ee4c3be3e72ce269627c2a7ab46af39d5903cdf8d38ab20da0fe7cc5a8fbf983

Sharing

Copy URL Twitter E-mail

General

Target

ee4c3be3e72ce269627c2a7ab46af39d5903cdf8d38ab20da0fe7cc5a8fbf983
Size

663KB
MD5

0d6fbd28d0c89621ef8eb2107dab3920
SHA1

fe80e91645c29909d7dea244650249e851b51393
SHA256

ee4c3be3e72ce269627c2a7ab46af39d5903cdf8d38ab20da0fe7cc5a8fbf983
SHA512

9bf517bd5fbcc4816fe16c6b0798f19371d8ba903b2874376b6dc1b45211af76d83c6ed077e75e21be0b4b6494d3ddadeaf78c5078d802bfec517e9eed97230e
SSDEEP

12288:nlDPj+fi6AezfvNmDOeBcjdg4RT/ceIah:nlDCfZfbvNmKRTR

Score

N/A

Malware Config

Signatures

Files

ee4c3be3e72ce269627c2a7ab46af39d5903cdf8d38ab20da0fe7cc5a8fbf983
.dll regsvr32 windows x86

1318f1099f8165726da6bff851ca2c97

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExA
GetUserNameA
OpenProcessToken
GetTokenInformation
EqualSid
AllocateAndInitializeSid
FreeSid
RegCreateKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
RegQueryValueExA
RegSetValueExA

gdi32

GetTextExtentPoint32W
SelectObject
GetDeviceCaps
GetObjectType
CreatePalette
GetPaletteEntries
SetEnhMetaFileBits
GetEnhMetaFileBits
CreateBitmap
GetBitmapBits
SetMetaFileBitsEx
GetMetaFileBitsEx
DeleteObject
CreateFontIndirectA
GetObjectA

kernel32

FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
GetCommandLineA
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
GetDriveTypeA
CreateMutexA
GetDriveTypeW
RtlMoveMemory
ReleaseMutex
GetTimeFormatA
GetLocaleInfoA
FileTimeToSystemTime
GetCurrentProcess
LocalAlloc
GetLocalTime
RemoveDirectoryA
FindNextFileA
CompareFileTime
SearchPathA
SystemTimeToFileTime
FormatMessageA
DeleteAtom
GetPrivateProfileIntA
GetPrivateProfileStringA
GetSystemTime
CreateThread
TerminateThread
TerminateProcess
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
ExitThread
GetSystemTimeAsFileTime
CopyFileA
GetSystemDirectoryA
GetUserDefaultLCID
GetSystemDefaultLCID
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
FindFirstFileA
GetFullPathNameA
SetLastError
CompareStringA
GetShortPathNameA
GetThreadLocale
lstrcatA
GetFileAttributesA
GetEnvironmentStrings
WriteFile
DeleteFileA
GetTempPathA
GlobalLock
GlobalSize
GlobalUnlock
CreateFileA
GetFileTime
SetFilePointer
ReadFile
GetFileSize
FindClose
QueryDosDeviceW
GetACP
FindAtomA
AddAtomA
CloseHandle
GetLastError
GetCurrentProcessId
LocalFree
GlobalAlloc
GlobalFree
LoadLibraryExA
GetProcessHeap
TlsAlloc
TlsFree
TlsGetValue
HeapAlloc
HeapFree
GetCurrentThreadId
lstrcpyA
lstrlenA
GetModuleFileNameA
lstrcmpA
lstrcmpiA
lstrcpynA
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
GetWindowsDirectoryA
GetVersionExA
GetSystemInfo
TlsSetValue
GetModuleHandleA
GetProcAddress
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
IsBadWritePtr
IsBadReadPtr
lstrlenW
LeaveCriticalSection
EnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
HeapSize
RtlUnwind
InterlockedExchange
VirtualQuery
InitializeCriticalSectionAndSpinCount
GetTickCount
lstrcpynW
LoadLibraryW
UnhandledExceptionFilter
GetOEMCP
GetCPInfo
VirtualAlloc
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
FlushFileBuffers
VirtualProtect
SetStdHandle
QueryPerformanceCounter
SetUnhandledExceptionFilter
CreateDirectoryA
RaiseException

