3548978de3de80b720c196bf77cd31d04f113481e9812e87e43f2a9a651b5478

Sharing

Copy URL Twitter E-mail

General

Target

3548978de3de80b720c196bf77cd31d04f113481e9812e87e43f2a9a651b5478
Size

403KB
MD5

019374f76641a13cd63569922abbfc90
SHA1

c93ae6d5efefa8d731ba8e86bf277a8ebd19971a
SHA256

3548978de3de80b720c196bf77cd31d04f113481e9812e87e43f2a9a651b5478
SHA512

c8be99bfc006b31955be621b438732d06bd79b6e54d3aca292e1fb595366a1c1dc9e76f642f6d557967037de32aaa288c7998566ef3d40facbfb19da6eb735b1
SSDEEP

12288:36EAdiIekYthida1hhedgeb22Rn/tZeQB:qEAdimLda1hheX2QVQ

Score

N/A

Malware Config

Signatures

Files

3548978de3de80b720c196bf77cd31d04f113481e9812e87e43f2a9a651b5478
.dll regsvr32 windows x86

86660019029121b29ff1b3398c0c83d4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcsicmp
wcscpy
wcsncmp
_ltoa
wcsstr
wcscat
sprintf
isalpha
iscntrl
isspace
time
islower
iswlower
iswdigit
iswxdigit
wcstol
wcschr
isdigit
memchr
wcstok
_wtoi
wcsncpy
wcsncat
_wcsnicmp
wcscmp
rand
free
_initterm
malloc
_adjust_fdiv
__dllonexit
_onexit
_purecall
isxdigit
wcsrchr
_except_handler3

shlwapi

StrStrW
StrCmpW
StrCmpNIW
StrCpyNW
StrStrIA
StrCmpIW
StrChrA
ord342
ord151
SHGetValueA
StrToIntA
StrCmpNIA
StrNCatA
StrRChrA
UrlCombineA
UrlCanonicalizeA
ord153
StrStrA
UrlUnescapeA

advapi32

RegOpenKeyA
RegCreateKeyExW
AllocateAndInitializeSid
SetEntriesInAclA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
GetUserNameA
OpenProcessToken
GetTokenInformation
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
OpenThreadToken
RevertToSelf
SetThreadToken
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegQueryValueA

kernel32

ResetEvent
RtlMoveMemory
CreateFileA
lstrcpynA
SetFilePointer
SetEndOfFile
WriteFile
OutputDebugStringA
SetErrorMode
GetDateFormatA
GetSystemTime
GetSystemInfo
CreateIoCompletionPort
GetQueuedCompletionStatus
CreateThread
FreeLibraryAndExitThread
Sleep
SetEvent
InterlockedCompareExchange
GetLocalTime
SystemTimeToFileTime
FileTimeToSystemTime
LocalAlloc
LocalFree
InterlockedIncrement
GetCPInfo
IsDBCSLeadByteEx
WaitForSingleObject
ReleaseMutex
CreateMutexA
GlobalAlloc
TlsFree
TlsGetValue
TlsAlloc
TlsSetValue
InterlockedExchangeAdd
GetExitCodeThread
LocalFileTimeToFileTime
GetModuleHandleA
lstrcmpA
FormatMessageW
GlobalUnlock
GlobalLock
LoadLibraryW
CompareFileTime
GlobalSize
DeviceIoControl
GetComputerNameA
VirtualFree
VirtualAlloc
CreateSemaphoreA
ReleaseSemaphore
RaiseException
GlobalMemoryStatus
IsBadStringPtrA
PostQueuedCompletionStatus
GetLastError
MultiByteToWideChar
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
InitializeCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
lstrlenA
lstrcatA
lstrcpyA
InterlockedExchange
GetVersionExA
GlobalFree
SetLastError
IsBadWritePtr
IsBadStringPtrW
IsBadReadPtr
WideCharToMultiByte
lstrlenW
IsBadCodePtr
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
lstrcmpiA
CreateEventA
CloseHandle
GetCurrentThread
lstrcmpiW
GetModuleFileNameW

user32

wsprintfW
CreateWindowExA
SetWindowLongA
MsgWaitForMultipleObjects
UnregisterClassA
RegisterClassA
PostMessageA
GetWindowLongA
DefWindowProcA
DestroyWindow
PeekMessageA
TranslateMessage
DispatchMessageA
CharLowerA
CharUpperA
CharToOemA
wsprintfA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
WinHttpAddRequestHeaders
WinHttpCheckPlatform
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WinHttpCreateUrl
WinHttpDetectAutoProxyConfigUrl
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryAuthSchemes
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpQueryOption
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetCredentials
WinHttpSetDefaultProxyConfiguration
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpTimeFromSystemTime
WinHttpTimeToSystemTime
WinHttpWriteData

Sections

.text
Size: 311KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

86660019029121b29ff1b3398c0c83d4

Headers

File Characteristics

Imports

msvcrt

shlwapi

advapi32

kernel32

user32

Exports

Exports

Sections

.text Size: 311KB - Virtual size: 311KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 13KB - Virtual size: 13KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 311KB - Virtual size: 311KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 13KB - Virtual size: 13KB

.rmnet
Size: 56KB - Virtual size: 60KB