584dc7417414a85268690005429f8125dc4b4e837e67839f6cbe1e8577a462f3

Sharing

Copy URL Twitter E-mail

General

Target

584dc7417414a85268690005429f8125dc4b4e837e67839f6cbe1e8577a462f3
Size

314KB
MD5

15d773e595647781359788e82f2c3430
SHA1

1300f063066263052e9b4390e3ec63ddc31c9841
SHA256

584dc7417414a85268690005429f8125dc4b4e837e67839f6cbe1e8577a462f3
SHA512

9fbd5df71186d4d9e7c86308a481fad1b8dc3c3a14e414ac2db24ec445cc434e3bb4920186bb5b71a8b6ef2b9dc8dd6b6511784c3907f27cdd04f69cc6243dd9
SSDEEP

6144:XF/TR5riixfNvEEQZpEe8P8jL5ka7XkYOgHmFKY8U1Zzt+YpmR:XVxFMEQHLU8jLb7XCKzkZZ/p8

Score

N/A

Malware Config

Signatures

Files

584dc7417414a85268690005429f8125dc4b4e837e67839f6cbe1e8577a462f3
.dll windows x86

0be84a7282ded7e372cbd050df196294

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
calloc
fgetc
getc
ungetc
fprintf
_errno
fopen_s
??3@YAXPAX@Z
__CxxFrameHandler3
memcpy
??2@YAPAXI@Z
free
_strdup
vswprintf_s
malloc
atoi
strcpy_s
_wcsnicmp
strcat_s
_strlwr_s
_except_handler3
atol
realloc
_stricmp
memset
memmove
isdigit
isupper
strncmp
fclose
_ltoa_s
vsprintf_s
isspace
strchr
isxdigit
toupper
isalpha

kernel32

LocalFree
LocalAlloc
RtlMoveMemory
DeviceIoControl
HeapFree
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetDiskFreeSpaceA
SetLastError
IsBadWritePtr
IsBadReadPtr
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetVersionExA
GetTickCount
GetLastError
GlobalMemoryStatus
WideCharToMultiByte
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
GetACP
GetLocaleInfoA
LoadLibraryA
GetModuleFileNameA
IsBadStringPtrA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrlenA
lstrcmpiA
IsBadStringPtrW
MultiByteToWideChar
lstrcpyW
lstrlenW
GetSystemDefaultLCID
GetUserDefaultLCID
lstrcmpA
CloseHandle
CreateFileA
Sleep
RaiseException
LockResource
LoadResource
FindResourceA
IsValidCodePage
GetFileAttributesA
GetProcessHeap
GetFullPathNameA
GetFullPathNameW
LoadLibraryExA
LoadLibraryExW
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
lstrcpynA
lstrcpyA
VirtualProtect
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLocalTime
HeapAlloc
FreeLibrary

advapi32

RegSetValueExA
CryptGetProvParam
CryptReleaseContext
CryptAcquireContextA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptDestroyKey
CryptDestroyHash
CryptVerifySignatureA
CryptHashData
CryptCreateHash
RegDeleteKeyA
RegEnumKeyExA
RegEnumValueA
RegQueryValueExW
RegQueryInfoKeyA
RegOpenKeyExW

user32

SetDlgItemTextA
MessageBoxW
GetActiveWindow
IsDlgButtonChecked
GetDlgItem
EnableWindow
SetWindowTextA
SetWindowTextW
DialogBoxParamW
WinHelpA
GetDlgItemTextA
GetDlgItemInt
EndDialog
SetDlgItemTextW
SetFocus
SetWindowLongA
SetDlgItemInt
ShowWindow
SendMessageA
IsWindow
GetWindowLongA

crypt32

CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertSetCertificateContextProperty
CertOpenStore
CertAddEncodedCertificateToStore
CertGetIssuerCertificateFromStore
CertCompareCertificateName
CertAddCertificateContextToStore
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CryptImportPublicKeyInfo
CertCreateCertificateContext
CertSaveStore
CertGetSubjectCertificateFromStore
CertCompareCertificate
CryptDecodeObject
CryptEncodeObject
CertStrToNameA
CertNameToStrW

ole32

CoTaskMemFree
CoTaskMemAlloc

Exports

Exports

BuildEnrollmentMessage
BuildRenewalMessage
CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
ChangeStorePassword
PStoreToEPF
ProcessEnrollmentResponse
UpgradeEpfToPstore

Sections

.text
Size: 242KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0be84a7282ded7e372cbd050df196294

Headers

File Characteristics

Imports

msvcr80

kernel32

advapi32

user32

crypt32

ole32

Exports

Exports

Sections

.text Size: 242KB - Virtual size: 242KB

.data Size: 1024B - Virtual size: 7KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 10KB - Virtual size: 10KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 242KB - Virtual size: 242KB

.data
Size: 1024B - Virtual size: 7KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 10KB - Virtual size: 10KB

.rmnet
Size: 56KB - Virtual size: 60KB