NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
b5fa7fdb6b651eaae7ce0f2763167564e29f69ec5b99957c90a63ace76938320.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b5fa7fdb6b651eaae7ce0f2763167564e29f69ec5b99957c90a63ace76938320.dll
Resource
win10v2004-20220812-en
General
-
Target
b5fa7fdb6b651eaae7ce0f2763167564e29f69ec5b99957c90a63ace76938320
-
Size
356KB
-
MD5
15fabc78612954bdb0977909a73ae499
-
SHA1
698ad8c9d8a477b5403ed7a170c3eebf21b6ffb5
-
SHA256
b5fa7fdb6b651eaae7ce0f2763167564e29f69ec5b99957c90a63ace76938320
-
SHA512
0b27d520358eaa3bb15d3fb2d8fdef49f938760d5b1863e10c3ca76b0904fbb3d2d0b03e54bf8640614d10947eb445bc03cb21ef6f22bc178f58d3c67cfe4090
-
SSDEEP
6144:ESlXKWHx/dP9d+Rque//kXzWSlNGzfliDPIdxU5i0XUJAFxhln+Yk9J:ESlXKmx/t0e3yqSAAjKLApl+Yk9J
Malware Config
Signatures
Files
-
b5fa7fdb6b651eaae7ce0f2763167564e29f69ec5b99957c90a63ace76938320.dll windows x86
26355a14fce2f409abf22e8f7f72b2fb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
xul
?Assign@nsSubstring@@QAEXABVnsAString_internal@@@Z
?GrowArrayBy@nsVoidArray@@MAEHH@Z
?Compact@nsVoidArray@@UAEXXZ
?SizeTo@nsVoidArray@@UAEHH@Z
?Clear@nsVoidArray@@UAEXXZ
??0nsVoidArray@@QAE@XZ
??1nsVoidArray@@UAE@XZ
?EqualsASCII@nsAString_internal@@QBEHPBDI@Z
?AssignASCII@nsAString_internal@@QAEXPBDI@Z
?assign_with_AddRef@nsCOMPtr_base@@QAEXPAVnsISupports@@@Z
?Assign@nsAString_internal@@QAEXABVnsSubstringTuple@@@Z
?Replace@nsSubstring@@QAEXIIPBGI@Z
?Rebind@nsDependentSubstring@@QAEXABVnsAString_internal@@II@Z
?NS_NewAtom@@YAPAVnsIAtom@@ABVnsAString_internal@@@Z
?FindChar@nsAString_internal@@QBEHGI@Z
?Assign@nsSubstring@@QAEXABVnsSubstringTuple@@@Z
?LowerCaseEqualsASCII@nsSubstring@@QBEHPBDI@Z
?AppendASCIItoUTF16@@YAXPBDAAVnsAString_internal@@@Z
?Assign@nsSubstring@@QAEXABV1@@Z
?AppendASCII@nsAString_internal@@QAEXPBDI@Z
NS_Alloc_P
NS_Free_P
??1nsPrintfCString@@QAE@XZ
?CopyASCIItoUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
??0nsPrintfCString@@QAA@IPBDZZ
??0nsAutoVoidArray@@QAE@XZ
?AppendUTF8toUTF16@@YAXPBDAAVnsAString_internal@@@Z
?Append@nsAString_internal@@QAEXG@Z
?Equals@nsSubstring@@QBEHABVnsAString_internal@@@Z
?Equals@nsSubstring@@QBEHABV1@ABVnsStringComparator@@@Z
?StringBeginsWith@@YAHABVnsAString_internal@@0ABVnsStringComparator@@@Z
??_7nsDefaultStringComparator@@6B@
?SetCapacity@nsSubstring@@QAEXI@Z
?Find@nsString@@QBEHABV1@HH@Z
?Adopt@nsSubstring@@QAEXPAGI@Z
??1nsCOMArray_base@@IAE@XZ
?assign_from_qi_with_error@nsCOMPtr_base@@QAEXABVnsQueryInterfaceWithError@@ABUnsID@@@Z
?EmptyString@@YAABVnsString@@XZ
?Assign@nsSubstring@@QAEXPBGI@Z
PL_DestroyEvent
PL_InitEvent
?ElementAt@nsVoidArray@@QBEPAXH@Z
?Equals@nsAString_internal@@QBEHABV1@ABVnsStringComparator@@@Z
?Replace@nsSubstring@@QAEXIIABVnsAString_internal@@@Z
?ReplaceASCII@nsSubstring@@QAEXIIPBDI@Z
??1nsACString_internal@@QAE@XZ
?Clear@nsCOMArray_base@@IAEXXZ
?InsertObjectAt@nsCOMArray_base@@IAEHPAVnsISupports@@H@Z
?RemoveObject@nsCOMArray_base@@IAEHPAVnsISupports@@@Z
?LossyAppendUTF16toASCII@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?CompressWhitespace@nsString@@QAEXHH@Z
?Assign@nsCSubstring@@QAEXABV1@@Z
?AppendUTF8toUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?Equals@nsCSubstring@@QBEHPBD@Z
?HashString@@YAIABVnsAString_internal@@@Z
?InsertStringAt@nsStringArray@@QAEHABVnsAString_internal@@H@Z
?RemoveStringAt@nsStringArray@@QAEHH@Z
?StringAt@nsStringArray@@QBEXHAAVnsAString_internal@@@Z
PL_DHashTableOperate
PL_DHashTableRawRemove
PL_DHashTableFinish
??0nsStringArray@@QAE@XZ
??1nsStringArray@@UAE@XZ