ole32

CLSIDFromProgID
HWND_UserMarshal
HWND_UserUnmarshal
CoFreeUnusedLibraries
StringFromGUID2
HWND_UserSize
CLSIDFromString
HWND_UserFree
CoRegisterMessageFilter
StgOpenStorage
CoUnmarshalInterface
CoMarshalInterface
CoGetMarshalSizeMax
OleGetAutoConvert
ReleaseStgMedium
MonikerRelativePathTo
CreateGenericComposite
CoCreateInstance
CoGetClassObject
StringFromCLSID
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
GetClassFile
CoTaskMemFree
CoTaskMemAlloc
CreateBindCtx
MkParseDisplayName

rpcrt4

NdrCStdStubBuffer_Release
RpcRaiseException
NdrClientCall2
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
NdrDllRegisterProxy

shlwapi

PathRemoveFileSpecW
PathIsUNCServerShareW
SHStrDupW
StrTrimW
ord216
UrlCanonicalizeA
ord218
ord97
ord157
StrCpyW
StrCmpNIW
ord215
StrCpyNW
ord431
ord378
ord107
ord395
SHRegGetValueW
ord125
ord158
PathFindFileNameW
ord80
wnsprintfA
PathCombineA
SHGetValueW
ord24
ord507
ord57
ord508
ord361
SHRegQueryInfoUSKeyW
SHRegEnumUSValueW
SHRegEnumUSKeyW
SHRegQueryUSValueW
SHRegOpenUSKeyW
SHRegCreateUSKeyW
SHRegCloseUSKey
ord457
PathIsPrefixW
ord309
ord472
ord219
SHRegGetUSValueW
ord83
UrlIsW
PathIsUNCW
PathStripToRootW
SHRegSetUSValueW
PathIsRootW
ord446
StrRChrW
ord398
ord94
ord141
ord143
StrDupW
ord29
SHRegDeleteEmptyUSKeyW
SHRegDeleteUSValueW
SHRegWriteUSValueW
ord335
ord558
ord120
ord130
ord559
StrCmpNA
PathFindExtensionA
ord441
StrCatBuffW
SHQueryValueExA
StrCatBuffA
PathFileExistsA
StrToIntW
PathRenameExtensionA
StrStrIW
PathUndecorateA
ord435
SHRegGetBoolUSValueA
ord75
ord52
ord65
PathIsUNCServerA
ord76
UrlGetPartA
StrToIntA
UrlCombineA
UrlGetLocationA
PathCreateFromUrlA
StrDupA
UrlUnescapeA
ord1
StrStrA
ord154
StrStrW
ord155
ord151
ord153
PathFindExtensionW
StrCmpIW
wnsprintfW
ord564
StrChrW
StrCmpNIA
ord124
ord128
ord59
ord220
ord138
UrlCanonicalizeW
UrlUnescapeW
UrlEscapeW
PathCreateFromUrlW
UrlCreateFromPathW
UrlGetLocationW
StrChrA
UrlCompareW
UrlCombineW
StrCmpW
UrlGetPartW
SHRegGetUSValueA
ord2
ord436
StrNCatA
StrCatW
StrStrIA

user32

RegisterClipboardFormatA
LoadStringA
wsprintfA
CharNextA
CharPrevA
DestroyWindow
PostMessageA
SetWindowLongA
DefWindowProcA
SendMessageA
SetForegroundWindow
GetDlgItem
EndDialog
GetWindowLongA
PostQuitMessage
PeekMessageA
DispatchMessageA
TranslateMessage
GetQueueStatus
MsgWaitForMultipleObjects
UnregisterClassA
RegisterClassA
GetDoubleClickTime
MapWindowPoints
SetWindowTextW
GetClientRect
GetWindowDC
SendMessageW
DrawTextExW
CharLowerA
IsDlgButtonChecked
CheckDlgButton
SendDlgItemMessageA
SetFocus
EnableWindow
GetWindowRect
GetDC
ReleaseDC
SetWindowPos
ShowWindow
MessageBoxW
SetDlgItemTextA
CreateWindowExA
CharUpperBuffA
SetTimer
KillTimer
OemToCharBuffA
SendNotifyMessageA
GetParent
GetLastActivePopup
GetActiveWindow
DialogBoxParamA
FindWindowA
GetClipboardFormatNameA
GetAsyncKeyState

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

AsyncGetClassBits
AsyncInstallDistributionUnit
BindAsyncMoniker
CDLGetLongPathNameA
CDLGetLongPathNameW
CoGetClassObjectFromURL
CoInstall
CoInternetCombineUrl
CoInternetCompareUrl
CoInternetCreateSecurityManager
CoInternetCreateZoneManager
CoInternetFeatureSettingsChanged
CoInternetGetProtocolFlags
CoInternetGetSecurityUrl
CoInternetGetSession
CoInternetIsFeatureEnabled
CoInternetIsFeatureEnabledForUrl
CoInternetIsFeatureZoneElevationEnabled
CoInternetParseUrl
CoInternetQueryInfo
CoInternetSetFeatureEnabled
CompareSecurityIds
CompatFlagsFromClsid
CopyBindInfo
CopyStgMedium
CreateAsyncBindCtx
CreateAsyncBindCtxEx
CreateFormatEnumerator
CreateURLMoniker
CreateURLMonikerEx
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Extract
FaultInIEFeature
FindMediaType
FindMediaTypeClass
FindMimeFromData
GetClassFileOrMime
GetClassURL
GetComponentIDFromCLSSPEC
GetMarkOfTheWeb
GetSoftwareUpdateInfo
HlinkGoBack
HlinkGoForward
HlinkNavigateMoniker
HlinkNavigateString
HlinkSimpleNavigateToMoniker
HlinkSimpleNavigateToString
InstallFlash
IsAsyncMoniker
IsJITInProgress
IsLoggingEnabledA
IsLoggingEnabledW
IsValidURL
MkParseDisplayNameEx
ObtainUserAgentString
PrivateCoInstall
RegisterBindStatusCallback
RegisterFormatEnumerator
RegisterMediaTypeClass
RegisterMediaTypes
ReleaseBindInfo
RevokeBindStatusCallback
RevokeFormatEnumerator
SetSoftwareUpdateAdvertisementState
URLDownloadA
URLDownloadToCacheFileA
URLDownloadToCacheFileW
URLDownloadToFileA
URLDownloadToFileW
URLDownloadW
URLOpenBlockingStreamA
URLOpenBlockingStreamW
URLOpenPullStreamA
URLOpenPullStreamW
URLOpenStreamA
URLOpenStreamW
UrlMkBuildVersion
UrlMkGetSessionOption
UrlMkSetSessionOption
WriteHitLogging
ZonesReInit

Sections

.text
Size: 459KB - Virtual size: 459KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1318f1099f8165726da6bff851ca2c97

Headers

File Characteristics

Imports

advapi32

gdi32

kernel32

ole32

rpcrt4

shlwapi

user32

version

Exports

Exports

Sections

.text Size: 459KB - Virtual size: 459KB

.orpc Size: 4KB - Virtual size: 3KB

.data Size: 24KB - Virtual size: 53KB

.rsrc Size: 98KB - Virtual size: 98KB

.reloc Size: 19KB - Virtual size: 19KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 459KB - Virtual size: 459KB

.orpc
Size: 4KB - Virtual size: 3KB

.data
Size: 24KB - Virtual size: 53KB

.rsrc
Size: 98KB - Virtual size: 98KB

.reloc
Size: 19KB - Virtual size: 19KB

.rmnet
Size: 56KB - Virtual size: 60KB