6f919577f8a6333b6cc7e44b875faa2b92f5e6caa734d9831049d0d37cff7365

Sharing

Copy URL Twitter E-mail

General

Target

6f919577f8a6333b6cc7e44b875faa2b92f5e6caa734d9831049d0d37cff7365
Size

1.1MB
MD5

091180a3f44d8b7267d3e31bd6a62cd0
SHA1

180a85a8395d468c4ebd8895062a1d8eac33419b
SHA256

6f919577f8a6333b6cc7e44b875faa2b92f5e6caa734d9831049d0d37cff7365
SHA512

37f25d8b76afc48bef6410e156b4b8de19838affa8bd70b3b81fe3a5e2ca01d6cb5f63877ca65a75ac0f9459bc388d3c71fd935fea113cc9ef830b4bf43e3644
SSDEEP

12288:HwTHD/D0lEdA1PsRHZS5Np2xSaSnX3yB/omgRbd2IDsAOmSbT0x/UuYG/:HyHDIlEdA1UqQSa7B/SpHs5H0W

Score

N/A

Malware Config

Signatures

Files

6f919577f8a6333b6cc7e44b875faa2b92f5e6caa734d9831049d0d37cff7365
.dll regsvr32 windows x86

9360718fcd76079283e16a3648ca9454

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

fgets
_wfopen
fclose
towlower
iswlower
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
_amsg_exit
_initterm
_XcptFilter
wcstok_s
swscanf_s
_wcsicmp
??_V@YAXPAX@Z
memset
wcsrchr
??_U@YAPAXI@Z
wcscspn
memcpy
_ultow_s
realloc
malloc
free
isxdigit
wcsncmp
isalpha
memmove
iswascii
iswalpha
_i64tow_s
_wtoi
wcsstr
_vsnwprintf
_purecall
wcschr
_vsnprintf
iswdigit
iswxdigit
wcstol
swprintf_s
memcpy_s

ole32

CoUnmarshalInterface
CoGetTreatAsClass
CoGetObject
CoInitializeEx
CoSetProxyBlanket
CoFreeUnusedLibraries
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
FreePropVariantArray
StringFromGUID2
CLSIDFromProgID
StgOpenStorage
OleGetAutoConvert
ReleaseStgMedium
CoMarshalInterface
CoGetMarshalSizeMax
CoCreateGuid
MonikerRelativePathTo
CreateGenericComposite
StringFromCLSID
CLSIDFromString
CoGetClassObject
CoCreateInstance
GetClassFile
CreateBindCtx
MkParseDisplayName
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoInitialize

oleaut32

SysReAllocString
SysAllocStringLen
SafeArrayCreateVector
SysAllocString
SysStringLen
SysFreeString
VariantClear

shlwapi

ord596
PathIsUNCServerShareW
PathUnquoteSpacesW
SHDeleteKeyW
ord12
StrChrA
PathGetDriveNumberW
PathIsUNCW
StrCmpNW
PathFindFileNameW
StrDupW
ord158
ord157
StrCmpNA
StrStrIA
ord2
SHRegGetValueA
ord154
StrDupA
UrlCanonicalizeW
UrlGetPartW
UrlUnescapeW
UrlEscapeW
PathCreateFromUrlW
UrlCreateFromPathW
UrlGetLocationW
StrCmpW
UrlCompareW
StrChrW
ord176
SHRegGetUSValueA
ord156
SHSetValueA
PathFindExtensionW
ord151
ord153
ord155
StrToIntA
StrStrIW
StrChrIW
SHCreateStreamOnFileW
StrCmpIW
StrToInt64ExW
ord212
SHOpenRegStream2W
ord597
SHStrDupW
StrTrimW
SHRegGetBoolUSValueW
ord219
StrToIntExW
SHRegQueryInfoUSKeyW
SHRegEnumUSValueW
SHRegEnumUSKeyW
SHRegQueryUSValueW
SHRegCreateUSKeyW
SHRegCloseUSKey
SHRegOpenUSKeyW
PathIsPrefixW
PathRemoveFileSpecW
SHRegGetUSValueW
SHRegGetValueW
StrToIntW
PathIsRootW
SHRegWriteUSValueW
SHRegDeleteEmptyUSKeyW
SHRegDeleteUSValueW
StrRChrW
UrlIsW
PathStripToRootW
ord215
PathCreateFromUrlA
PathRemoveExtensionA
ShellMessageBoxA
UrlCombineW
PathFindExtensionA
StrStrW
SHQueryValueExA
StrStrA
PathIsPrefixA
PathFileExistsA
StrCmpNIA
ord1
PathSkipRootW
ord184
StrChrNW
SHRegGetBoolUSValueA
PathIsUNCServerW
UrlGetPartA

