Clone@nsMemory@@SAPAXPBXI@Z
?Assign@nsCSubstring@@QAEXPBDI@Z
?EqualsASCII@nsAString_internal@@QBEHPBDI@Z
?Assign@nsSubstring@@QAEXABV1@@Z
?LossyCopyUTF16toASCII@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?AppendInt@nsString@@QAEXHH@Z
?AppendWithConversion@nsString@@QAEXPBDH@Z
?assign_from_gs_contractid@nsCOMPtr_base@@QAEXVnsGetServiceByContractID@@ABUnsID@@@Z
?CallCreateInstance@@YAIABUnsID@@PAVnsISupports@@0PAPAX@Z
?EnsureMutable@nsSubstring@@IAEXXZ
?CallGetService@@YAIPBDABUnsID@@PAPAX@Z
?strcmp@nsCRT@@SAHPBD0@Z
?Assign@nsAString_internal@@QAEXABV1@@Z
?assign_from_qi@nsCOMPtr_base@@QAEXVnsQueryInterface@@ABUnsID@@@Z
?assign_from_helper@nsCOMPtr_base@@QAEXABVnsCOMPtr_helper@@ABUnsID@@@Z
?AppendUTF16toUTF8@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?Assign@nsCSubstring@@QAEXABVnsACString_internal@@@Z
??0nsCreateInstanceByContractID@@QAE@PBDPAVnsISupports@@PAI@Z
?AssignASCII@nsACString_internal@@QAEXPBDI@Z
?EqualsASCII@nsCSubstring@@QBEHPBDI@Z
??1nsAString_internal@@QAE@XZ
?IsASCII@@YAHABVnsACString_internal@@@Z
?CopyASCIItoUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?IsUTF8@@YAHABVnsACString_internal@@@Z
?CopyUTF8toUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?strdup@nsCRT@@SAPADPBD@Z
nsUnescape
?strlen@nsCRT@@SAIPBG@Z
nsEscape
?CallGetService@@YAIABUnsID@@0PAPAX@Z
?strncasecmp@nsCRT@@SAHPBD0I@Z
?strcasecmp@nsCRT@@SAHPBD0@Z
?NS_UnescapeURL@@YAHPBDHIAAVnsACString_internal@@@Z
NS_Free_P
NS_Alloc_P
?Init@nsPromiseFlatCString@@AAEXABVnsACString_internal@@@Z
?SetLength@nsCSubstring@@QAEXI@Z
?Length@nsAString_internal@@QBEIXZ
?EnsureMutable@nsCSubstring@@IAEXXZ
?GetReadableBuffer@nsAString_internal@@IBEIPAPBG@Z
?Assign@nsAString_internal@@QAEXPBGI@Z
?NS_NewByteBuffer@@YAIPAPAVnsIByteBuffer@@PAVnsISupports@@I@Z
?NS_NewUnicharBuffer@@YAIPAPAVnsIUnicharBuffer@@PAVnsISupports@@I@Z
?assign_from_gs_cid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByCIDWithError@@ABUnsID@@@Z
?Append@nsAString_internal@@QAEXPBG@Z
?SetLength@nsAString_internal@@QAEXI@Z
??_7nsCaseInsensitiveCStringComparator@@6B@
?Equals@nsACString_internal@@QBEHABV1@ABVnsCStringComparator@@@Z
?Equals@nsCSubstring@@QBEHABV1@ABVnsCStringComparator@@@Z
?ToLowerCase@@YAXAAVnsCSubstring@@@Z
?LossyAppendUTF16toASCII@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?Init@nsPromiseFlatString@@AAEXABVnsAString_internal@@@Z
?AppendASCIItoUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?SetLength@nsACString_internal@@QAEXI@Z
?Length@nsACString_internal@@QBEIXZ
?sCanonicalVTable@nsObsoleteAString@@2PBXB
?ToString@nsID@@QBEPADXZ
?free@nsCRT@@SAXPAD@Z
?assign_from_gs_contractid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByContractIDWithError@@ABUnsID@@@Z
?assign_with_AddRef@nsCOMPtr_base@@QAEXPAVnsISupports@@@Z
?NS_NewGenericModule2@@YAIPBUnsModuleInfo@@PAPAVnsIModule@@@Z
??1nsCOMPtr_base@@QAE@XZ
?Adopt@nsCSubstring@@QAEXPADI@Z
?sEmptyBuffer@?$nsCharTraits@D@@2PBDB
??1nsACString_internal@@QAE@XZ
?GetReadableBuffer@nsACString_internal@@IBEIPAPBD@Z
?sCanonicalVTable@nsObsoleteACString@@2PBXB
nspr4
PR_AtomicDecrement
PR_AtomicIncrement
PR_Free
PR_Malloc
PR_Realloc
kernel32
LoadLibraryA
GetProcAddress
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetLocaleInfoA
GetACP
GetCurrentProcessId
msvcr80
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
free
_encoded_null
_malloc_crt
_encode_pointer
memmove
memset
??_U@YAPAXI@Z
??_V@YAXPAX@Z
strncmp
strlen
memcpy
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
__clean_type_info_names_internal
Exports
Exports
Sections
.text Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 652KB - Virtual size: 650KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