EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
49a240768134c73cca8c8056f9f9d3d6d5f5c652d7bd65c8498920da8f0c2fe8.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
49a240768134c73cca8c8056f9f9d3d6d5f5c652d7bd65c8498920da8f0c2fe8.dll
Resource
win10v2004-20220812-en
General
-
Target
49a240768134c73cca8c8056f9f9d3d6d5f5c652d7bd65c8498920da8f0c2fe8
-
Size
236KB
-
MD5
8431f6d0f4b9553ae13a394f3b1d6095
-
SHA1
929858fc21355161358abec2be44a99641342d9d
-
SHA256
49a240768134c73cca8c8056f9f9d3d6d5f5c652d7bd65c8498920da8f0c2fe8
-
SHA512
c2678b3ee053ec6e6ab7a9c9a30e6a72105fc96d2aee43e406bdf1b0ac5b009cf198a63c4d576828cd9cf068c1aae85e9764dff0ec3593953da4a21a0bb3b104
-
SSDEEP
3072:g9uEzOn/Qsgpn2DcDjHoYGq8nv7vAqHlqLtbaOmFes6U14YTBwvfbcldRPGE8/80:fjgpn2DcDjIPvp86FesdibcPRPS/6U
Malware Config
Signatures
Files
-
49a240768134c73cca8c8056f9f9d3d6d5f5c652d7bd65c8498920da8f0c2fe8.dll windows x86
94113205e1b36dec06802af345446344
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
GetModuleHandleA
GetLastError
SetLastError
DisableThreadLibraryCalls
InterlockedExchange
CompareStringA
ExitProcess
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
FreeLibrary
GlobalAlloc
GetSystemDefaultLCID
GlobalLock
GlobalUnlock
LoadLibraryA
GlobalFree
user32
SetTimer
KillTimer
TranslateMessage
MsgWaitForMultipleObjects
gdi32
SetMapMode
SelectObject
GetDeviceCaps
AbortDoc
Polyline
EndDoc
StartPage
DeleteDC
SetBkMode
EndPage
DeleteObject
GetCurrentObject
winspool.drv
ClosePrinter
comdlg32
CommDlgExtendedError
ole32
CoCreateInstance
CoUninitialize
CoRegisterMessageFilter
CoInitializeEx
CreateBindCtx
oleaut32
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
SafeArrayCopy
VariantInit
VariantChangeType
SysAllocString
VariantCopy
VariantClear
SafeArrayDestroy
xprt5
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?CompareNormal@TBstr@XPRT@@QBEHPBG@Z
?AddTail@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?RemoveHead@TPtrList@XPRT@@QAEPAXXZ
??0TPtrList@XPRT@@QAE@H@Z
??1TPtrList@XPRT@@QAE@XZ
_XprtAtomicIncrement@4
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
xprt_memmove
_XprtMemAlloc@4
_XprtAtomicDecrement@4
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?Lock@TSpinLock@XPRT@@QAEXXZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
xprt_iswdigit
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
_XprtInitialize@8
_XprtUninitialize@0
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?Copy@TBstr@XPRT@@QBEPAGXZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??0TBstr@XPRT@@QAE@XZ
kSystemEncoding
??0TBstr@XPRT@@QAE@PBDPBG@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
??1TBstr@XPRT@@QAE@XZ
?Compare@TBstr@XPRT@@QBEHPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?Normalize@TBstr@XPRT@@QAEAAV12@XZ
_XprtGenerateRandom@8
_XprtMemFree@4
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
xprt_memset
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
msvcrt
??2@YAPAXI@Z
_adjust_fdiv
_initterm
_onexit
__dllonexit
??3@YAXPAX@Z
malloc
_except_handler3
_purecall
qsort
strcmp
_snwprintf
wcstok
free
memcpy
towupper
isspace
wcslen
swprintf
wcscmp
swscanf
memset
tolower
isupper
Exports
Exports
Sections
.text Size: 80KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE