8c1ef57b95cdda2c480313198c772c05a1d720ea6767fc065d86e87f05ee6d1a

Sharing

Copy URL Twitter E-mail

General

Target

8c1ef57b95cdda2c480313198c772c05a1d720ea6767fc065d86e87f05ee6d1a
Size

1.6MB
MD5

928fb9fd62b9c7944ad08df1dbedfa43
SHA1

76ed7b9b3eb5f27f096b3b3ef2db328a17c97dfd
SHA256

8c1ef57b95cdda2c480313198c772c05a1d720ea6767fc065d86e87f05ee6d1a
SHA512

abbed603c7d0b49601b6653fb8093e050daf776c2aee13b16b426bd127a6b5ef65c4a7d2a74cfee330dcc65bf5533d572274c6d9d83105ad76bee6c4687e229c
SSDEEP

24576:V0zmhLHKBowkSruERQx7/3y9XnITsAE7fdm4L:+zCLHKBoIrumAy935AO1t

Score

N/A

Malware Config

Signatures

Files

8c1ef57b95cdda2c480313198c772c05a1d720ea6767fc065d86e87f05ee6d1a
.dll windows x86

8162fce27727759e2b023fb68396e071

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_CxxThrowException
__CxxFrameHandler3
malloc
memset
_XcptFilter
_amsg_exit
free
_initterm
??1type_info@@UAE@XZ
_lock
__dllonexit
_onexit
?terminate@@YAXXZ
_except_handler4_common
_ftol2_sse
_ftol2
_vsnwprintf
ldiv
_stricmp
tolower
isdigit
memcpy
_purecall
memmove_s
memcpy_s
??0exception@@QAE@ABQBD@Z
_vsnprintf
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
_unlock
memcmp

ntdll

RtlInitUnicodeString
WinSqmAddToStreamEx
WinSqmIsOptedIn
NtFlushProcessWriteBuffers
EtwEventUnregister
EtwEventRegister
EtwEventWrite

api-ms-win-core-libraryloader-l1-1-1

DisableThreadLibraryCalls
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleExA
GetProcAddress
GetModuleFileNameA
LoadLibraryExW
FreeLibrary
LoadLibraryExA
GetModuleHandleExW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter

api-ms-win-security-base-l1-2-0

AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSidSubAuthority
InitializeSid
SetSecurityDescriptorSacl
GetSidLengthRequired
AddMandatoryAce
InitializeAcl
AllocateLocallyUniqueId
GetLengthSid
IsValidSid
SetKernelObjectSecurity

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc

api-ms-win-core-interlocked-l1-2-0

InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InitializeSListHead
InterlockedPushEntrySList
InterlockedCompareExchange64
InterlockedFlushSList

api-ms-win-core-processthreads-l1-1-1

TerminateProcess
GetCurrentProcess
TlsSetValue
GetCurrentProcessId
SwitchToThread
IsProcessorFeaturePresent
GetCurrentThreadId
TlsAlloc
TlsFree
TlsGetValue
GetProcessId

api-ms-win-core-sysinfo-l1-2-0

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW

api-ms-win-core-debug-l1-1-1

DebugBreak
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-synch-l1-2-0

InitializeCriticalSectionAndSpinCount
InitializeSRWLock
SetCriticalSectionSpinCount
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeConditionVariable
ReleaseSRWLockExclusive
SleepEx
AcquireSRWLockExclusive
WakeConditionVariable
SleepConditionVariableCS
CreateSemaphoreExW
OpenSemaphoreW
WaitForSingleObject
ReleaseSemaphore
InitOnceExecuteOnce
LeaveCriticalSection
SetEvent
EnterCriticalSection
InitializeCriticalSection
Sleep
TryEnterCriticalSection
DeleteCriticalSection

api-ms-win-core-registry-l1-1-0

RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExW
RegGetValueW
RegCloseKey
RegQueryValueExA
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-1

GetWriteWatch
VirtualFree
VirtualAlloc
ResetWriteWatch

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

dxgi

CreateDXGIFactory
CreateDXGIFactory1

api-ms-win-ntuser-dc-access-l1-1-0

ReleaseDC
GetDC

api-ms-win-ntuser-rectangle-l1-1-0

IntersectRect

api-ms-win-ntuser-sysparams-l1-1-0

EnumDisplayDevicesW

api-ms-win-dx-d3dkmt-l1-1-0

D3DKMTDestroyDCFromMemory
D3DKMTCheckSharedResourceAccess
GdiEntry13
D3DKMTCreateDCFromMemory

kernelbase

BaseFormatObjectAttributes

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-file-l1-2-0

CreateFileA
GetFileSize

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

D3D11CoreCreateDevice
D3D11CoreCreateLayeredDevice
D3D11CoreGetLayeredDeviceSize
D3D11CoreRegisterLayers
D3D11CreateDevice
D3D11CreateDeviceAndSwapChain
D3DKMTCloseAdapter
D3DKMTCreateAllocation
D3DKMTCreateContext
D3DKMTCreateDevice
D3DKMTCreateSynchronizationObject
D3DKMTDestroyAllocation
D3DKMTDestroyContext
D3DKMTDestroyDevice
D3DKMTDestroySynchronizationObject
D3DKMTEscape
D3DKMTGetContextSchedulingPriority
D3DKMTGetDeviceState
D3DKMTGetDisplayModeList
D3DKMTGetMultisampleMethodList
D3DKMTGetRuntimeData
D3DKMTGetSharedPrimaryHandle
D3DKMTLock
D3DKMTOpenAdapterFromHdc
D3DKMTOpenResource
D3DKMTPresent
D3DKMTQueryAdapterInfo
D3DKMTQueryAllocationResidency
D3DKMTQueryResourceInfo
D3DKMTRender
D3DKMTSetAllocationPriority
D3DKMTSetContextSchedulingPriority
D3DKMTSetDisplayMode
D3DKMTSetDisplayPrivateDriverFormat
D3DKMTSetGammaRamp
D3DKMTSetVidPnSourceOwner
D3DKMTSignalSynchronizationObject
D3DKMTUnlock
D3DKMTWaitForSynchronizationObject
D3DKMTWaitForVerticalBlankEvent
D3DPerformance_BeginEvent
D3DPerformance_EndEvent
D3DPerformance_GetStatus
D3DPerformance_SetMarker
EnableFeatureLevelUpgrade
OpenAdapter10
OpenAdapter10_2

Sections

.text
Size: 689KB - Virtual size: 688KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text_hf
Size: 414KB - Virtual size: 414KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 497KB - Virtual size: 496KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8162fce27727759e2b023fb68396e071

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

dxgi

api-ms-win-ntuser-dc-access-l1-1-0

api-ms-win-ntuser-rectangle-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-0

kernelbase

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 689KB - Virtual size: 688KB

.text_hf Size: 414KB - Virtual size: 414KB

.data Size: 15KB - Virtual size: 15KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 497KB - Virtual size: 496KB

.reloc Size: 38KB - Virtual size: 38KB

.text
Size: 689KB - Virtual size: 688KB

.text_hf
Size: 414KB - Virtual size: 414KB

.data
Size: 15KB - Virtual size: 15KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 497KB - Virtual size: 496KB

.reloc
Size: 38KB - Virtual size: 38KB