EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
22af7791366f68992cf78d915ed5a5f6c57e90eae54958369d66852bfb8bbd94.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
22af7791366f68992cf78d915ed5a5f6c57e90eae54958369d66852bfb8bbd94.dll
Resource
win10v2004-20220812-en
General
-
Target
22af7791366f68992cf78d915ed5a5f6c57e90eae54958369d66852bfb8bbd94
-
Size
366KB
-
MD5
792f27789f5e4b14fa2bc1c1f4a5a894
-
SHA1
390d9763cebea9b0d671ed35f9e952a109db737d
-
SHA256
22af7791366f68992cf78d915ed5a5f6c57e90eae54958369d66852bfb8bbd94
-
SHA512
401e9403c0a1d7c9aae3c4813dfcdbadda96dc5c7db4e2698038bf406924607982b027a16320c2274b3bf428151d964e562715ba2f6e4226ce43b16ed0680a25
-
SSDEEP
6144:FfT8WKcFLbcrQ1m0Ws/eeZMt8m4W7grefrYfe7:hTGcFL4rQ1cJyqs0Efe7
Malware Config
Signatures
Files
-
22af7791366f68992cf78d915ed5a5f6c57e90eae54958369d66852bfb8bbd94.dll windows x86
f58b57481a2257a2ce68ace8403e0648
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
OpenProcess
GetLastError
DuplicateHandle
GetCurrentProcess
MapViewOfFile
GetCurrentProcessId
SetEvent
WaitForSingleObject
FreeLibrary
CompareStringA
UnmapViewOfFile
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
SetLastError
InterlockedCompareExchange
GetCurrentThreadId
ResetEvent
DisableThreadLibraryCalls
ExitProcess
InterlockedExchange
ReleaseMutex
user32
TranslateMessage
SetTimer
KillTimer
MsgWaitForMultipleObjects
xprt5
?Replace@TBstr@XPRT@@QAEHPBG0@Z
??0TBstr@XPRT@@QAE@PBDPBG@Z
kSystemEncoding
xprt_iswdigit
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
_XprtAtomicIncrement@4
_XprtAtomicDecrement@4
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
_XprtInitialize@8
_XprtUninitialize@0
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
?GetTm@TTime@XPRT@@QBE_NPAUtm@@@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?GetMinute@TTime@XPRT@@QBEHXZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
_XprtMemRealloc@8
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?ToInt@TBstr@XPRT@@QBEHH@Z
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
?Set@TTime@XPRT@@QAEXN@Z
?GetTickCount@TTime@XPRT@@SA?AV12@XZ
?GetTime64@TTime@XPRT@@QBE_JXZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?Set@TTime@XPRT@@QAEXHHHHHH@Z
?AppendFormat@TBstr@XPRT@@QAAXPBGZZ
?Tokenize@TBstr@XPRT@@QBE?AV12@PBGAAH@Z
?Format@TBstr@XPRT@@QAAXPBGZZ
_XprtGetMilliseconds@0
xprt_wcsncmp
xprt_wcslen
?Insert@TBstr@XPRT@@QAEHHPBG@Z
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?Find@TBstr@XPRT@@QBEHPBGH@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?GetEncodedByteLength@TBstr@XPRT@@QBEHPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBDHPBG@Z
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
_XprtMemAlloc@4
xprt_memset
xprt_memmove
_XprtMemFree@4
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?GetDayOfWeek@TTime@XPRT@@QBEHXZ
?GetYear@TTime@XPRT@@QBEHXZ
?GetMonth@TTime@XPRT@@QBEHXZ
?GetDay@TTime@XPRT@@QBEHXZ
?Format@TTime@XPRT@@QBE?AVTBstr@2@PBG@Z
?GetHour@TTime@XPRT@@QBEHXZ
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
??0TBstr@XPRT@@QAE@XZ
_XprtReleaseMessageId@4
_XprtUnregisterMessageCallback@4
_XprtRegisterMessageCallback@8
_XprtRequestMessageId@0
_XprtGetMessageQueue@0
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??1TBstr@XPRT@@QAE@XZ
?Append@TBstr@XPRT@@QAEAAV12@G@Z
_XprtCreateThread@8
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
msvcrt
qsort
_snwprintf
_except_handler3
__dllonexit
??2@YAPAXI@Z
_onexit
free
_initterm
malloc
_adjust_fdiv
strcmp
memset
_purecall
memmove
memcpy
??3@YAXPAX@Z
memcmp
ole32
CoRegisterMessageFilter
CoUninitialize
CreateBindCtx
CoCreateInstance
CoInitializeEx
oleaut32
VariantClear
VariantCopy
VarCmp
VariantTimeToSystemTime
SysAllocString
VariantChangeType
SystemTimeToVariantTime
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
SafeArrayCopy
VariantInit
Exports
Exports
Sections
.text Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE