CreatePlugin
Static task
static1
Behavioral task
behavioral1
Sample
6e1d6689fddd69c553d9d1428407de8895af8c2b500e67367e2208cf9ffb711b.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6e1d6689fddd69c553d9d1428407de8895af8c2b500e67367e2208cf9ffb711b.dll
Resource
win10v2004-20220812-en
General
-
Target
6e1d6689fddd69c553d9d1428407de8895af8c2b500e67367e2208cf9ffb711b
-
Size
224KB
-
MD5
4347d7b8d475d56b036eeaeaff3fd066
-
SHA1
4b1b20304c6b3ec70080d951276b12c23456232a
-
SHA256
6e1d6689fddd69c553d9d1428407de8895af8c2b500e67367e2208cf9ffb711b
-
SHA512
6c8878ec4fcbb80d0770f4b7e54e2ed1612cbe0772aac6f8dbd4627d38398f3ea23fd6759e3dca3aa4eec4d29357e01cc1a608ec48b28a7fc9e5a59e9ef3896c
-
SSDEEP
6144:fQd+4gKWTBskN1neqiOTtEvwmAn8xOOUpISE:O6KWTBsk1nEwmAvoSE
Malware Config
Signatures
Files
-
6e1d6689fddd69c553d9d1428407de8895af8c2b500e67367e2208cf9ffb711b.dll windows x86
0f1fb3225f3750f2ba3de73f7a7e6595
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
filemanager
?GetRecordCount@CFileManager@@QBEIXZ
?RemoveRecord@CFileManager@@QAEJH@Z
?UpdateRecord@CFileManager@@QAEJPBVIRecord@@@Z
?ReadRecord@CFileManager@@QAEPAVIRecord@@H@Z
?GetFieldCount@CFileManager@@QBEIXZ
??0CFileManager@@QAE@XZ
?CreateNewRecord@CFileManager@@QAEPAVIRecord@@XZ
?AddRecord@CFileManager@@QAEJPBVIRecord@@@Z
?Open@CFileManager@@QAEJABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?Close@CFileManager@@QAEXXZ
?SetFieldInfo@CFileManager@@QAEJABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z
??1CFileManager@@QAE@XZ
shlwapi
PathFileExistsW
kernel32
LoadLibraryW
GetCurrentThreadId
SetFileAttributesW
GetProcAddress
CopyFileW
DeleteFileW
GetModuleFileNameA
GetModuleFileNameW
GetPrivateProfileStringW
CloseHandle
CreateMutexA
WaitForSingleObject
ReleaseMutex
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcessId
GetSystemTimeAsFileTime
GetFileAttributesW
GetTickCount
QueryPerformanceCounter
ExitProcess
ole32
CoUninitialize
CoInitialize
msvcp71
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?clear@ios_base@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?_Nomemory@std@@YAXXZ
msvcr71
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
wcscpy
wcslen
??_V@YAXPAX@Z
__RTDynamicCast
??0exception@@QAE@ABV0@@Z
_CxxThrowException
sprintf
strncpy
fclose
fread
ftell
fseek
fopen
strncmp
wcsncmp
wcsncpy
atoi
_purecall
memmove
sscanf
strchr
strstr
strtol
malloc
_callnewh
??1type_info@@UAE@XZ
__security_error_handler
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
free
_initterm
_adjust_fdiv
__CppXcptFilter
_stricmp
Exports
Exports
Sections
.text Size: 88KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE