EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
244c2623ff1cf22a565c3a6291b6280cfcdd221672c9e260c677543bebb6e78a.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
244c2623ff1cf22a565c3a6291b6280cfcdd221672c9e260c677543bebb6e78a.dll
Resource
win10v2004-20220812-en
General
-
Target
244c2623ff1cf22a565c3a6291b6280cfcdd221672c9e260c677543bebb6e78a
-
Size
444KB
-
MD5
516a7d09524e9695d7bca9a2671b9cd0
-
SHA1
8145a98d3bb52d68f39531e925fc7700a0733e38
-
SHA256
244c2623ff1cf22a565c3a6291b6280cfcdd221672c9e260c677543bebb6e78a
-
SHA512
2f224be1cebf5b46c43148c7a06b8b425a25589857ccde564e2ceed994164a4d6663bb476f041e81bd2c3dfbf42092fb549581c9d666b442b33ffa5f1298ea0d
-
SSDEEP
12288:2198cOAo3eCZlw3DLnoEPfqGAtyiPml8ff:2T8MoOCZlw3DLnTfqGuPqm
Malware Config
Signatures
Files
-
244c2623ff1cf22a565c3a6291b6280cfcdd221672c9e260c677543bebb6e78a.dll windows x86
4fd19ce6c4ae0e0ac187606fc477150a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
xprt5
?GetTickCount@TTime@XPRT@@SA?AV12@XZ
?Format@TTime@XPRT@@QBE?AVTBstr@2@PBG@Z
?Copy@TPtrArray@XPRT@@QAEXABV12@@Z
?SetPosition@TMemStream@XPRT@@UAE_N_JH@Z
?Write@TMemStream@XPRT@@UAEHPBXH@Z
??1TMemStream@XPRT@@UAE@XZ
??0TMemStream@XPRT@@QAE@XZ
??3TXprtAllocated@XPRT@@SAXPAX@Z
?OnExternalEntityRef@TXmlParser@XPRT@@MAE_NPBD000@Z
?OnDefault@TXmlParser@XPRT@@MAEXPBDH@Z
?OnEndCdataSection@TXmlParser@XPRT@@MAEXXZ
?OnStartCdataSection@TXmlParser@XPRT@@MAEXXZ
?OnComment@TXmlParser@XPRT@@MAEXPBD@Z
?OnProcessingInstruction@TXmlParser@XPRT@@MAEXPBD0@Z
?Go@TXmlParser@XPRT@@QAE_NXZ
??1TXmlParser@XPRT@@UAE@XZ
??0TXmlParser@XPRT@@QAE@AAVTStream@1@@Z
??0TBstr@XPRT@@QAE@PBDPBG@Z
??0TBstr@XPRT@@QAE@PBDHPBG@Z
kUtf8Encoding
_XprtStringUtf8ByteLen@8
_XprtStringToUtf8@16
_XprtStringLen@4
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?GetEncodedByteLength@TBstr@XPRT@@QBEHPBG@Z
?Set@TTime@XPRT@@QAEXHHHHHH@Z
?GetTime64@TTime@XPRT@@QBE_JXZ
_XprtMemRealloc@8
?Assign@TBstr@XPRT@@QAEAAV12@PBGH@Z
??0TBstr@XPRT@@QAE@PBGH@Z
_XprtGetSystemInfo@0
_XprtBinToBase64@16
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
xprt_memset
?Find@TBstr@XPRT@@QBEHGH@Z
_XprtCanonicalizeScreenName@8
?Init@TCritSec@XPRT@@QAEXXZ
?Term@TCritSec@XPRT@@QAEXXZ
?Lock@TCritSec@XPRT@@QAEXXZ
?Unlock@TCritSec@XPRT@@QAEXXZ
?Lookup@TPtrFromPtrMap@XPRT@@QBEPBVTPair@12@PAX@Z
?IsValid@TTime@XPRT@@QBE_NXZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?Remove@TBstr@XPRT@@QAEHG@Z
?Insert@TBstr@XPRT@@QAEHHPBG@Z
?Insert@TBstr@XPRT@@QAEHHG@Z
?Delete@TBstr@XPRT@@QAEHHH@Z
kSystemEncoding
_XprtUrlEncode@8
??0TBstr@XPRT@@QAE@GH@Z
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?RemoveAt@TPtrArray@XPRT@@QAEXHH@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?ToInt@TBstr@XPRT@@QBEHH@Z
?Set@TTime@XPRT@@QAEXN@Z
XprtTrace
?Attach@TBstr@XPRT@@QAEXPAG@Z
?Detach@TBstr@XPRT@@QAEPAGXZ
?Replace@TBstr@XPRT@@QAEHGG@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
_XprtMemFree@4
?GetLength@TBstr@XPRT@@QBEHXZ
?SetAt@TBstr@XPRT@@QAEXHG@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?MakeUpper@TBstr@XPRT@@QAEAAV12@XZ
_XprtStringByteLen@8
_XprtAtomicIncrement@4
xprt_strcmp
_XprtAtomicDecrement@4
?GetTm@TTime@XPRT@@QBE_NPAUtm@@@Z
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
_XprtEntityEscape@8
?Lock@TSpinLock@XPRT@@QAEXXZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
xprt_iswdigit
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
_XprtInitialize@8
_XprtUninitialize@0
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtDestroyThread@8
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?Replace@TBstr@XPRT@@QAEHPBG0@Z
?ReverseFind@TBstr@XPRT@@QBEHG@Z
?AppendFormat@TBstr@XPRT@@QAAXPBGZZ
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
_XprtFreeString@4
_XprtHashString@4
?MakeLower@TBstr@XPRT@@QAEAAV12@XZ
_XprtGetMilliseconds@0
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
xprt_memmove
_XprtMemAlloc@4
?Init@TCondVar@XPRT@@QAEXXZ
?Term@TCondVar@XPRT@@QAEXXZ
?Signal@TCondVar@XPRT@@QAEXXZ
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?ToDouble@TBstr@XPRT@@QBENXZ
_XprtCompareString@8
_XprtAllocString@4
??0TBstr@XPRT@@QAE@PBG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
??0TBstr@XPRT@@QAE@XZ
??1TBstr@XPRT@@QAE@XZ
?IsEmpty@TBstr@XPRT@@QBE_NXZ
?Empty@TBstr@XPRT@@QAEXXZ
?GetString@TBstr@XPRT@@QBEPBGXZ
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
?CompareNoCase@TBstr@XPRT@@QBEHPBG@Z
?Format@TBstr@XPRT@@QAAXPBGZZ
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
kernel32
ResetEvent
CloseHandle
FreeLibrary
CompareStringA
InterlockedExchange
GetModuleHandleA
GetLastError
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
SetLastError
InterlockedCompareExchange
GetCurrentThreadId
ExitProcess
GetModuleFileNameA
SetEvent
DisableThreadLibraryCalls
user32
MsgWaitForMultipleObjects
KillTimer
SetTimer
TranslateMessage
msvcrt
_snwprintf
_except_handler3
??3@YAXPAX@Z
memset
??2@YAPAXI@Z
strcmp
qsort
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
memcpy
memmove
isspace
_purecall
_wtoi
_getpid
ole32
CoCreateInstance
CoCreateGuid
CoInitializeEx
CoUninitialize
CoRegisterMessageFilter
CreateBindCtx
oleaut32
VariantClear
VariantCopy
SysAllocString
VariantChangeType
VariantInit
SystemTimeToVariantTime
SafeArrayDestroy
SafeArrayCopy
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
Exports
Exports
Sections
.text Size: 224KB - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 832B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE