EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
1066aa5418c776af96ab8f51ae4450f060b9ec5da589d3eff3679fe5b3e8434c.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1066aa5418c776af96ab8f51ae4450f060b9ec5da589d3eff3679fe5b3e8434c.dll
Resource
win10v2004-20220901-en
General
-
Target
1066aa5418c776af96ab8f51ae4450f060b9ec5da589d3eff3679fe5b3e8434c
-
Size
1.8MB
-
MD5
098d3cbdcbddc48a4fad158d34923c35
-
SHA1
d1128dedb0c44f9ec6fa4e5d8ce61183fdbe5dad
-
SHA256
1066aa5418c776af96ab8f51ae4450f060b9ec5da589d3eff3679fe5b3e8434c
-
SHA512
4dd26e0df1977c5a0659305135169a52322b46008fe795feeb50dec94b5b3e8b0fac7afe273b8314f5ed748b6f1828279aba9223cfbd6c85d451c872c78924f2
-
SSDEEP
24576:OZeGy0eCxWE0zCAEKoTW6ylqGgLHgibKCWDAsCoqNJb1LxKCbx5tmJvaOlzBJt5/:yqCA9ukULiAspqXNbbFy7/
Malware Config
Signatures
Files
-
1066aa5418c776af96ab8f51ae4450f060b9ec5da589d3eff3679fe5b3e8434c.dll windows x86
f05f692539cbbcc429601344b3ee3bef
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
timeKillEvent
timeSetEvent
timeGetTime
rpcrt4
UuidToStringW
RpcStringFreeW
urlmon
FindMimeFromData
CreateURLMoniker
CoInternetParseUrl
riched20
ord4
kernel32
WaitForSingleObject
CreateEventA
QueryPerformanceCounter
IsBadCodePtr
GetLongPathNameA
LoadLibraryExA
GetFileAttributesA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
RaiseException
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetLastError
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
SizeofResource
LoadResource
GetCurrentProcess
GlobalUnlock
GlobalSize
GlobalLock
GetCurrentThreadId
SetProcessWorkingSetSize
GetProcessWorkingSetSize
VirtualQuery
GetUserDefaultLCID
MulDiv
IsBadWritePtr
FlushInstructionCache
HeapAlloc
GetProcessHeap
GlobalAlloc
HeapFree
lstrlenA
GlobalFree
CloseHandle
SetEvent
ResetEvent
InterlockedCompareExchange
ExitProcess
CompareStringA
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
SetLastError
GetVersionExA
lstrcpyA
GetTempFileNameA
GetTempPathA
CreateFileA
ReadFile
WriteFile
GetFileSize
SetEndOfFile
user32
SetWindowPlacement
AttachThreadInput
DestroyIcon
FlashWindowEx
EnableMenuItem
GetWindowRgn
UpdateWindow
RemoveMenu
CallNextHookEx
ClientToScreen
GetWindowPlacement
WindowFromPoint
GetAncestor
PtInRect
GetWindowThreadProcessId
SetActiveWindow
WindowFromDC
GetForegroundWindow
SetForegroundWindow
ToUnicode
UnhookWindowsHookEx
SetParent
GetActiveWindow
SetWindowRgn
GetCapture
InvalidateRgn
InvalidateRect
GetKeyboardState
IsZoomed
TrackPopupMenu
GetSystemMenu
EnumChildWindows
EnumWindows
MoveWindow
MapWindowPoints
OffsetRect
NotifyWinEvent
IsIconic
SetCursorPos
GetMessagePos
SetCursor
CreateIconIndirect
DrawEdge
DrawFrameControl
IsRectEmpty
EqualRect
IntersectRect
UnionRect
MsgWaitForMultipleObjects
IsWindowEnabled
GetWindowLongA
GetAsyncKeyState
PeekMessageA
DispatchMessageA
IsDialogMessageA
GetClassNameA
AdjustWindowRectEx
GetMenu
ShowCursor
GetWindowDC
GetUpdateRect
TranslateMessage
SetRect
SetCapture
ReleaseCapture
SetCaretPos
InvertRect
GetCaretBlinkTime
CreateCaret
ShowCaret
HideCaret
GetDlgItem
SetFocus
GetFocus
IsChild
FillRect
RedrawWindow
IsWindow
DestroyAcceleratorTable
IsWindowVisible
ShowWindow
GetParent
GetWindow
PostQuitMessage
GetCursor
GetIconInfo
DrawIconEx
ReleaseDC
GetDC
MonitorFromRect
MonitorFromWindow
MessageBeep
SetWindowPos
GetKeyState
MonitorFromPoint
GetDoubleClickTime
GetCursorPos
ScreenToClient
GetDesktopWindow
GetWindowRect
GetSystemMetrics
DestroyWindow
