EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
7dc72e401b253ce41e31958190b023d24c2d3c92be1faa66cebe648946f6b195.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7dc72e401b253ce41e31958190b023d24c2d3c92be1faa66cebe648946f6b195.dll
Resource
win10v2004-20220812-en
General
-
Target
7dc72e401b253ce41e31958190b023d24c2d3c92be1faa66cebe648946f6b195
-
Size
239KB
-
MD5
0194b3763368811dcd5d61dadc2c2e6a
-
SHA1
6968f85930686a7abf3f3fd8043e85cf3ca04822
-
SHA256
7dc72e401b253ce41e31958190b023d24c2d3c92be1faa66cebe648946f6b195
-
SHA512
6c19db3168470b4eaf57dcd1d5ac1129258bdafbb5626c6abf84c5849b068202275dd6831886632bb29f3b341ec2f8e84e720eae513d89023a256d2c0049bf92
-
SSDEEP
3072:hy+qXmD0V4eov6ow0BndFR5vAI5gia2xzYfZSMBKAjth9vWHeArUisxZ4ca7iVzg:xSmVDZBnrfr5Dh1EfZvkeAryW4M157
Malware Config
Signatures
Files
-
7dc72e401b253ce41e31958190b023d24c2d3c92be1faa66cebe648946f6b195.dll windows x86
0ff4809bd50d03f27c439a4139848a20
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreate
xprt5
_XprtInitialize@8
xprt_strlen
xprt_memcpy
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?Add@TPtrArray@XPRT@@QAEHPAX@Z
xprt_iswdigit
?GetLength@TBstr@XPRT@@QBEHXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
_XprtUninitialize@0
?GetAt@TBstr@XPRT@@QBEGH@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TBstr@XPRT@@QAE@ABV01@@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
_XprtAtomicDecrement@4
_XprtMemAlloc@4
xprt_memmove
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
?Compare@TBstr@XPRT@@QBEHPBG@Z
xprt_strcmp
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
_XprtAtomicIncrement@4
xprt_memset
XprtTrace
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBDPBG@Z
?Format@TBstr@XPRT@@QAAXPBGZZ
kSystemEncoding
??0TBstr@XPRT@@QAE@PBG@Z
??0TBstr@XPRT@@QAE@XZ
??1TBstr@XPRT@@QAE@XZ
_XprtMemFree@4
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
aolidlemon
ord2
ord3
ord1
msvcrt
strncpy
memset
strcmp
qsort
_snwprintf
_purecall
_except_handler3
__dllonexit
_onexit
_initterm
_adjust_fdiv
strstr
free
_stricmp
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
strncmp
_mbstrlen
_mbschr
_mbsstr
_mbscmp
?terminate@@YAXXZ
_strlwr
malloc
wcsrchr
strcat
printf
fopen
fwrite
fclose
tolower
getenv
time
strrchr
_getpid
_vsnprintf
_beginthreadex
sprintf
_snprintf
atoi
__CxxFrameHandler
memcpy
strcpy
strlen
kernel32
VirtualQuery
SuspendThread
GetThreadContext
GlobalAlloc
GlobalFree
GetCurrentProcessId
GetEnvironmentVariableA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetCurrentThread
GetVersion
ReadFile
WriteFile
HeapFree
HeapAlloc
CreateDirectoryA
MoveFileA
GetFileAttributesA
OpenEventA
IsBadWritePtr
OpenProcess
GetExitCodeProcess
OutputDebugStringA
Sleep
GetCurrentProcess
GetVersionExA
ResumeThread
WaitForMultipleObjects
TerminateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
CreateSemaphoreA
WaitForSingleObject
CreateEventA
CreateProcessA
SetLastError
GetLastError
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
InterlockedExchange
CompareStringA
GetCurrentThreadId
ExitProcess
GetProcessHeap
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
GetSystemPowerStatus
FreeLibrary
GetTickCount
advapi32
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
user32
DispatchMessageA
GetMessageA
PostMessageA
DefWindowProcA
CreateWindowExA
SetTimer
KillTimer
TranslateMessage
MsgWaitForMultipleObjects
DestroyWindow
wsprintfA
UnregisterClassA
RegisterClassA
GetKeyState
ole32
CoCreateInstance
CreateBindCtx
CoUninitialize
CoRegisterMessageFilter
CoInitializeEx
CoTaskMemFree
StringFromCLSID
oleaut32
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayUnlock
SafeArrayCreate
SafeArrayLock
SafeArrayCopy
SafeArrayDestroy
VariantClear
VariantChangeType
SysAllocString
VariantCopy
VariantInit
Exports
Exports
Sections
.text Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 62KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE