7186748869d4a33f16d87dde5e339d021d9c3d266c0d655ad8a7d6489f0c875b

Sharing

Copy URL Twitter E-mail

General

Target

7186748869d4a33f16d87dde5e339d021d9c3d266c0d655ad8a7d6489f0c875b
Size

1.3MB
MD5

65405e1a69434133684e1fc1eef27767
SHA1

da52cca57754fe154a661d4430a73ce5b3a2a3fb
SHA256

7186748869d4a33f16d87dde5e339d021d9c3d266c0d655ad8a7d6489f0c875b
SHA512

58f56a119e1e77c9abf2d2153cbf1bc9d38ad26d1934c4f53983e94472ad39b0a4f4194313c0de1b492e3b841b898ef8f9134d843faca04bf05714bc5d92efb1
SSDEEP

12288:gx3FdJIyh2PireQtCTS2dgpUdV5dtRsYu2MRRPrvPZ/Yrjnlyvq4WNt0YxeAljcg:g3Fp12Jdzp3MRtpyiq4WN9j

Score

N/A

Malware Config

Signatures

Files

7186748869d4a33f16d87dde5e339d021d9c3d266c0d655ad8a7d6489f0c875b
.dll windows x86

a587891ee8cb2aa079030e7db13b829e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__CxxFrameHandler3
_wcsicmp
wcsstr
memcpy
wcspbrk
_wcsnicmp
iswgraph
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
malloc
_callnewh
_CxxThrowException
free
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
_purecall
__RTDynamicCast
memset
_vsnwprintf
iswxdigit

atl

ord15
ord23
ord21
ord16
ord32

netshell

HrGetIconFromMediaType
NcFreeNetconProperties

shlwapi

PathGetArgsW
PathRemoveArgsW
PathCanonicalizeW
PathUnquoteSpacesW
PathQuoteSpacesW
PathFileExistsW
AssocQueryStringW

shell32

ord893
ShellExecuteExW

gdiplus

GdipAlloc
GdipDisposeImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateHICONFromBitmap
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree

advapi32

RegCreateKeyW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
EventWrite
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
EventUnregister
EventRegister

setupapi

SetupDiOpenDevRegKey
SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

user32

SendDlgItemMessageW
SetPropW
RemovePropW
GetPropW
GetParent
MessageBoxW
LoadCursorW
SetCursor
ShowWindow
PeekMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
LoadStringW
MapWindowPoints
PtInRect
PostMessageW
SetWindowLongW
GetClientRect
GetSystemMetrics
LoadImageW
DestroyIcon
GetDlgItem
EnableWindow
SendMessageW
SetForegroundWindow

ole32

CoTaskMemAlloc
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
StringFromGUID2
CLSIDFromString
CoInitializeEx
CoTaskMemFree

oleaut32

VariantInit
SysAllocString
SysFreeString

userenv

ExpandEnvironmentStringsForUserW

kernel32

CreateThread
CloseHandle
FormatMessageW
FreeLibrary
TlsGetValue
TlsSetValue
GetProcAddress
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
DisableThreadLibraryCalls
LoadLibraryW
TlsFree
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LocalFree
lstrcmpiW
GetProcessHeap
HeapReAlloc
HeapAlloc
GetModuleHandleW
FindResourceW
LoadResource
LockResource
HeapFree
CreateFileW
GetUserDefaultUILanguage
GetUserGeoID
ReadFile
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
GetModuleFileNameW
TlsAlloc
TerminateProcess
GetCurrentProcess
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

Exports

Exports

AddConnectionOptionListEntries
CreateVPNConnection
DllCanUnloadNow
DllGetClassObject
GetInternetConnected
GetNetworkConnected
GetVPNConnected
HrIsInternetConnected
HrIsInternetConnectedGUID
IsInternetConnected
IsInternetConnectedGUID
IsUniqueConnectionName
RegisterPageWithPage
UnregisterPage
UnregisterPagesLink

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a587891ee8cb2aa079030e7db13b829e

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

atl

netshell

shlwapi

shell32

gdiplus

advapi32

setupapi

user32

ole32

oleaut32

userenv

kernel32

Exports

Exports

Sections

.text Size: 134KB - Virtual size: 133KB

.data Size: 86KB - Virtual size: 86KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 21KB - Virtual size: 21KB

.text
Size: 134KB - Virtual size: 133KB

.data
Size: 86KB - Virtual size: 86KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 21KB - Virtual size: 21KB