cc87b82b8af6d906657bc373fcdb7b8a48035ed8b651da3424de6ba10d11659f

Sharing

Copy URL

Twitter E-mail

General

Target

cc87b82b8af6d906657bc373fcdb7b8a48035ed8b651da3424de6ba10d11659f
Size

337KB
MD5

90a2bb9629a8910139ec1979eea58a81
SHA1

31be20f28a421697fd0413f0ea384c46692ea7d3
SHA256

cc87b82b8af6d906657bc373fcdb7b8a48035ed8b651da3424de6ba10d11659f
SHA512

4e63887a681d5d44a3d454fb926d78b0314002184d2057c8f32185c29d4125ed6849b306eade806609f6c3cf8e77cfe509c1befe45e61edffc885174646ed8c6
SSDEEP

6144:WS9akwp1uXbe3swM22Rk4IfyBKJ5IJteVvWtPfrHGo4eun:R9aZvuy3swM2VjBesvWtCo4Dn

Score

N/A

Malware Config

Signatures

Files

cc87b82b8af6d906657bc373fcdb7b8a48035ed8b651da3424de6ba10d11659f
.dll windows x86

0b45d32ed3fcc01d4f708a7453a80b92

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenEventLogW
ReadEventLogW
CloseEventLog
ObjectDeleteAuditAlarmW
ImpersonateNamedPipeClient
GetAclInformation
CopySid
ReportEventW
RegisterEventSourceW
ObjectOpenAuditAlarmW
CreatePrivateObjectSecurityEx
SetPrivateObjectSecurity
CreatePrivateObjectSecurity
DeleteAce
CheckTokenMembership
LookupPrivilegeValueW
AdjustTokenPrivileges
SetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
OpenProcessToken
MapGenericMask
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetLengthSid
InitializeAcl
AddAccessAllowedAce
AddAccessDeniedAce
MakeSelfRelativeSD
DestroyPrivateObjectSecurity
GetAce
ImpersonateSelf
RevertToSelf
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
InitializeSecurityDescriptor
SetEntriesInAclW
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
AllocateAndInitializeSid
FreeSid
RegOpenKeyExW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
GetUserNameW
AreAnyAccessesGranted
AccessCheck
AreAllAccessesGranted
OpenThreadToken
GetTokenInformation
ObjectCloseAuditAlarmW
GetSecurityDescriptorLength

gdi32

TranslateCharsetInfo
GetTextMetricsW
StartDocW
SetBkMode
StartPage
EndPage
EndDoc
AbortDoc
GdiGetSpoolFileHandle
GdiGetDC
GdiGetPageCount
GetWorldTransform
GdiStartDocEMF
GdiEndDocEMF
GdiDeleteSpoolFileHandle
GdiGetPageHandle
GdiStartPageEMF
GdiGetDevmodeForPage
GdiEndPageEMF
GdiResetDCEMF
ResetDCW
SetGraphicsMode
ModifyWorldTransform
SetWorldTransform
GdiPlayPageEMF
CancelDC
CreateDCW
GetDeviceCaps
DeleteDC
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontIndirectW
SelectObject
PatBlt
TextOutA
GetBitmapBits
GdiQueryFonts
GdiArtificialDecrementDriver

