323b0f7b6c9a12e9c8c0eda9da0d5d9e8b63cfd3030447918456ce8ba118d0ad

Sharing

Copy URL Twitter E-mail

General

Target

323b0f7b6c9a12e9c8c0eda9da0d5d9e8b63cfd3030447918456ce8ba118d0ad
Size

286KB
MD5

0b32c3cddb809416709c3e3510493240
SHA1

56f059f267eca9bb23629afc3a4a6cdd6df5a51d
SHA256

323b0f7b6c9a12e9c8c0eda9da0d5d9e8b63cfd3030447918456ce8ba118d0ad
SHA512

ac5f1d0c23c7dd76b72b1e22d1b65b5058d9b12f1e032ae97ec06b789a8b68fe0c6f19abdc7d7559671640d5d50de1c8d23259ff24d2bc8a81cc6863e8c4ce55
SSDEEP

6144:BUlin6gmYnhok5BmJ0/R3UxRJO2sdi5VtJLi1cCxKDxX5a8HQisH1cATRq:Wli6psN5Sf3W/ZxW5nHTsH1ca

Score

N/A

Malware Config

Signatures

Files

323b0f7b6c9a12e9c8c0eda9da0d5d9e8b63cfd3030447918456ce8ba118d0ad
.dll windows x86

e9f228f542d51ba645a748b0dd2396a3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_CxxThrowException
__CxxFrameHandler3
wcsstr
memmove
wcsrchr
_vscwprintf
_vsnwprintf
wcsncmp
fputws
_wfopen
fclose
calloc
_XcptFilter
_amsg_exit
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_lock
_unlock
_wcslwr
wcspbrk
wcschr
memmove_s
_stricmp
_wcsicmp
towlower
iswctype
wcsspn
memcpy_s
realloc
free
iswspace
wcstok_s
_wcsnicmp
__dllonexit
_onexit
malloc
_except_handler4_common
memset

kernel32

EnterCriticalSection
DelayLoadFailureHook
QueryDosDeviceW
GetLogicalDriveStringsW
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
ReleaseMutex
LoadLibraryW
OpenProcess
InitializeCriticalSection
CreateMutexW
IsWow64Process
WaitForSingleObject
LoadLibraryExW
GetVersionExA
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
Sleep
OutputDebugStringA
GetModuleHandleA
DeleteCriticalSection
VirtualProtect
SetEnvironmentVariableW
GetCurrentProcess
DuplicateHandle
CopyFileExW
SetFileAttributesW
DeviceIoControl
GetFileInformationByHandle
CreateDirectoryW
lstrcmpiW
EncodePointer
FindClose
FindNextFileW
GetCurrentThreadId
GetModuleHandleExW
GetModuleFileNameW
SearchPathW
GetFileAttributesW
SetLastError
LocalAlloc
VirtualQuery
GetCurrentDirectoryW
LocalFree
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryExA
GetProcAddress
FreeLibrary
GetModuleHandleW
GetLastError
GetCurrentProcessId
GetProcessId
TlsSetValue
ExitThread
GetProcessIdOfThread
GetThreadId
InterlockedIncrement
HeapAlloc
GetProcessHeap
InterlockedDecrement
HeapFree
GetSystemDirectoryW
GetWindowsDirectoryW
GetLongPathNameW
GetFullPathNameW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
TlsGetValue
TlsAlloc
OpenEventW
WaitForSingleObjectEx
CloseHandle
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
TerminateProcess
DecodePointer
CreateFileW
GetFileSizeEx
OutputDebugStringW
TlsFree
FindFirstFileW

api-ms-win-downlevel-shlwapi-l1-1-0

StrCmpNCW
StrCmpNICW
StrDupW
PathSkipRootW
PathIsUNCW
PathGetArgsW
StrCmpIW
PathFindFileNameW
StrCmpICW
StrCmpCW
StrCmpICA

api-ms-win-downlevel-advapi32-l1-1-0

RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegGetValueW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

ntdll

RtlNtStatusToDosError
NtQueryObject

iertutil

ord58
ord303
ord45
ord321
ord101
ord137
ord751
ord308
ord298
ord305
ord121
ord573
ord170
ord134
ord50

Exports

Exports

AcRedirNotify
AcRedirNotifySetEnabled
AcRedirSetEnabled
IEShims_CreateWindowEx
IEShims_GetOriginatingThreadId
IEShims_InDllMainContext
IEShims_Initialize
IEShims_SetRedirectRegistryForThread
IEShims_Uninitialize

Sections

.text
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e9f228f542d51ba645a748b0dd2396a3

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

api-ms-win-downlevel-shlwapi-l1-1-0

api-ms-win-downlevel-advapi32-l1-1-0

ntdll

iertutil

Exports

Exports

Sections

.text Size: 205KB - Virtual size: 204KB

.data Size: 4KB - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 14KB - Virtual size: 13KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 205KB - Virtual size: 204KB

.data
Size: 4KB - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 14KB - Virtual size: 13KB

.rmnet
Size: 56KB - Virtual size: 60KB