6505bfcf8a1972b30174ab42749aa055869b0f4159bb05d999a80bccdfc0033e

Sharing

Copy URL

Twitter E-mail

General

Target

6505bfcf8a1972b30174ab42749aa055869b0f4159bb05d999a80bccdfc0033e
Size

100KB
MD5

8133ad4d9f81486b56a7a1eefca3a760
SHA1

21eb74f23a000c0b8597adb06b9ca43d1f24b462
SHA256

6505bfcf8a1972b30174ab42749aa055869b0f4159bb05d999a80bccdfc0033e
SHA512

0f8e891989d6adcce20241f63e812aa21d4d468d294ae25d0346d9960e60bdc1ffb8748f928617909b68b179864a9c8d8b4d5e88230a4b1c4de26ff8bd009f99
SSDEEP

3072:064bWS0eSt/+6ZXppw2k2veF2hs9JxXh:06UWRcOE2kT2hS

Score

N/A

Malware Config

Signatures

Files

6505bfcf8a1972b30174ab42749aa055869b0f4159bb05d999a80bccdfc0033e
.dll windows x86

352a0e108382c31fe7ac8ffd99b5772e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

_strlwr
_ultoa
strncpy
towlower
strcpy

kernel32

GlobalAlloc
GlobalFree
GlobalAlloc

msvcrt

putc
_get_sbh_threshold
_seterrormode
_isctype
_fgetwchar
calloc
_wfreopen
_strerror
iswpunct
_msize
rand
_wexecvpe
rename
rewind
_wchmod
_strset
fseek
_wspawnlpe

user32

CharNextA

shlwapi

PathUnmakeSystemFolderA
PathFileExistsA
PathFindNextComponentA
PathGetDriveNumberA
PathRemoveBackslashW
StrCmpNW
PathAddBackslashW
SHEnumValueA
PathUnExpandEnvStringsW
PathGetArgsA
SHRegGetPathA
StrCatBuffA
ChrCmpIW
SHReleaseThreadRef
PathUnquoteSpacesW
StrRetToStrA
PathRemoveBlanksA
UrlGetPartW
PathIsRelativeA
SHCreateStreamOnFileW
SHEnumValueW
StrRetToStrW
StrRChrIA
AssocQueryKeyA
StrChrA
PathIsFileSpecW
SHRegDeleteUSValueA
IntlStrEqWorkerW

crypt32

CertAddEncodedCTLToStore
CertNameToStrA
CryptMsgEncodeAndSignCTL
CertDuplicateCertificateChain
CertCompareCertificate
CryptMsgDuplicate
CertRDNValueToStrA
CertStrToNameA
CryptDecodeObjectEx
CryptFreeOIDFunctionAddress
CryptDecryptMessage
CryptQueryObject
CertFindCertificateInCRL
CertCreateCTLContext
CertAddCertificateContextToStore

msi

ord75
ord98
ord223
ord108
ord148
ord39
ord55
ord211
ord119
ord121
ord26
ord24
ord170
ord109
ord137
ord166
ord15
ord176
ord99
ord155
ord203
ord161
ord189
ord9
ord30

mprapi

MprAdminMIBEntryGetNext
MprAdminUserSetInfo
MprAdminTransportCreate
MprConfigInterfaceEnum
MprAdminRegisterConnectionNotification
MprConfigInterfaceCreate
MprConfigTransportGetInfo
MprAdminMIBBufferFree
MprAdminInterfaceConnect
MprAdminInterfaceSetInfo
MprAdminServerDisconnect
MprAdminInterfaceQueryUpdateResult
MprConfigGetFriendlyName
MprAdminTransportGetInfo
MprInfoDelete
MprAdminIsDomainRasServer
MprAdminInterfaceGetCredentials
MprAdminInterfaceGetInfo

clusapi

ClusterResourceTypeControl
ClusterNetworkControl
ClusterNetworkCloseEnum
ClusterRegDeleteKey
ClusterRegSetKeySecurity
GetClusterResourceState
ClusterNodeOpenEnum
CanResourceBeDependent
CreateClusterNotifyPort
ResumeClusterNode
RegisterClusterNotify
ClusterRegDeleteValue
AddClusterResourceDependency
GetClusterResourceTypeKey
PauseClusterNode
ClusterNetInterfaceControl

Exports

Exports

ActivateAndByLibraries
ActivateTrimConfigStringChar
CombineWellStg
DetectBltEventHolderCertificate
DeviceLoadAuthentication
DisconnectSecurity
EndScroll
FlashDebuggerHotScreen
PrivilegedFlatDirectory
RemoveResyncNotificationVerify
RetrieveDlgTimeoutPoint
ScreenCompareStringStream
StretchStartup
StrokeUnescape

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.G
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.d4
Size: 512B - Virtual size: 83B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

352a0e108382c31fe7ac8ffd99b5772e

Headers

File Characteristics

Imports

ntdll

kernel32

msvcrt

user32

shlwapi

crypt32

msi

mprapi

clusapi

Exports

Exports

Sections

.text Size: 83KB - Virtual size: 82KB

.data Size: 1024B - Virtual size: 4KB

.G Size: 14KB - Virtual size: 13KB

.d4 Size: 512B - Virtual size: 83B

.reloc Size: 1024B - Virtual size: 20KB

.text
Size: 83KB - Virtual size: 82KB

.data
Size: 1024B - Virtual size: 4KB

.G
Size: 14KB - Virtual size: 13KB

.d4
Size: 512B - Virtual size: 83B

.reloc
Size: 1024B - Virtual size: 20KB