kernel32

SystemTimeToTzSpecificLocalTime
GetSystemDefaultLCID
GetTimeFormatA
IsDBCSLeadByte
GetSystemDefaultLangID
SystemTimeToFileTime
GetDateFormatA
CreateFileA
GetCurrentProcess
GetLongPathNameW
GetFullPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
ConnectNamedPipe
DisconnectNamedPipe
DefineDosDeviceW
QueryDosDeviceW
WaitForMultipleObjectsEx
CreateNamedPipeW
GetWindowsDirectoryW
InterlockedIncrement
InterlockedCompareExchange
InterlockedDecrement
DelayLoadFailureHook
LoadLibraryA
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDBCSLeadByteEx
GetACP
DeviceIoControl
SetCommTimeouts
GetCommTimeouts
GetProfileStringW
GetProfileIntW
BuildCommDCBW
SetDefaultCommConfigW
GetDefaultCommConfigW
SetCommState
GetCommState
GetSystemWindowsDirectoryW
WriteProfileStringW
SetLastError
GetLastError
GetTickCount
lstrcmpW
lstrcmpiW
GetSystemTime
lstrlenW
SetEndOfFile
SetFilePointer
DeleteFileW
UnmapViewOfFile
WaitForSingleObject
SetEvent
CloseHandle
GetCurrentThread
CreateFileW
CreateThread
GetSystemInfo
GetVersion
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
Sleep
LoadLibraryW
SetErrorMode
GetExitCodeThread
GetFileSize
ResetEvent
CreateEventW
MapViewOfFile
CreateFileMappingW
DuplicateHandle
WriteFile
ReadFile
WaitForSingleObjectEx
GetFileAttributesExW
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleExW
FreeLibrary
FindClose
FindFirstFileW
SetFileTime
DosDateTimeToFileTime
LoadLibraryExW
CompareFileTime
SetFileAttributesW
GetFileAttributesW
VerifyVersionInfoW
LocalFree
GetTempFileNameW
CreateDirectoryW
CopyFileW
GetLocalTime
FormatMessageW
MultiByteToWideChar
FindNextFileW
MoveFileExW
GetSystemDirectoryW
GetExitCodeProcess
CreateProcessW
IsBadStringPtrW
RemoveDirectoryW
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
FlushFileBuffers
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
LocalAlloc
CloseProfileUserMapping
SetThreadPriority
GetVersionExW
GetComputerNameW
GlobalMemoryStatus
GetTimeZoneInformation
ExitThread
SetThreadExecutionState

msvcrt

wcscmp
wcsncmp
_wcsnicmp
wcsrchr
wcschr
_initterm
malloc
_adjust_fdiv
wcsstr
isdigit
isspace
_wcslwr
memmove
isprint
isupper
_vsnprintf
_wsplitpath
isxdigit
wcsncat
??3@YAXPAX@Z
??2@YAPAXI@Z
iswalpha
fclose
fwprintf
_wfopen
_vsnwprintf
wcslen
_wcsicmp
rand
srand
wcsncpy
wcspbrk
wcstoul
iswctype
_ftol
free
_except_handler3

ntdll

NtSetInformationThread
RtlGetNtProductType
NtClose
NtQueryValueKey
NtOpenKey
RtlInitUnicodeString
RtlTimeToSecondsSince1970
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
NtOpenThreadToken
RtlImageNtHeader
VerSetConditionMask
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString

ole32

CoTaskMemFree
CoInitializeEx
CoCreateInstance
StringFromIID
CoUninitialize

oleaut32

SafeArrayCreate
VariantClear
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
VariantInit
SafeArrayPutElement
SafeArrayDestroy
VariantCopy
SysAllocString
SysFreeString

rpcrt4

RpcBindingServerFromClient
RpcStringFreeW
RpcStringBindingParseW
RpcBindingToStringBindingW
I_RpcBindingInqTransportType
RpcBindingFree

secur32

GetUserNameExW

sfc_os

ord5
ord4
ord3

spoolss

LoadDriverFiletoConvertDevmode
CallDrvDevModeConversion
UnloadDriverFile
BuildOtherNamesFromMachineName
FreeOtherNames
LoadDriverWithVersion
UnloadDriver
ScheduleJob
AddJobW
ReallocSplStr
ReadPrinter
AbortPrinter
WritePrinter
StartDocPrinterW
EndDocPrinter
SetJobW
GetJobW
SplInitializeWinSpoolDrv
WaitForSpoolerInitialization
EnumJobsW
GetPrinterW
SetPrinterW
LogWmiTraceEvent
IsNamedPipeRpcCall
ClosePrinter
IsLocalCall
MarshallDownStructure
MarshallUpStructure
AddPrinterW
ProvidorFindClosePrinterChangeNotification
ReplyPrinterChangeNotification
PartialReplyPrinterChangeNotification
AppendPrinterNotifyInfoData
RouterFreePrinterNotifyInfo
RouterAllocPrinterNotifyInfo
WaitForPrinterChange
ProvidorFindFirstPrinterChangeNotification
SplIsUpgrade
OpenPrinterW
GetJobAttributes
GetPrinterDataW
SplUnregisterForDeviceEvents
SplRegisterForDeviceEvents
OpenPrinterPortW
DeletePortW
ReallocSplMem
AllocSplStr
RevertToPrinterSelf
DllFreeSplMem
ImpersonatePrinterClient
DllAllocSplMem
DllFreeSplStr
UpdatePrinterRegAll
bGetDevModePerUser

