6c226d3e720402b577f13621d2d9d9f07480489fcb1b28a2abd734952064d046

Sharing

Copy URL Twitter E-mail

General

Target

6c226d3e720402b577f13621d2d9d9f07480489fcb1b28a2abd734952064d046
Size

211KB
MD5

696df4b0b6ecb145cf6e63d2e96a8000
SHA1

43e2582b79b2783e466ecae4f4a3de332c48a607
SHA256

6c226d3e720402b577f13621d2d9d9f07480489fcb1b28a2abd734952064d046
SHA512

5b7a468061366669c8fe043d0d483b56ef4757fcdc1d390585f1be00600cb3f988041dc746267cc93434b888b516c7ff454d780ac728932d9bd92edb53033a5d
SSDEEP

6144:gHj/rW0JocOvshv02OlDpJyWFe7x/UdlnEjDl5TAp:ej/dOvshKJyCe7x/UlnE/o

Score

N/A

Malware Config

Signatures

Files

6c226d3e720402b577f13621d2d9d9f07480489fcb1b28a2abd734952064d046
.dll windows x86

df2ab948fad630fe2cae9e47c07d249e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

cppuhelper3msc

?bootstrap_expandUri@cppu@@YA?AVOUString@rtl@@ABV23@@Z

sal3

osl_searchFileURL
osl_getExecutableFile
rtl_uriConvertRelToAbs
rtl_bootstrap_get
osl_getModuleURLFromFunctionAddress
rtl_ustr_lastIndexOfChar_WithLength
rtl_ustr_indexOfChar_WithLength
rtl_string_newFromStr_WithLength
osl_getSystemTime
osl_createDirectoryPath
osl_getFileStatus
osl_releaseDirectoryItem
osl_setFileSize
osl_setFilePos
osl_closeFile
osl_openFile
rtl_fillMemory
rtl_byte_sequence_reference2One
rtl_byte_sequence_constructFromArray
rtl_byte_sequence_assign
rtl_byte_sequence_construct
rtl_ustr_valueOfInt64
rtl_str_toInt64
rtl_str_getLength
osl_getSystemPathFromFileURL
rtl_bootstrap_get_from_handle
rtl_bootstrap_args_open
osl_getFileURLFromSystemPath
osl_getAbsoluteFileURL
rtl_uStringbuffer_insert_ascii
rtl_uStringbuffer_insert
rtl_uString_new_WithLength
rtl_uString_newFromAscii
rtl_ustr_valueOfInt32
rtl_uString_newFromStr_WithLength
rtl_ustr_toInt64
rtl_uString_getToken
rtl_uString_newTrim
rtl_uString_newConcat
rtl_uString_assign
osl_getThreadTextEncoding
osl_loadModule
rtl_allocateMemory
rtl_copyMemory
rtl_freeMemory
osl_getGlobalMutex
osl_releaseMutex
osl_acquireMutex
osl_destroyMutex
osl_createMutex
osl_getFunctionSymbol
osl_unloadModule
rtl_byte_sequence_equals
rtl_byte_sequence_release
rtl_byte_sequence_acquire
rtl_ustr_reverseCompare_WithLength
rtl_ustr_compare_WithLength
rtl_uString_release
rtl_string2UString
rtl_uString_acquire
rtl_uString_new
rtl_string_newConcat
rtl_str_reverseCompare_WithLength
rtl_str_compare_WithLength
rtl_string_assign
rtl_string_release
rtl_uString2String
rtl_string_newFromStr
rtl_string_acquire
rtl_string_new
osl_getDirectoryItem

libxml2

xmlStrcmp
xmlNodeSetContent
xmlSaveFormatFile
xmlNewDoc
xmlNewDocComment
xmlNewDocNode
xmlNewNs
xmlDocSetRootElement
xmlNewComment
xmlAddPrevSibling
xmlSaveFormatFileEnc
xmlSetProp
xmlUnlinkNode
xmlXPathFreeObject
xmlXPathFreeContext
xmlFreeDoc
xmlCharStrdup
xmlFree
xmlNodeListGetString
xmlXPathEvalExpression
xmlXPathRegisterNs
xmlXPathNewContext
xmlParseFile
xmlFreeNode
xmlGetProp
xmlAddChild
xmlNewText
xmlSetNsProp
xmlNewTextChild
xmlSearchNsByHref
xmlDocGetRootElement
xmlGetNsProp
xmlNodeSetContentLen
xmlNewChild

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

msvcr90

_except_handler4_common
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_crt_debugger_hook
_encode_pointer
getenv
??_U@YAPAXI@Z
__iob_func
fprintf
??2@YAPAXI@Z
_invalid_parameter_noinfo
??_V@YAXPAX@Z
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??3@YAXPAX@Z
??0exception@std@@QAE@ABQBDH@Z
?what@exception@std@@UBEPBDXZ
__CxxFrameHandler3
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_malloc_crt
__CppXcptFilter

msvcp90

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

kernel32

UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
SetUnhandledExceptionFilter
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent
GetCurrentThreadId

Exports

Exports

GetVersionInfo
jfw_addJRELocation
jfw_areEqualJavaInfo
jfw_existJRE
jfw_findAllJREs
jfw_findAndSelectJRE
jfw_freeJavaInfo
jfw_getEnabled
jfw_getJRELocations
jfw_getJavaInfoByPath
jfw_getSelectedJRE
jfw_getUserClassPath
jfw_getVMParameters
jfw_isVMRunning
jfw_lock
jfw_setEnabled
jfw_setJRELocations
jfw_setSelectedJRE
jfw_setUserClassPath
jfw_setVMParameters
jfw_startVM
jfw_unlock

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 107KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

df2ab948fad630fe2cae9e47c07d249e

Headers

DLL Characteristics

File Characteristics

Imports

cppuhelper3msc

sal3

libxml2

advapi32

msvcr90

msvcp90

kernel32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 68KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text Size: 107KB - Virtual size: 108KB

.text
Size: 68KB - Virtual size: 68KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 107KB - Virtual size: 108KB