e0e61be1fad3651f569cbb89caf454ee266a8078896eaa7964e10ad36b63c5c7

Sharing

Copy URL Twitter E-mail

General

Target

e0e61be1fad3651f569cbb89caf454ee266a8078896eaa7964e10ad36b63c5c7
Size

210KB
MD5

16b4c4206305253408ab8c6852fe09f8
SHA1

4c8c0299c0ab4495605d535df9cf180498e44179
SHA256

e0e61be1fad3651f569cbb89caf454ee266a8078896eaa7964e10ad36b63c5c7
SHA512

33f3affa263cfcc616ef2e8f0da98dacca453d5d81a7f48f400d516cd8b3270b055f9ee0d4ae6586052c604c3adfb84be13e9d20cbdb20313ffd41923ec0296b
SSDEEP

3072:4cBiqORoDvOmiV8hnC3sNatmm1dnfRvnl1AedFW1LCZuxm0FuxeMeP:0qlDvOmiV8hnYswnvnrA5AZVE

Score

N/A

Malware Config

Signatures

Files

e0e61be1fad3651f569cbb89caf454ee266a8078896eaa7964e10ad36b63c5c7
.dll regsvr32 windows x86

4ad9005523d3a5905e13dc71b15f6def

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcslwr
memmove
wcsncpy
wcscat
wcstok
_wtol
_wcsicmp
wcsncat
wcscmp
wcscpy
wcslen
__CxxFrameHandler
_onexit
__dllonexit
_initterm
_adjust_fdiv
_purecall
??2@YAPAXI@Z
swprintf
_snwprintf
_ltow
malloc
free
wcschr
??3@YAXPAX@Z

atl

ord21
ord22
ord16
ord23
ord32
ord15
ord18

ntdll

RtlInitUnicodeString
RtlRunEncodeUnicodeString
RtlRunDecodeUnicodeString

advapi32

RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegCreateKeyExW
CryptImportKey
CryptSetHashParam
CryptGetHashParam
CredMarshalCredentialA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegConnectRegistryW
CryptSetProvParam
CryptAcquireContextW
CryptReleaseContext
GetTokenInformation
OpenThreadToken
RevertToSelf
ImpersonateLoggedOnUser
CryptGetProvParam
CryptDestroyKey
CryptGetKeyParam
CryptGetUserKey
CryptAcquireContextA
RegSetValueExW
RegEnumKeyExW
CryptVerifySignatureW
CryptDestroyHash
CryptSignHashW
CryptHashData
CryptCreateHash
CryptGenRandom
CredFree

cryptui

CryptUIDlgViewCertificateW

crypt32

CertFindChainInStore
CertEnumCertificatesInStore
CertCompareCertificateName
CryptImportPublicKeyInfo
CryptDecodeObject
CertFindExtension
CertVerifyTimeValidity
CertGetCertificateChain
CertDeleteCertificateFromStore
CertSetCertificateContextProperty
CertGetEnhancedKeyUsage
CertGetNameStringW
CryptDecodeObjectEx
CertVerifyCertificateChainPolicy
CertCreateCertificateContext
CryptUnprotectData
CertFreeCertificateChain
CertAddCertificateContextToStore
CryptProtectData
CertGetCertificateContextProperty
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore

gdi32

GetTextExtentPoint32W
SelectObject

kernel32

lstrcpyA
SetLastError
FormatMessageW
InitializeCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
GetCurrentProcess
GetCurrentThreadId
GetACP
LocalFree
LocalAlloc
GetLastError
GetCurrentProcessId
lstrlenW
lstrcmpW
GetProcAddress
WideCharToMultiByte
LeaveCriticalSection
CloseHandle
GetCurrentThread
EnterCriticalSection
MultiByteToWideChar
LoadLibraryA
FreeLibrary
LoadLibraryW
DeleteCriticalSection
lstrlenA
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
CompareFileTime
GetComputerNameExW
ExpandEnvironmentStringsW
lstrcmpiW
InterlockedIncrement
InterlockedDecrement

mprapi

MprAdminGetErrorString

ole32

CoGetClassObject
CoTaskMemAlloc
CoCreateInstance

oleaut32

SysStringLen
GetErrorInfo
SysAllocStringLen
VariantClear
SysAllocString
SysFreeString
VariantInit

rasapi32

RasSetCredentialsW

rtutils

RouterLogEventStringW
RouterLogEventW
TraceVprintfExA
TraceRegisterExW
TraceDeregisterW
TraceDumpExA

schannel

InitializeSecurityContextW
FreeCredentialsHandle
QueryContextAttributesW
ApplyControlToken
DeleteSecurityContext
FreeContextBuffer
AcceptSecurityContext
AcquireCredentialsHandleW

secur32

SetContextAttributesW
GetUserNameExW
QuerySecurityContextToken
DecryptMessage
EncryptMessage

user32

FindWindowW
GetWindowThreadProcessId
PostMessageW
GetWindowLongW
BringWindowToTop
LoadStringW
GetWindowTextW
IsDlgButtonChecked
EndDialog
SetWindowLongW
GetDlgItem
SetWindowTextW
SetWindowPos
GetSystemMetrics
GetWindowRect
GetDesktopWindow
DialogBoxParamW
DestroyWindow
UpdateWindow
CreateDialogParamW
CheckRadioButton
GetFocus
ReleaseDC
GetDC
wsprintfW
GetWindowTextLengthW
WinHelpW
MessageBoxW
SendMessageW
SetFocus
ShowWindow
CheckDlgButton
EnableWindow

winscard

SCardEstablishContext
SCardGetCardTypeProviderNameA
SCardFreeMemory
SCardReleaseContext
SCardListReadersA

comctl32

InitCommonControlsEx

psapi

GetModuleBaseNameW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RasEapCreateConnectionProperties
RasEapCreateConnectionProperties_XP
RasEapCreateUserProperties
RasEapCreateUserProperties_XP
RasEapFreeMemory
RasEapGetCredentials
RasEapGetIdentity
RasEapGetInfo
RasEapInvokeConfigUI
RasEapInvokeInteractiveUI

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ad9005523d3a5905e13dc71b15f6def

Headers

File Characteristics

Imports

msvcrt

atl

ntdll

advapi32

cryptui

crypt32

gdi32

kernel32

mprapi

ole32

oleaut32

rasapi32

rtutils

schannel

secur32

user32

winscard

comctl32

psapi

Exports

Exports

Sections

.text Size: 132KB - Virtual size: 131KB

.data Size: 64KB - Virtual size: 64KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 132KB - Virtual size: 131KB

.data
Size: 64KB - Virtual size: 64KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 7KB - Virtual size: 6KB