GetSysColor
SetTimer
BeginPaint
EndPaint
KillTimer
GetClientRect
CreateDialogParamA
CreateDialogIndirectParamA
WaitMessage
gdi32
GetPixel
DeleteDC
GetDeviceCaps
GetClipBox
RestoreDC
SaveDC
PatBlt
SetTextColor
CreateDIBSection
SetBkMode
IntersectClipRect
SetMapMode
CreateBitmap
SetBkColor
GetTextColor
GetBkColor
SetViewportOrgEx
OffsetViewportOrgEx
GetRgnBox
CreateRectRgn
CombineRgn
CreateRoundRectRgn
DeleteObject
GetDIBits
ExtCreateRegion
GetRegionData
SetWindowOrgEx
LPtoDP
CreateRectRgnIndirect
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
StretchBlt
StretchDIBits
SelectClipRgn
GetClipRgn
SetBrushOrgEx
SetStretchBltMode
GetStretchBltMode
GetTextMetricsA
CreateFontA
GetGlyphOutlineA
GetGlyphOutlineW
GetOutlineTextMetricsA
CreateCompatibleDC
GetStockObject
BitBlt
SelectObject
SetPixel
CreateSolidBrush
CreatePen
CreateCompatibleBitmap
advapi32
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
shell32
DragQueryFileA
DragFinish
DragAcceptFiles
SHAppBarMessage
SHGetMalloc
DragQueryPoint
ole32
OleLoadFromStream
CoInitializeEx
CoRegisterMessageFilter
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
OleFlushClipboard
OleSetClipboard
ReleaseStgMedium
OleGetClipboard
CoCreateGuid
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
CreateStreamOnHGlobal
CoGetClassObject
OleLockRunning
CreateBindCtx
OleInitialize
OleUninitialize
CoFileTimeNow
RegisterDragDrop
RevokeDragDrop
DoDragDrop
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
OleRegGetMiscStatus
CreateDataAdviseHolder
WriteClassStm
OleSaveToStream
oleaut32
OleLoadPicture
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayCopy
SafeArrayDestroy
SafeArrayUnlock
SafeArrayCreate
SafeArrayLock
VariantChangeTypeEx
OleCreatePropertyFrame
SysAllocStringByteLen
LoadTypeLi
LoadRegTypeLi
VarBstrCmp
SysAllocStringLen
OleCreateFontIndirect
SysStringLen
SysStringByteLen
VariantCopy
SysAllocString
VariantChangeType
VariantClear
VariantInit
SysFreeString
VarUI4FromStr
VarCmp
xprt5
_XprtAllocString@4
_XprtFreeString@4
_XprtCompareString@8
_XprtHashString@4
?Attach@TBstr@XPRT@@QAEXPAG@Z
?FileNameFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
xprt_towupper
xprt_strlcpy
??1TMemStream@XPRT@@UAE@XZ
??1TXmlDeserializer@XPRT@@UAE@XZ
?Deserialize@TXmlSerializable@XPRT@@QAE_NAAVTXmlDeserializer@2@@Z
??0TXmlDeserializer@XPRT@@QAE@AAVTStream@1@@Z
?SetPosition@TMemStream@XPRT@@UAE_N_JH@Z
?Write@TMemStream@XPRT@@UAEHPBXH@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetEncodedByteLength@TBstr@XPRT@@QBEHPBG@Z
??0TMemStream@XPRT@@QAE@XZ
??1TXmlWriter@XPRT@@UAE@XZ
?Assign@TBstr@XPRT@@QAEAAV12@PBDHPBG@Z
?GetData@TMemStream@XPRT@@QBEPBXXZ
?GetLength@TMemStream@XPRT@@UBE_JXZ
?Serialize@TXmlSerializable@XPRT@@QBE_NAAVTXmlWriter@2@@Z
??0TXmlWriter@XPRT@@QAE@AAVTStream@1@@Z
?Replace@TBstr@XPRT@@QAEHGG@Z
_XprtGetMicroseconds@0
?Assign@TBstr@XPRT@@QAEAAV12@G@Z
?GetRawBstrPtr@TBstr@XPRT@@QAEPAPAGXZ
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?Normalize@TBstr@XPRT@@QAEAAV12@XZ
?ReverseFind@TBstr@XPRT@@QBEHG@Z
xprt_abs
xprt_wcstol
xprt_wcstod
xprt_wcsrchr
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?GetBstrPtr@TBstr@XPRT@@QAEPAPAGXZ
?TrimRight@TBstr@XPRT@@QAEAAV12@G@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@G@Z
??0TBstr@XPRT@@QAE@GH@Z
xprt_iswdigit
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
_XprtAtomicIncrement@4
_XprtAtomicDecrement@4
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
_XprtInitialize@8
_XprtUninitialize@0
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
xprt_strcmp
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
kSystemEncoding
??0TBstr@XPRT@@QAE@PBDPBG@Z
?Replace@TBstr@XPRT@@QAEHPBG0@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?Find@TBstr@XPRT@@QBEHPBGH@Z
?Right@TBstr@XPRT@@QBE?AV12@H@Z
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
?Empty@TBstr@XPRT@@QAEXXZ
?Format@TBstr@XPRT@@QAAXPBGZZ
?Assign@TBstr@XPRT@@QAEAAV12@PBGH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Delete@TBstr@XPRT@@QAEHHH@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?Compare@TBstr@XPRT@@QBEHPBG@Z
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
kUtf8Encoding
_XprtStringEncodedByteLen@12
_XprtStringToUtf8@16
xprt_snprintf
xprt_strlcat
_XprtUnicodeToMultibyte@16
_XprtMemAlloc@4
_XprtMemFree@4
??0TBstr@XPRT@@QAE@PBGH@Z
xprt_isspace
xprt_wcscmp
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??0TBstr@XPRT@@QAE@ABV01@@Z
xprt_wcsnicmp
xprt_ucslcat
xprt_wcschr
xprt_isalnum
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
xprt_wcslen
xprt_wcsicmp
??0TBstr@XPRT@@QAE@XZ
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
xprt_memcpy
xprt_memmove
xprt_strlen
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
??0TBstr@XPRT@@QAE@PBG@Z
??1TBstr@XPRT@@QAE@XZ
xprt_ucslcpy
xprt_memset
?FreeDataChain@SPlex@XPRT@@QAEXXZ
_XprtMultibyteToUnicode@16
?MakeLower@TBstr@XPRT@@QAEAAV12@XZ
?Detach@TBstr@XPRT@@QAEPAGXZ
?FindOneOf@TBstr@XPRT@@QBEHPBG@Z
_XprtMemRealloc@8
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?RemoveAt@TPtrList@XPRT@@QAEXPAU__POSITION@2@@Z
?Find@TPtrList@XPRT@@QBEPAU__POSITION@2@PAXPAU32@@Z
?RemoveHead@TPtrList@XPRT@@QAEPAXXZ
?Find@TPtrArray@XPRT@@QBEHPAXH@Z
?InsertAt@TPtrArray@XPRT@@QAEXHPAXH@Z
_XprtGetSystemInfo@0
?GetAt@TBstr@XPRT@@QBEGH@Z
xprt_wcsstr
?RemoveAt@TPtrArray@XPRT@@QAEXHH@Z
?GetTickCount@TTime@XPRT@@SA?AV12@XZ
?Format@TTime@XPRT@@QBE?AVTBstr@2@PBG@Z
?Add@TPtrArray@XPRT@@QAEHPAX@Z
??1TPtrArray@XPRT@@QAE@XZ
??0TPtrArray@XPRT@@QAE@XZ
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
_XprtHtmlToPlain@8
xprt_snwprintf
?AddTail@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?RemoveTail@TPtrList@XPRT@@QAEPAXXZ
??0TPtrList@XPRT@@QAE@H@Z
?RemoveAll@TPtrList@XPRT@@QAEXXZ
??1TPtrList@XPRT@@QAE@XZ
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
??0TFile@XPRT@@QAE@XZ
?Open@TFile@XPRT@@QAE_NPBGI_N@Z
?GetLength@TFile@XPRT@@UBE_JXZ
?Read@TFile@XPRT@@UAEHPAXH@Z
?Close@TFile@XPRT@@UAE_NXZ
?IsOpen@TFile@XPRT@@QBE_NXZ
??1TFile@XPRT@@UAE@XZ
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
strrchr
strcat
_CIasin
floor
_CIacos
_clearfp
_controlfp
strtod
longjmp
strncpy
strcpy
pow
abort
sprintf
calloc
_iob
fprintf
_setjmp3
fclose
fread
strncmp
sscanf
_makepath
_splitpath
srand
rand
qsort
strcmp
setlocale
_snwprintf
wcstol
wcstok
swscanf
strstr
_wcsicmp
iswdigit
wcstoul
wcsncpy
abs
_wgetcwd
strlen
_purecall
memcmp
memmove
_set_sbh_threshold
fmod
fabs
??2@YAPAXI@Z
malloc
_wcsdup
realloc
memcpy
free
??3@YAXPAX@Z
_except_handler3
memset
_CIpow
msvfw32
DrawDibDraw
DrawDibClose
DrawDibOpen
Exports
Exports
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 140KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 100KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 132KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE