0079fa052f41d0532f4454097bbaafd53cf881c1dfa7d2715aa0851ef39711dc

Sharing

Copy URL Twitter E-mail

General

Target

0079fa052f41d0532f4454097bbaafd53cf881c1dfa7d2715aa0851ef39711dc
Size

289KB
MD5

a11b9aebde325562289242fad39b4ae0
SHA1

948c60883912301ad3904f713ab625400e4eb413
SHA256

0079fa052f41d0532f4454097bbaafd53cf881c1dfa7d2715aa0851ef39711dc
SHA512

96ac6b46d4339756e8db559f13987673c754ffd11ab919a46579fea1323f28a36517f69b57ef60b2a1f7bb25f2712b61f5dfee80005838d813381fb7cd143ee1
SSDEEP

6144:YvgD9QAG2q2TM6s+t8BA8jcxmZkClvEauLSVpbV9:YvgD9s2GvYA9Hu4L

Score

N/A

Malware Config

Signatures

Files

0079fa052f41d0532f4454097bbaafd53cf881c1dfa7d2715aa0851ef39711dc
.dll windows x86

499599933283a256ec6bca674e933c1e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtMapViewOfSection
NtCreateSection
NtUnmapViewOfSection
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtQuerySystemInformation
NtQueryVirtualMemory
_alloca_probe
NtQueryDirectoryFile
NtOpenFile
RtlxAnsiStringToUnicodeSize
NlsMbCodePageTag
RtlUnicodeStringToInteger
DbgPrint
NtQueryInformationProcess
RtlGetVersion
NtEnumerateValueKey
NtQueryKey
NtCreateKey
NtSetValueKey
NtDeleteValueKey
RtlDowncaseUnicodeString
RtlGetFullPathName_U
NtSetInformationKey
NtDeleteKey
strpbrk
strspn
_wcsupr
RtlUpcaseUnicodeChar
toupper
RtlUpcaseUnicodeString
NtWriteFile
RtlSecondsSince1970ToTime
RtlImageRvaToVa
RtlGUIDFromString
strchr
isdigit
LdrResFindResource
LdrResSearchResource
RtlUnwind
NtReadFile
qsort
NtDeleteFile
NtCreateFile
RtlDoesFileExists_U
NtOpenProcessToken
NtQueryInformationToken
RtlGetFileMUIPath
NtQueryInformationFile
RtlCreateUnicodeString
_vscwprintf
EtwEventRegister
EtwEventUnregister
EtwEventWrite
RtlAppendUnicodeStringToString
DbgPrintEx
wcsstr
strncmp
wcspbrk
wcsspn
wcschr
_vsnwprintf
ord7
RtlGetNativeSystemInformation
ord3
ord4
RtlEnterCriticalSection
LdrInitShimEngineDynamic
RtlLeaveCriticalSection
LdrLoadDll
LdrGetProcedureAddress
LdrUnloadDll
RtlTimeToTimeFields
RtlCompareUnicodeString
strrchr
LdrLockLoaderLock
LdrUnlockLoaderLock
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlInitString
LdrGetProcedureAddressEx
NtFlushInstructionCache
LdrFindEntryForAddress
RtlImageDirectoryEntryToData
_stricmp
_vsnprintf
RtlDeleteCriticalSection
RtlInitializeCriticalSection
_wcsnicmp
NtProtectVirtualMemory
RtlDosPathNameToNtPathName_U
LdrGetDllHandle
NtOpenKey
NtQueryValueKey
RtlExpandEnvironmentStrings_U
NtClose
RtlFormatCurrentUserKeyPath
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlStringFromGUID
RtlDuplicateUnicodeString
RtlQueryEnvironmentVariable_U
RtlSetEnvironmentVariable
RtlUnicodeStringToAnsiString
RtlFreeHeap
RtlFreeAnsiString
RtlDosPathNameToRelativeNtPathName_U
WinSqmIsOptedIn
RtlRandom
RtlCompareMemory
wcsnlen
RtlCaptureStackBackTrace
RtlNtStatusToDosError
RtlCreateServiceSid
RtlLengthRequiredSid
RtlEqualSid
RtlGetOwnerSecurityDescriptor
NtQuerySecurityObject
ord6
_strnicmp
RtlCreateUnicodeStringFromAsciiz
NtQueryObject
_strupr
_itoa_s
strcpy_s
LdrEnumerateLoadedModules
wcscat_s
wcscpy_s
RtlComputeCrc32
memset
NtApphelpCacheControl
wcsrchr
_wcsicmp
memcpy
RtlInitUnicodeString
RtlNtPathNameToDosPathName
RtlpEnsureBufferSize
RtlFreeUnicodeString
RtlAllocateHeap
RtlUpcaseUnicodeToMultiByteN
memmove
RtlReleaseRelativeName
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlImageNtHeader

kernel32

RegOpenKeyExA
RegOpenKeyExW
RegGetKeySecurity
RegCloseKey
GetModuleFileNameW
WideCharToMultiByte
CompareStringW
CompareStringA
lstrlenA
LoadLibraryExW
SetLastError
GetFileSizeEx
LocalAlloc
LocalFree
GetSystemDirectoryW
GetFileAttributesW
GetCurrentDirectoryW
WriteFile
IsDBCSLeadByte
VerLanguageNameW
OutputDebugStringW
GetLongPathNameW
ReadProcessMemory
GetSystemWindowsDirectoryW
Wow64DisableWow64FsRedirection
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
Wow64RevertWow64FsRedirection
GetUserDefaultUILanguage
FreeLibrary
GetTempPathW
GetTempFileNameW
LoadLibraryW
SetErrorMode
GetProcessTimes
FindNextFileW
FindClose
FindFirstFileW
SetFilePointerEx
SetFilePointer
ReadFile
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
TerminateProcess
GetProcessHeap
GetCurrentProcess
IsWow64Process
GetModuleHandleW
GetProcAddress
GetCurrentProcessId
OutputDebugStringA
FindResourceW
LoadResource
LockResource
SizeofResource
BaseDumpAppcompatCache
BaseFlushAppcompatCache
GetDriveTypeW
BaseCheckAppcompatCacheEx
BaseUpdateAppcompatCache
BaseIsAppcompatInfrastructureDisabled
OpenProcess
CreateFileW
GetLastError
CloseHandle
DisableThreadLibraryCalls
CompareFileTime

api-ms-win-security-base-l1-1-0

GetAclInformation
GetAce
GetSecurityDescriptorDacl

Exports

Exports

AllowPermLayer
ApphelpCheckExe
ApphelpCheckIME
ApphelpCheckInstallShieldPackage
ApphelpCheckModule
ApphelpCheckMsiPackage
ApphelpCheckRunApp
ApphelpCheckRunAppEx
ApphelpCheckShellObject
ApphelpCreateAppcompatData
ApphelpFixMsiPackage
ApphelpFixMsiPackageExe
ApphelpFreeFileAttributes
ApphelpGetFileAttributes
ApphelpGetMsiProperties
ApphelpGetNTVDMInfo
ApphelpGetShimDebugLevel
ApphelpParseModuleData
ApphelpQueryModuleData
ApphelpQueryModuleDataEx
ApphelpShowDialog
ApphelpUpdateCacheEntry
GetPermLayers
SE_DllLoaded
SE_DllUnloaded
SE_DynamicShim
SE_GetHookAPIs
SE_GetMaxShimCount
SE_GetProcAddressIgnoreIncExc
SE_GetProcAddressLoad
SE_GetShimCount
SE_InstallAfterInit
SE_InstallBeforeInit
SE_IsShimDll
SE_LdrEntryRemoved
SE_ProcessDying
SdbAddLayerTagRefToQuery
SdbApphelpNotify
SdbApphelpNotifyEx
SdbApphelpNotifyEx2
SdbBeginWriteListTag
SdbBuildCompatEnvVariables
SdbCloseApphelpInformation
SdbCloseDatabase
SdbCloseDatabaseWrite
SdbCloseLocalDatabase
SdbCommitIndexes
SdbCreateDatabase
SdbCreateHelpCenterURL
SdbCreateMsiTransformFile
SdbDeclareIndex
SdbDeletePermLayerKeys
SdbDumpSearchPathPartCaches
SdbEndWriteListTag
SdbEnumMsiTransforms
SdbEscapeApphelpURL
SdbFindCustomActionForPackage
SdbFindFirstDWORDIndexedTag
SdbFindFirstGUIDIndexedTag
SdbFindFirstMsiPackage
SdbFindFirstMsiPackage_Str
SdbFindFirstNamedTag
SdbFindFirstStringIndexedTag
SdbFindFirstTag
SdbFindFirstTagRef
SdbFindMsiPackageByID
SdbFindNextDWORDIndexedTag
SdbFindNextGUIDIndexedTag
SdbFindNextMsiPackage
SdbFindNextStringIndexedTag
SdbFindNextTag
SdbFindNextTagRef
SdbFormatAttribute
SdbFreeDatabaseInformation
SdbFreeFileAttributes
SdbFreeFileInfo
SdbFreeFlagInfo
SdbGUIDFromString
SdbGUIDToString
SdbGetAppCompatDataSize
SdbGetAppPatchDir
SdbGetBinaryTagData
SdbGetDatabaseGUID
SdbGetDatabaseID
SdbGetDatabaseInformation
SdbGetDatabaseInformationByName
SdbGetDatabaseMatch
SdbGetDatabaseVersion
SdbGetDllPath
SdbGetEntryFlags
SdbGetFileAttributes
SdbGetFileImageType
SdbGetFileImageTypeEx
SdbGetFileInfo
SdbGetFirstChild
SdbGetImageType
SdbGetIndex
SdbGetItemFromItemRef
SdbGetLayerName
SdbGetLayerTagRef
SdbGetLocalPDB
SdbGetMatchingExe
SdbGetMsiPackageInformation
SdbGetNamedLayer
SdbGetNextChild
SdbGetNthUserSdb
SdbGetPDBFromGUID
SdbGetPermLayerKeys
SdbGetShowDebugInfoOption
SdbGetShowDebugInfoOptionValue
SdbGetStandardDatabaseGUID
SdbGetStringTagPtr
SdbGetTagDataSize
SdbGetTagFromTagID
SdbGrabMatchingInfo
SdbGrabMatchingInfoEx
SdbInitDatabase
SdbInitDatabaseEx
SdbIsNullGUID
SdbIsStandardDatabase
SdbIsTagrefFromLocalDB
SdbIsTagrefFromMainDB
SdbLoadString
SdbMakeIndexKeyFromString
SdbOpenApphelpDetailsDatabase
SdbOpenApphelpDetailsDatabaseSP
SdbOpenApphelpInformation
SdbOpenApphelpInformationByID
SdbOpenApphelpResourceFile
SdbOpenDatabase
SdbOpenDbFromGuid
SdbOpenLocalDatabase
SdbPackAppCompatData
SdbQueryApphelpInformation
SdbQueryBlockUpgrade
SdbQueryContext
SdbQueryData
SdbQueryDataEx
SdbQueryDataExTagID
SdbQueryFlagInfo
SdbQueryFlagMask
SdbQueryName
SdbQueryReinstallUpgrade
SdbReadApphelpData
SdbReadApphelpDetailsData
SdbReadBYTETag
SdbReadBYTETagRef
SdbReadBinaryTag
SdbReadDWORDTag
SdbReadDWORDTagRef
SdbReadEntryInformation
SdbReadMsiTransformInfo
SdbReadPatchBits
SdbReadQWORDTag
SdbReadQWORDTagRef
SdbReadStringTag
SdbReadStringTagRef
SdbReadWORDTag
SdbReadWORDTagRef
SdbRegisterDatabase
SdbRegisterDatabaseEx
SdbReleaseDatabase
SdbReleaseMatchingExe
SdbResolveDatabase
SdbSetApphelpDebugParameters
SdbSetEntryFlags
SdbSetImageType
SdbSetPermLayerKeys
SdbShowApphelpDialog
SdbShowApphelpFromQuery
SdbStartIndexing
SdbStopIndexing
SdbStringDuplicate
SdbStringReplace
SdbStringReplaceArray
SdbTagIDToTagRef
SdbTagRefToTagID
SdbTagToString
SdbUnpackAppCompatData
SdbUnregisterDatabase
SdbWriteBYTETag
SdbWriteBinaryTag
SdbWriteBinaryTagFromFile
SdbWriteDWORDTag
SdbWriteNULLTag
SdbWriteQWORDTag
SdbWriteStringRefTag
SdbWriteStringTag
SdbWriteStringTagDirect
SdbWriteWORDTag
SetPermLayerState
SetPermLayers
ShimDbgPrint
ShimDumpCache
ShimFlushCache

Sections

.text
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

499599933283a256ec6bca674e933c1e

Headers

File Characteristics

Imports

ntdll

kernel32

api-ms-win-security-base-l1-1-0

Exports

Exports

Sections

.text Size: 236KB - Virtual size: 236KB

.data Size: 7KB - Virtual size: 8KB

.rsrc Size: 34KB - Virtual size: 34KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 236KB - Virtual size: 236KB

.data
Size: 7KB - Virtual size: 8KB

.rsrc
Size: 34KB - Virtual size: 34KB

.reloc
Size: 9KB - Virtual size: 9KB