e538ebb9a14003a1dbfc6d9731650157f5bd6176ac9afb47d6ccb6727951659b

Sharing

Copy URL Twitter E-mail

General

Target

e538ebb9a14003a1dbfc6d9731650157f5bd6176ac9afb47d6ccb6727951659b
Size

48KB
MD5

8213cf8050f04b094999028143370f26
SHA1

ca277ed3fe59ad9bf6d2330ff0d4f421f6f0ace3
SHA256

e538ebb9a14003a1dbfc6d9731650157f5bd6176ac9afb47d6ccb6727951659b
SHA512

c080ca83f3470cd423c26f39a338071a071f6b6b27bf7f60c8bc55838891ac6d7fd170a78d20f0f3c0950daeb849c43186a08dbe46cb82e3becd573f2c5bb6f8
SSDEEP

768:04M6/ZfhZWqeyei28HEMbZYPSBhN85/qVbHt9eR7Ui5FfupxWZU3HnU:NRhfhZCi2AVYCSlQbHcUwOWZcHnU

Score

N/A

Malware Config

Signatures

Files

e538ebb9a14003a1dbfc6d9731650157f5bd6176ac9afb47d6ccb6727951659b
.dll regsvr32 windows x86

36806ac5b2ce15dd3904fe4462bdee53

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
InterlockedDecrement
HeapDestroy
lstrlenW
lstrlenA
GetShortPathNameA
GetModuleHandleA
LocalFree
GetCurrentProcessId
WideCharToMultiByte
GetCommandLineW
InterlockedIncrement
CreateThread
GetSystemDirectoryA
Process32Next
Process32First
WritePrivateProfileStringA
Sleep
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetExitCodeProcess
WaitForSingleObject
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
RemoveDirectoryA
CreateProcessA
ExitProcess
CreateDirectoryA
GetProcAddress
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
GetModuleFileNameA
LoadLibraryA
CloseHandle
FreeLibrary

advapi32

SetNamedSecurityInfoA
SetEntriesInAclA
RegDeleteKeyA
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA

shell32

CommandLineToArgvW
SHGetSpecialFolderPathA

ole32

CoUninitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoInitialize
CoMarshalInterThreadInterfaceInStream

oleaut32

SysFreeString
LoadRegTypeLi
SysStringLen
VariantClear
SysAllocString

shlwapi

SHDeleteValueA
SHDeleteKeyA
SHSetValueA

msvcrt

strcmp
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
_wcslwr
wcsstr
memcmp
_purecall
memcpy
_access
fopen
fseek
ftell
fread
fclose
strlen
memset
strcat
strcpy
sprintf
??3@YAXPAX@Z
_strlwr
strrchr
strstr
??2@YAPAXI@Z
atoi
strchr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36806ac5b2ce15dd3904fe4462bdee53

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcrt

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 28KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 4KB

idata Size: 4KB - Virtual size: 4B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 28KB - Virtual size: 28KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 4KB

idata
Size: 4KB - Virtual size: 4B

.reloc
Size: 4KB - Virtual size: 2KB