faf0c287c756003c065e32ebb7ff652a73f2d2cc34cafc1f1bd1d6a3aec498b3

Sharing

Copy URL

Twitter E-mail

General

Target

faf0c287c756003c065e32ebb7ff652a73f2d2cc34cafc1f1bd1d6a3aec498b3
Size

471KB
MD5

0e7e1cad316016937b709bbf89b23810
SHA1

b7ddaea5e5832bb2fed4f3653e4011d1a8e73ae5
SHA256

faf0c287c756003c065e32ebb7ff652a73f2d2cc34cafc1f1bd1d6a3aec498b3
SHA512

fa78a17d686571b028e17a65f6d349fc980c38e14a57c9ec1be2a49d83cdaa7ee5c79275c9048977ab01c6fe48957c2840022eb2145b0ca8172a0a082e4ce813
SSDEEP

6144:jpWxq0Z4Gqj66AOAk5sgY0hr/ANddrLKY0e8mvVzUTRDMD1nkVdurx:tD8TqP/5sEhr/ANdBKe8QVM1ykVdur

Score

N/A

Malware Config

Signatures

Files

faf0c287c756003c065e32ebb7ff652a73f2d2cc34cafc1f1bd1d6a3aec498b3
.dll windows x86

7fbdd28d5aadf838ff4f9caec3419956

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

HeapFree
WideCharToMultiByte
OutputDebugStringA
LoadLibraryExW
GetModuleHandleW
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
HeapAlloc
SetUnhandledExceptionFilter
HeapSize
GetCPInfo
GetACP
GetOEMCP
LoadLibraryExA
InitializeCriticalSection
GetEnvironmentStringsW
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
GetCommandLineA
UnhandledExceptionFilter
Module32NextW
CreateToolhelp32Snapshot
Module32FirstW
GetModuleFileNameW
LoadLibraryW
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetVersionExA
LocalFree
GetSystemTime
CloseHandle
ReleaseMutex
GetFileAttributesExW
GetFileTime
CreateMutexA
CreateFileW
ReadFile
WriteFile
SetFileTime
WaitForSingleObject
SystemTimeToFileTime
SetFilePointer
InterlockedCompareExchange
GetProcAddress
InterlockedDecrement
InterlockedIncrement
FreeLibrary
GetSystemTimeAsFileTime
DeleteCriticalSection
EnterCriticalSection
InterlockedExchange
RaiseException
SetStdHandle
GetConsoleMode
GetConsoleCP
LeaveCriticalSection
DisableThreadLibraryCalls
GetLastError
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetVersion
CompareFileTime
FileTimeToSystemTime
CreateFileA
lstrlenA
GetDriveTypeA
GetVolumeInformationA
GetLogicalDriveStringsA
DeviceIoControl
Sleep

crypt32

CryptUnprotectData
CertVerifyCertificateChainPolicy

advapi32

RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
CryptGetProvParam
RegOpenKeyExA
RegQueryValueExW
CryptGetDefaultProviderW
CryptVerifySignatureA
CryptGenKey
CryptDuplicateKey
CryptSignHashA
CryptGetKeyParam
CryptSetKeyParam
CryptExportKey
CryptGetHashParam
CryptSetHashParam
CryptReleaseContext
CryptContextAddRef
CryptAcquireContextW
CryptImportKey
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDeriveKey
CryptGenRandom
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsA
GetTraceLoggerHandle
GetTraceEnableFlags
TraceMessage

shell32

SHGetFolderPathW

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData

msdrm

DRMGetUnboundLicenseObject
DRMGetUnboundLicenseAttribute
DRMGetUnboundLicenseAttributeCount
DRMParseUnboundLicense
DRMCloseQueryHandle
DRMGetUnboundLicenseObjectCount

Exports

Exports

SPAttest
SPBindLicense
SPCheckEnvironmentSecurity
SPCloseHandle
SPCommit
SPCreateDecryptor
SPCreateEnablingPrincipal
SPCreateEncryptor
SPCreatePCE
SPCreateSecurityProcessor
SPDecrypt
SPDecryptFinal
SPDecryptUpdate
SPEnableAndEncrypt
SPEnablePublishingLicense
SPEncrypt
SPEncryptFinal
SPEncryptUpdate
SPGetBoundRightKey
SPGetCurrentTime
SPGetInfo
SPGetLicenseAttribute
SPGetLicenseAttributeCount
SPGetLicenseObject
SPGetLicenseObjectCount
SPGetProcAddress
SPIsActivated
SPLoadLibrary
SPRegisterRevocationList
SPSign

Sections

.text
Size: 349KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7fbdd28d5aadf838ff4f9caec3419956

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

crypt32

advapi32

shell32

wintrust

msdrm

Exports

Exports

Sections

.text Size: 349KB - Virtual size: 349KB

.data Size: 51KB - Virtual size: 51KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 10KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 349KB - Virtual size: 349KB

.data
Size: 51KB - Virtual size: 51KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 10KB

.rmnet
Size: 56KB - Virtual size: 60KB