599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171

Sharing

Copy URL

Twitter E-mail

General

Target

599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171
Size

280KB
MD5

40c549486b4de232eb7ca4175981ddd6
SHA1

fd7c1f68aa0613b93139d1f0b9e109648412bf4c
SHA256

599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171
SHA512

509608dfe313ca7fe24f7fd7270640338ef1138edbac57d7223ae27ab8a72092d330a665081ac0ac92b271ece6a40d710279f7f68e60e9f2177c3543a0011a08
SSDEEP

3072:4ZYU2rPrsfgVml2lwrsryNqDiXDuFPw7QRFwiCrSsTICt/egcnjhpijRphKQJosa:mY1rtwlUusr2qD6DLec1egSgUQJuAI

Score

N/A

Malware Config

Signatures

Files

599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171
.dll windows x86

d54390ae70e704b3e16674e4151641d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

wcsftime
_ftol2
wcsspn
wcsncmp
wcscspn
_wtoi
_wcsicmp
wcsrchr
_wcslwr_s
memset
vswprintf_s
_vsnwprintf
memmove_s
free
malloc
calloc
??0exception@@QAE@ABQBD@Z
_localtime64_s
_wcsnicmp
memcpy
_purecall
_resetstkoflw
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
_callnewh
_XcptFilter
_initterm
_amsg_exit
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
??1type_info@@UAE@XZ
realloc
_errno
wcsstr
_time64
_vscwprintf
_CxxThrowException
wcsnlen
memcpy_s
__CxxFrameHandler3
??1exception@@UAE@XZ

kernel32

SetThreadPreferredUILanguages
InitializeCriticalSection
DeleteCriticalSection
GetLastError
GetThreadPreferredUILanguages
InterlockedIncrement
InterlockedDecrement
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetModuleHandleW
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
MultiByteToWideChar
lstrlenW
lstrcmpiW
Sleep
InterlockedCompareExchange
OutputDebugStringA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThread
CloseHandle
SetEvent
DeleteFileW
WaitForSingleObject
lstrcmpW
MoveFileW
CreateEventW
WaitForSingleObjectEx
CreateThread
CompareFileTime
SetLastError
CopyFileW
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
FileTimeToSystemTime
LoadLibraryW
GetProcAddress
RaiseException
LeaveCriticalSection
EnterCriticalSection

advapi32

RegSetValueExW
OpenThreadToken
GetLengthSid
GetTokenInformation
OpenProcessToken
CheckTokenMembership
IsValidSid
CopySid
RegCreateKeyExW
StartTraceW
EventEnabled
StopTraceW
ControlTraceW
EnableTraceEx
EventActivityIdControl
RegEnumValueW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
EventUnregister
EventRegister
SetNamedSecurityInfoW
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
InitializeAcl
AddAce
EventWrite

user32

LoadStringW
UnregisterClassA

ole32

CoTaskMemFree
StringFromGUID2
CoDisableCallCancellation
CoGetClassObject
CoEnableCallCancellation
CoCancelCall
CoFreeUnusedLibrariesEx
CLSIDFromString
CoTaskMemAlloc
CoCreateGuid
CoCreateInstance
CoTaskMemRealloc
CoFreeUnusedLibraries

oleaut32

SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString

shlwapi

PathFindFileNameW
PathFileExistsW

rpcrt4

UuidCreateSequential
MesHandleFree
MesEncodeDynBufferHandleCreate
MesDecodeBufferHandleCreate
NdrMesTypeEncode2
NdrMesTypeDecode2

wer

WerReportAddFile
WerReportSubmit
WerReportSetParameter
WerReportCreate
WerReportCloseHandle

wdi

WdiGetParameterByName
WdiSetResolution
WdiSetProblemDetectionResult
WdiGetDiagnosticModuleId
WdiGetParameterCount
WdiGetParameterByIndex
WdiGetParameterName
WdiGetParameterData
WdiGetInstanceId
WdiGetParameterDataLength
WdiAddParameter
WdiImpersonateClient
WdiRevertToSelf
WdiAddFileToInstance
WdiSetProgress
WdiGetScenarioInfo

ws2_32

ntohs

iphlpapi

ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToAlias
ConvertInterfaceGuidToLuid
ConvertInterfaceLuidToIndex
ConvertInterfaceLuidToGuid
GetAdaptersAddresses

userenv

UnloadUserProfile

shell32

SHGetFolderPathAndSubDirW

setupapi

SetupDiGetDeviceInstallParamsW
SetupOpenFileQueue
SetupDiSetSelectedDriverW
SetupDiDestroyDeviceInfoList
SetupDiSetDeviceInstallParamsW
SetupDiCallClassInstaller
SetupScanFileQueueW
SetupCloseFileQueue
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiOpenDevRegKey
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoW
SetupDiGetDriverInfoDetailW

nlaapi

NlaCreateTypeSet
NlaCloseQuery
NlaDeleteDataSet
NlaQueryNetData
NlaQueryNetSignatures
NlaOpenQuery
NlaAddToTypeSet
NlaDeleteTypeSet

ntdll

RtlIpv4AddressToStringW
RtlSubAuthoritySid
RtlIpv6AddressToStringW
RtlInitializeSid
WinSqmEndSession
WinSqmSetDWORD
WinSqmAddToStream
WinSqmSetString
WinSqmStartSession

Exports

Exports

HelperTraceEvent
WdiDiagnosticModuleMain
WdiGetDiagnosticModuleInterfaceVersion
WdiHandleInstance

Sections

.text
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d54390ae70e704b3e16674e4151641d4

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

advapi32

user32

ole32

oleaut32

shlwapi

rpcrt4

wer

wdi

ws2_32

iphlpapi

userenv

shell32

setupapi

nlaapi

ntdll

Exports

Exports

Sections

.text Size: 194KB - Virtual size: 194KB

.data Size: 61KB - Virtual size: 61KB

.rsrc Size: 14KB - Virtual size: 14KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 194KB - Virtual size: 194KB

.data
Size: 61KB - Virtual size: 61KB

.rsrc
Size: 14KB - Virtual size: 14KB

.reloc
Size: 9KB - Virtual size: 9KB