user32

RegisterClipboardFormatA
SendDlgItemMessageA
SetWindowLongA
DefWindowProcA
PostMessageA
CharPrevA
CharNextA
LoadStringA
SendMessageW
GetWindowLongA
LoadStringW
SetDlgItemTextW
GetDlgItem
SendMessageA
SetForegroundWindow
EndDialog
DialogBoxParamW
RegisterClassA
UnregisterClassA
CreateWindowExA
PeekMessageA
PostQuitMessage
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageA
CharNextW
CharPrevW
GetClipboardFormatNameA
CharLowerA
GetParent
GetLastActivePopup
FindWindowA
SendNotifyMessageA
KillTimer
SetTimer
CharUpperBuffA
AllowSetForegroundWindow
SystemParametersInfoA
GetAsyncKeyState
EnumWindows
GetClassNameW
SendMessageTimeoutW
LoadImageW
GetDC
SystemParametersInfoW
SendDlgItemMessageW
DestroyIcon
RegisterWindowMessageW
GetWindowRect
SetPropA
GetWindowDC
DrawTextW
GetClientRect
GetDoubleClickTime
ReleaseDC
MapWindowPoints
GetProcessWindowStation
GetThreadDesktop
GetUserObjectInformationW
PeekMessageW
DispatchMessageW
SetWindowTextW
SetWindowLongW
CheckDlgButton
ShowWindow
EnableWindow
SetWindowPos
IsWindowVisible
IsDlgButtonChecked
GetWindowLongW
PostMessageW
CharLowerW
GetPropA

advapi32

UnregisterTraceGuids
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyExA
RegGetValueA
RegQueryValueExW
RegEnumKeyExA
RegOpenKeyA
RegQueryValueA
RegQueryInfoKeyW
RegEnumValueW
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegEnumValueA
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
TraceMessageVa
RegQueryInfoKeyA
RegDeleteValueA
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidA
FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
CheckTokenMembership
ConvertSidToStringSidW
RegisterTraceGuidsA

ntdll

RtlMoveMemory

kernel32

ReleaseActCtx
CreateActCtxW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
QueryPerformanceCounter
Sleep
InitializeCriticalSectionAndSpinCount
ReleaseMutex
OpenFileMappingW
LocalReAlloc
OpenProcess
CreateMutexW
InitOnceExecuteOnce
IsWow64Process
GetPrivateProfileIntW
WritePrivateProfileStringW
CreateMutexA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetDriveTypeW
LoadLibraryExW
GetModuleHandleA
GetTimeFormatA
GetModuleHandleW
GetLocaleInfoA
GetFullPathNameA
GetTempFileNameA
FileTimeToSystemTime
FormatMessageA
GetPrivateProfileIntA
GetPrivateProfileStringA
DeleteAtom
AddAtomA
FindAtomA
SystemTimeToFileTime
SearchPathA
GetCurrentProcess
FindNextFileA
FindFirstFileA
RemoveDirectoryA
TerminateProcess
TerminateThread
ExitThread
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
CreateThread
CopyFileA
GetSystemDirectoryA
GetSystemDefaultLCID
DeleteFileA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
WriteFile
SetFileAttributesA
CreateFileA
GetLongPathNameW
GetLongPathNameA
GetThreadLocale
ActivateActCtx
DecodePointer
GetTempPathA
CreateDirectoryA
GetFileAttributesA
LoadLibraryExA
GetWindowsDirectoryA
GetShortPathNameW
GetSystemInfo
EncodePointer
GetCPInfo
IsDBCSLeadByte
QueryDosDeviceW
GetDriveTypeA
GetFullPathNameW
AcquireSRWLockShared
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetVersionExA
IsDBCSLeadByteEx
CompareStringOrdinal
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
GlobalSize
GetSystemTime
SetLastError
GetUserDefaultUILanguage
GetLocaleInfoW
LoadLibraryW
GetUserDefaultLCID
LoadLibraryA
GetProcAddress
SetFilePointer
ReadFile
FindClose
FindFirstFileW
GetFileSize
CreateFileW
GetFileAttributesW
DeleteFileW
CompareStringW
lstrcmpW
InterlockedExchange
GetACP
CloseHandle
FindAtomW
GetModuleHandleExW
AddAtomW
GetCurrentProcessId
GetCurrentThreadId
CompareFileTime
GetSystemTimeAsFileTime
lstrlenA
TlsFree
TlsAlloc
GetProcessHeap
HeapFree
TlsSetValue
HeapAlloc
TlsGetValue
GetModuleFileNameA
MultiByteToWideChar
lstrcmpA
WideCharToMultiByte
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
InterlockedCompareExchange
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
lstrlenW
GetLastError
LocalFree
LocalAlloc
DeactivateActCtx
LockResource
LoadResource
SizeofResource
FindResourceW
GetFileTime
CompareStringA
GetFileAttributesExW
GetCurrentThread
GetVersionExW
SetErrorMode
OpenMutexW
DuplicateHandle
RaiseException
GetShortPathNameA
GetLocalTime

