DllInstall
DllRegisterServer
General
-
Target
0b013e75cf6bfb2a3fc50556cb5e7b5ae4321ecae09df4b315885bd374797dc3.bin
-
Size
164KB
-
MD5
ad29c0e8a5ddaf173521b2f6c979119b
-
SHA1
b2454947cc58cee36bee53e24cf294fd060c5ad1
-
SHA256
0b013e75cf6bfb2a3fc50556cb5e7b5ae4321ecae09df4b315885bd374797dc3
-
SHA512
83d33354663e6ea271e49ebdadb1acd0cd51489e24e89d64d8cd8fc8410753297697fca8b077f3638e897a61097526969645783db76fd90cd7654189fdc3dc3d
-
SSDEEP
3072:czQazYYCn1fU6IABVJ2z/DjTBf5gyHeO/ya:+zZCn1PN/Je/DjTBxfHB/
Score
10/10
Malware Config
Signatures
-
Qakbot family
Files
-
0b013e75cf6bfb2a3fc50556cb5e7b5ae4321ecae09df4b315885bd374797dc3.bin.dll regsvr32 windows x86
4ec0fd278ac094f105aead49a4fff735
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memchr
_strtoi64
_errno
_snprintf
qsort
_vsnprintf
memset
_time64
_vsnwprintf
malloc
strncpy
strchr
strtod
localeconv
_ftol2_sse
free
atol
memcpy
kernel32
FindNextFileW
GetTickCount
GetModuleHandleA
GetWindowsDirectoryW
GetCurrentDirectoryW
CreateMutexW
DuplicateHandle
GetCurrentThread
lstrcmpA
GetLastError
lstrcatA
GetLocaleInfoA
CreateDirectoryW
DisconnectNamedPipe
lstrcpynW
GetProcessId
lstrcatW
lstrcpyW
GetFileAttributesW
Sleep
lstrcmpiW
GetDriveTypeW
K32GetModuleFileNameExW
MoveFileW
lstrcpynA
lstrlenW
GetCurrentProcessId
SwitchToThread
GetModuleHandleW
GetProcAddress
HeapCreate
HeapFree
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
FreeLibrary
lstrcmpiA
GetSystemTimeAsFileTime
SetThreadPriority
GetExitCodeProcess
FindFirstFileW
GetSystemInfo
SetFileAttributesW
LocalAlloc
FlushFileBuffers
LoadLibraryW
GetCommandLineW
GetVersionExA
user32
GetIconInfo
CopyIcon
GetDC
CharUpperBuffA
CharUpperBuffW
RegisterClassExA
UnregisterClassA
CreateWindowExA
DestroyWindow
DefWindowProcW
DrawIconEx
GetCursorInfo
gdi32
SelectObject
GetObjectW
BitBlt
CreateCompatibleBitmap
DeleteObject
CreateCompatibleDC
GetDIBits
GetDeviceCaps
DeleteDC
shell32
CommandLineToArgvW
ole32
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
oleaut32
VariantClear
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayDestroy
SysFreeString
SysAllocString
SafeArrayGetLBound
Exports
Exports
Sections
.text Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