cd5a809ad464add65738e99f6eac3e6111e4de41b4606875e5228675ad32bfde

Sharing

Copy URL

Twitter E-mail

General

Target

cd5a809ad464add65738e99f6eac3e6111e4de41b4606875e5228675ad32bfde
Size

136KB
MD5

0677f01c90f73680649e2ab3a74d7d03
SHA1

7dd98d5581ab4d000a49c238ff7a8cb815261b4e
SHA256

cd5a809ad464add65738e99f6eac3e6111e4de41b4606875e5228675ad32bfde
SHA512

cf968d98e474368ff70129ab8db5d77413ec65e74ef3e3786914c5e496a1274d390eb02b4e97ec225043cdd44720723d2132722ab00de16d23f6b791cbb6fc56
SSDEEP

3072:gtbBzuGSmwHc6+pmdWlsNoaqEodGjAbKzRIuIuHnD5lM:64GHw86DWl8/q1dOD6at

Score

N/A

Malware Config

Signatures

Files

cd5a809ad464add65738e99f6eac3e6111e4de41b4606875e5228675ad32bfde
.dll windows x86

b2372cbfdf38a6fe7306e57065aaeb85

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
memcpy
_vsnwprintf
_XcptFilter
malloc
free
_initterm
_amsg_exit
_except_handler4_common
??3@YAXPAX@Z
_purecall
??2@YAPAXI@Z

api-ms-win-core-localregistry-l1-1-0

RegDeleteValueW
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegEnumValueW

user32

IsWindow
IsCharAlphaW
CharNextW
CharLowerW

comctl32

ord332
ord386
ord334
ord329
ord336
ord337
ord338
ord339
ord328

shell32

SHGetIDListFromObject
SHCreateItemWithParent
SHBindToFolderIDListParent
SHBindToFolderIDListParentEx
ord147
SHGetFolderLocation
SHParseDisplayName
SHGetDesktopFolder
SHChangeNotify
ord16
ord19
ord21
ord704
SHCreateItemFromIDList
ord102
ord24
SHBindToParent
ord155
SHBindToObject
ord25
ord18
ord17

shlwapi

PathAppendW
StrRetToBufW
ord476
StrRetToStrW
PathFindFileNameW
PathRemoveFileSpecW
SHStrDupW
ord446
PathCombineW
ord219
PathFindExtensionW
PathMatchSpecW
ord214
PathIsSameRootW
PathIsRootW
SHGetValueW
ord24
StrDupW
StrCmpNIW
ord215
ord217
PathFileExistsW
PathIsUNCW
ord158
PathAddBackslashW
PathRemoveBackslashW

linkinfo

IsValidLinkInfo
GetLinkInfoData
CompareLinkInfoVolumes
ResolveLinkInfoW
CreateLinkInfoW
DestroyLinkInfo
CompareLinkInfoReferents

kernel32

GetModuleHandleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
Sleep
InterlockedExchange
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
DelayLoadFailureHook
SetLastError
lstrlenA
EnterCriticalSection
LeaveCriticalSection
GetFileAttributesExW
FileTimeToLocalFileTime
lstrcmpW
GetShortPathNameW
GetFullPathNameW
FindFirstFileW
FindClose
SetFileAttributesW
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
lstrlenW
SetErrorMode
GetFileAttributesW
DeleteCriticalSection
DeleteFileW
GetLastError
LocalAlloc
InitializeCriticalSectionAndSpinCount
LocalFree

Exports

Exports

AddAllTwinsToTwinList
AddFolderTwin
AddObjectTwin
AddTwinToTwinList
AnyTwins
BeginReconciliation
ClearBriefcaseCache
CloseBriefcase
CompareFileStamps
CountSourceFolderTwins
CreateFolderTwinList
CreateRecList
CreateTwinList
DeleteBriefcase
DeleteTwin
DestroyFolderTwinList
DestroyRecList
DestroyTwinList
EndReconciliation
FindBriefcaseClose
FindFirstBriefcase
FindNextBriefcase
GetFileStamp
GetFolderTwinStatus
GetObjectTwinHandle
GetOpenBriefcaseInfo
GetVolumeDescription
IsFolderTwin
IsOrphanObjectTwin
IsPathOnVolume
OpenBriefcase
ReconcileItem
ReleaseTwinHandle
RemoveAllTwinsFromTwinList
RemoveTwinFromTwinList
SaveBriefcase

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b2372cbfdf38a6fe7306e57065aaeb85

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-localregistry-l1-1-0

user32

comctl32

shell32

shlwapi

linkinfo

kernel32

Exports

Exports

Sections

.text Size: 71KB - Virtual size: 71KB

.data Size: 61KB - Virtual size: 60KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 71KB - Virtual size: 71KB

.data
Size: 61KB - Virtual size: 60KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 2KB - Virtual size: 2KB