iertutil

ord86
ord306
ord88
ord110
ord318
ord683
ord76
ord111
ord81
ord681
ord85
ord74
ord79
ord656
ord653
ord685
ord72
ord62
ord57
ord682
ord651
ord657
ord658
ord650
ord664
ord667
ord50
ord166
ord172
ord159
ord158
ord150
ord54
ord201
ord200
ord27
ord28
ord209
ord43
ord205
ord321
ord574
ord56
ord44
ord42
ord308
ord45
ord58
ord16
ord528
ord527
ord517
ord520
ord404
ord541
ord325
ord403
ord457
ord458
ord340
ord453
ord309
ord386
ord518
ord519
ord460
ord230
FastMimeSetIsMimeFilterEnabled
FastMimeGetIsMimeFilterEnabled
FastMimeLookupKnownType
ord20
ord70
ord63
ord68
ord64
ord61
ord151
ord443
ord32
ord526
ord9
ord25
ord173
ord17
ord89
ord35
ord654
ord665
ord675
ord672
ord655
ord516

wininet

InternetReadFileExW
FindFirstUrlCacheEntryExW
GetUrlCacheEntryInfoW
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
CommitUrlCacheEntryW
CreateUrlCacheContainerW
FindNextUrlCacheContainerW
FindNextUrlCacheEntryA
FindFirstUrlCacheContainerW
FindFirstUrlCacheEntryExA
DeleteUrlCacheContainerW
GetUrlCacheConfigInfoW
IsHostInProxyBypassList
InternetCloseHandle
InternetSetOptionA
GetUrlCacheEntryInfoExW
HttpQueryInfoW
InternetLockRequestFile
InternetQueryOptionA
HttpQueryInfoA
InternetOpenW
InternetSetStatusCallbackA
InternetConnectW
InternetSetOptionW
InternetQueryOptionW
InternetCreateUrlA
InternetInitializeAutoProxyDll
InternetQueryDataAvailable
InternetReadFile
InternetErrorDlg
RetrieveUrlCacheEntryFileW
UnlockUrlCacheEntryFileW
InternetUnlockRequestFile
ResumeSuspendedDownload
InternetSetFilePointer
InternetGetConnectedState
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestExW
HttpSendRequestW
InternetWriteFile
HttpEndRequestA
FtpGetFileSize
InternetOpenUrlW
GetUrlCacheEntryInfoA
CreateUrlCacheEntryA
CommitUrlCacheEntryA
InternetTimeToSystemTimeA
InternetCrackUrlA
DeleteUrlCacheEntryA
InternetTimeFromSystemTimeA
InternetCanonicalizeUrlA
FindNextUrlCacheContainerA
FindCloseUrlCache
GetUrlCacheEntryInfoExA
FindFirstUrlCacheContainerA

Exports

Exports

AsyncGetClassBits
AsyncInstallDistributionUnit
BindAsyncMoniker
CDLGetLongPathNameA
CDLGetLongPathNameW
CORPolicyProvider
CoGetClassObjectFromURL
CoInstall
CoInternetCanonicalizeIUri
CoInternetCombineIUri
CoInternetCombineUrl
CoInternetCombineUrlEx
CoInternetCompareUrl
CoInternetCreateSecurityManager
CoInternetCreateZoneManager
CoInternetFeatureSettingsChanged
CoInternetGetProtocolFlags
CoInternetGetSecurityUrl
CoInternetGetSecurityUrlEx
CoInternetGetSession
CoInternetIsFeatureEnabled
CoInternetIsFeatureEnabledForIUri
CoInternetIsFeatureEnabledForUrl
CoInternetIsFeatureZoneElevationEnabled
CoInternetParseIUri
CoInternetParseUrl
CoInternetQueryInfo
CoInternetSetFeatureEnabled
CompareSecurityIds
CompatFlagsFromClsid
CopyBindInfo
CopyStgMedium
CreateAsyncBindCtx
CreateAsyncBindCtxEx
CreateFormatEnumerator
CreateIUriBuilder
CreateURLMoniker
CreateURLMonikerEx
CreateURLMonikerEx2
CreateUri
CreateUriFromMultiByteString
CreateUriPriv
CreateUriWithFragment
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Extract
FaultInIEFeature
FindMediaType
FindMediaTypeClass
FindMimeFromData
GetAddSitesFileUrl
GetClassFileOrMime
GetClassURL
GetComponentIDFromCLSSPEC
GetIDNFlagsForUri
GetIUriPriv
GetIUriPriv2
GetLabelsFromNamedHost
GetMarkOfTheWeb
GetPortFromUrlScheme
GetPropertyFromName
GetPropertyName
GetSoftwareUpdateInfo
GetUrlmonThreadNotificationHwnd
HlinkGoBack
HlinkGoForward
HlinkNavigateMoniker
HlinkNavigateString
HlinkSimpleNavigateToMoniker
HlinkSimpleNavigateToString
IECompatLogCSSFix
IEDllLoader
IEInstallScope
IntlPercentEncodeNormalize
IsAsyncMoniker
IsDWORDProperty
IsIntranetAvailable
IsJITInProgress
IsLoggingEnabledA
IsLoggingEnabledW
IsStringProperty
IsValidURL
MkParseDisplayNameEx
ObtainUserAgentString
PrivateCoInstall
QueryAssociations
QueryClsidAssociation
RegisterBindStatusCallback
RegisterFormatEnumerator
RegisterMediaTypeClass
RegisterMediaTypes
ReleaseBindInfo
ResetUrlmonLanguageData
RevokeBindStatusCallback
RevokeFormatEnumerator
SetSoftwareUpdateAdvertisementState
ShouldDisplayPunycodeForUri
ShouldShowIntranetWarningSecband
ShowTrustAlertDialog
URLDownloadA
URLDownloadToCacheFileA
URLDownloadToCacheFileW
URLDownloadToFileA
URLDownloadToFileW
URLDownloadW
URLOpenBlockingStreamA
URLOpenBlockingStreamW
URLOpenPullStreamA
URLOpenPullStreamW
URLOpenStreamA
URLOpenStreamW
UrlMkBuildVersion
UrlMkGetSessionOption
UrlMkSetSessionOption
WriteHitLogging
ZonesReInit

Sections

.text
Size: 665KB - Virtual size: 665KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wpp_sf
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9360718fcd76079283e16a3648ca9454

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ole32

oleaut32

shlwapi

user32

advapi32

ntdll

kernel32

iertutil

wininet

Exports

Exports

Sections

.text Size: 665KB - Virtual size: 665KB

.wpp_sf Size: 6KB - Virtual size: 5KB

.data Size: 41KB - Virtual size: 41KB

.rsrc Size: 340KB - Virtual size: 339KB

.reloc Size: 26KB - Virtual size: 25KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 665KB - Virtual size: 665KB

.wpp_sf
Size: 6KB - Virtual size: 5KB

.data
Size: 41KB - Virtual size: 41KB

.rsrc
Size: 340KB - Virtual size: 339KB

.reloc
Size: 26KB - Virtual size: 25KB

.rmnet
Size: 56KB - Virtual size: 60KB