user32

PostThreadMessageW
SendNotifyMessageW
LoadStringW
WinHelpW
GetWindowLongW
GetDlgItemTextW
EndDialog
BringWindowToTop
SetFocus
SetWindowLongW
SendDlgItemMessageW
DialogBoxParamW
CharUpperW
MessageBeep
MessageBoxW

userenv

RegisterGPNotification
UnregisterGPNotification

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ws2_32

closesocket
gethostbyname
WSAGetLastError
socket
WSACloseEvent
WSACleanup
WSAStartup
setsockopt
WSAGetOverlappedResult
WSAResetEvent
WSACreateEvent
WSASend
shutdown
WSASocketW
getsockopt
connect

Exports

Exports

ClosePrintProcessor
ControlPrintProcessor
DllMain
EnumPrintProcessorDatatypesW
GetPrintProcessorCapabilities
InitializePrintMonitor
InitializePrintProvidor
LclIsSessionZero
LclPromptUIPerSessionUser
OpenPrintProcessor
PrintDocumentOnPrintProcessor
PrintProcLogEvent
SplAddForm
SplAddMonitor
SplAddPort
SplAddPortEx
SplAddPrintProcessor
SplAddPrinter
SplAddPrinterDriverEx
SplBroadcastChange
SplClosePrinter
SplCloseSpooler
SplConfigChange
SplCopyFileEvent
SplCopyNumberOfFiles
SplCreateSpooler
SplDeleteForm
SplDeleteMonitor
SplDeletePort
SplDeletePrintProcCacheData
SplDeletePrintProcessor
SplDeletePrinter
SplDeletePrinterDriverEx
SplDeletePrinterKey
SplDeleteSpooler
SplDriverEvent
SplEnumForms
SplEnumMonitors
SplEnumPorts
SplEnumPrintProcCacheData
SplEnumPrintProcessorDatatypes
SplEnumPrintProcessors
SplEnumPrinterDataEx
SplEnumPrinterKey
SplEnumPrinters
SplGetDriverDir
SplGetForm
SplGetPrintProcCacheData
SplGetPrintProcessorDirectory
SplGetPrinter
SplGetPrinterData
SplGetPrinterDataEx
SplGetPrinterDriver
SplGetPrinterDriverDirectory
SplGetPrinterDriverEx
SplGetPrinterExtra
SplGetPrinterExtraEx
SplLoadLibraryTheCopyFileModule
SplLogEventExternal
SplMonitorIsInstalled
SplOpenPrinter
SplPowerEvent
SplReenumeratePorts
SplResetPrinter
SplSetForm
SplSetPrintProcCacheData
SplSetPrinter
SplSetPrinterData
SplSetPrinterDataEx
SplSetPrinterExtra
SplSetPrinterExtraEx
SplXcvData

Sections

.text
Size: 298KB - Virtual size: 297KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b45d32ed3fcc01d4f708a7453a80b92

Headers

File Characteristics

Imports

advapi32

gdi32

kernel32

msvcrt

ntdll

ole32

oleaut32

rpcrt4

secur32

sfc_os

spoolss

user32

userenv

version

ws2_32

Exports

Exports

Sections

.text Size: 298KB - Virtual size: 297KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 15KB - Virtual size: 15KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 298KB - Virtual size: 297KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 15KB - Virtual size: 15KB

.reloc
Size: 10KB - Virtual size: 10KB