PL_DHashTableInit
PL_DHashFinalizeStub
PL_DHashMoveEntryStub
PL_DHashFreeTable
PL_DHashAllocTable
?NS_NewAtom@@YAPAVnsIAtom@@PBD@Z
?EqualsASCII@nsSubstring@@QBEHPBD@Z
?EnumerateForwards@nsVoidArray@@QAEHP6AHPAX0@Z0@Z
?RemoveElement@nsVoidArray@@QAEHPAX@Z
??4nsVoidArray@@QAEAAV0@ABV0@@Z
?GetReadableBuffer@nsAString_internal@@IBEIPAPBG@Z
?IndexOf@nsStringArray@@QBEHABVnsAString_internal@@@Z
?Init@nsPromiseFlatString@@AAEXABVnsSubstring@@@Z
?Append@nsAString_internal@@QAEXPBGI@Z
?SetCharAt@nsString@@QAEHGI@Z
?RFindChar@nsString@@QBEHGHH@Z
NS_QuickSort
?GetWritableBuffer@nsAString_internal@@IAEIPAPAG@Z
?EnsureMutable@nsSubstring@@IAEXXZ
?RemoveElementsAt@nsVoidArray@@QAEHHH@Z
?InsertElementAt@nsVoidArray@@QAEHPAXH@Z
?SetLength@nsSubstring@@QAEXI@Z
?AssignASCII@nsSubstring@@QAEXPBDI@Z
?EqualsASCII@nsSubstring@@QBEHPBDI@Z
?NS_GetWeakReference@@YAPAVnsIWeakReference@@PAVnsISupports@@PAI@Z
?IsVoid@nsAString_internal@@QBEHXZ
?Init@nsPromiseFlatString@@AAEXABVnsAString_internal@@@Z
??0nsQueryReferent@@QAE@PAVnsIWeakReference@@PAI@Z
?Equals@nsSubstring@@QBEHABV1@@Z
?FindChar@nsSubstring@@QBEHGI@Z
?Equals@nsAString_internal@@QBEHABV1@@Z
?assign_from_helper@nsCOMPtr_base@@QAEXABVnsCOMPtr_helper@@ABUnsID@@@Z
?Rebind@nsDependentSubstring@@QAEXABVnsSubstring@@II@Z
??0nsCreateInstanceByContractID@@QAE@PBDPAVnsISupports@@PAI@Z
??0nsCreateInstanceByCID@@QAE@ABUnsID@@PAVnsISupports@@PAI@Z
?SetIsVoid@nsAString_internal@@QAEXH@Z
?sEmptyBuffer@?$nsCharTraits@G@@2PBGB
?SetLength@nsAString_internal@@QAEXI@Z
?Append@nsAString_internal@@QAEXABV1@@Z
?assign_from_qi@nsCOMPtr_base@@QAEXVnsQueryInterface@@ABUnsID@@@Z
?assign_from_gs_cid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByCIDWithError@@ABUnsID@@@Z
?CopyUTF8toUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?AppendUTF16toUTF8@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
??1nsAString_internal@@QAE@XZ
?sCanonicalVTable@nsObsoleteAString@@2PBXB
?Assign@nsAString_internal@@QAEXABV1@@Z
?Length@nsAString_internal@@QBEIXZ
?ToString@nsID@@QBEPADXZ
?free@nsCRT@@SAXPAD@Z
?CallGetService@@YAIPBDABUnsID@@PAPAX@Z
?assign_from_gs_contractid@nsCOMPtr_base@@QAEXVnsGetServiceByContractID@@ABUnsID@@@Z
?assign_from_gs_contractid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByContractIDWithError@@ABUnsID@@@Z
?strcmp@nsCRT@@SAHPBD0@Z
?NS_NewGenericModule2@@YAIPBUnsModuleInfo@@PAPAVnsIModule@@@Z
??1nsCOMPtr_base@@QAE@XZ
?Adopt@nsCSubstring@@QAEXPADI@Z
?InsertElementsAt@nsVoidArray@@QAEHABV1@H@Z
?NS_RegisterStaticAtoms@@YAIPBUnsStaticAtom@@I@Z
?Replace@nsCSubstring@@QAEXIIPBDI@Z
??0nsCOMArray_base@@IAE@ABV0@@Z
?IndexOf@nsVoidArray@@QBEHPAX@Z
?RemoveObjectAt@nsCOMArray_base@@IAEHH@Z
?ReplaceElementAt@nsVoidArray@@QAEHPAXH@Z
?NS_NewAtom@@YAPAVnsIAtom@@ABVnsACString_internal@@@Z
?Append@nsAString_internal@@QAEXABVnsSubstringTuple@@@Z
?sEmptyBuffer@?$nsCharTraits@D@@2PBDB
?LossyCopyUTF16toASCII@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?sCanonicalVTable@nsObsoleteACString@@2PBXB
nspr4
PR_Malloc
PR_Free
PR_dtoa
PR_LocalTimeParameters
PR_Now
PR_ExplodeTime
PR_snprintf
PR_FormatTime
PR_strtod
js3250
JS_ValueToString
JS_GetStringChars
JS_GetStringLength
msvcp71
?_Nomemory@std@@YAXXZ
msvcr71
_except_handler3
__CppXcptFilter
_adjust_fdiv
_initterm
free
_callnewh
malloc
tolower
__dllonexit
log10
ceil
floor
fmod
memmove
memcpy
??_V@YAXPAX@Z
memset
??3@YAXPAX@Z
_purecall
fabs
_onexit
kernel32
DisableThreadLibraryCalls
Exports
Exports
Sections
.text Size: 148KB - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE