9WStspZfqmq[.]dll[.]exe

General

Target
9WStspZfqmq.dll.exe
Size 570KB
Sample221109-c35yrsdbc5
SHA256 01cd4dd8b8897baea60eaa954e0acbd32aca0ad1c4d32171e3676e9e6a16c770
MD5 ea4d27dc0ff2aaeda0f93ccd72362942
SHA1 659cdeee1f26d3f4b8b7e41426ca5b4e669d5148
SHA512 4e8550fc2a59cdae0419d356f33758b43a052944d98c00e8e0401550f100fa6e5c925c9d3d705fd417cd9fe6d3598e32cf732587fbeb374abc7b99efcb3b46fc
SSDEEP 12288:V2nPUlhGYxfKesOd46kYQ9oY1Ewhax7uLVG2c79QWiDQFAyHs:V2PX7OdHPQ97bhaSG2c76WiM
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

9WStspZfqmq.dll.exe

.dll 570KB

9WStspZfqmq.dll.exe

IMPHASH 52070df51ae03170ced339768bc53be6
SHA256 01cd4dd8b8897baea60eaa954e0acbd32aca0ad1c4d32171e3676e9e6a16c770
MD5 ea4d27dc0ff2aaeda0f93ccd72362942
SHA1 659cdeee1f26d3f4b8b7e41426ca5b4e669d5148
SHA512 4e8550fc2a59cdae0419d356f33758b43a052944d98c00e8e0401550f100fa6e5c925c9d3d705fd417cd9fe6d3598e32cf732587fbeb374abc7b99efcb3b46fc
SSDEEP 12288:V2nPUlhGYxfKesOd46kYQ9oY1Ewhax7uLVG2c79QWiDQFAyHs:V2PX7OdHPQ97bhaSG2c76WiM
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

Minor OS version

Major OS version

Entry point

70720

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ExitProcess WriteConsoleW SetEndOfFile WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType CloseHandle GetFileSizeEx SetFilePointerEx FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle CreateFileW ReadConsoleW HeapSize RtlUnwind

ole32

CoLoadLibrary

ADXTOpJMSjuRwxcuksmzi ADjnkFtWxhdHgmsJqPQET APHXfqSCeK AikatooD AsHXQwWhLF BAQHBoHshwPXIBgxfRt BPaVYYXxYzqAumZeMkFJIDsRsb BblennjQgbVTAD BhtSAYlmVbOzKpcrDPMMDK COsSPHnCgwrtMKroVU CPnXbEj CPoQinjZOixXMaUSfhfc DHZVMrYfjQpTb DLYUEmDcJdYmbFijN DRdOLHawduQpBElgQQAy DhGgKPIouGCZeGLB DllRegisterServer DpCSeQxhBWOqcLLdAcekR DqhayeVTxkUkazoD ETqooeVAyzISKJvOd FCseLqHRulECZZmXghTlfbI FGgfQikJB FOHwCZpsYOY FWnnIKvrOmfpBkQcxZJFJose FgLMAJhvm FrgWxkoerZ FuYsGflElaFGRhANYxsYvNvwj GASLVbBI GTWLlbyBBCHqJivRbN GXPcKjevwJZAbrEG GYTNVuotixihh GbNmWwWYQ GdXuxc GdoZNrCkgFAXO GlyPTKlBzdbNEHNSrvImlmtkxN GomZPINrdGMrvUKkqs GwZdPAPGCxiFNuLQGNJtMF HFzIYkbPOjoxRTTeWvVkgtcF HHNRTXIBgSZQ HJwTVGwDNZAemtyaKaD HLeMaWjBefWbesLDSfooJ HcLWwFmHWwrQAf HstPofrxDfYCf HwThzHtWhja IGKxgXlkdIgblzc IGVdsRMcrbSYPgjqZyLy IjDzZnXeqHTS IwfTRTdGlqP JFiYdDtBWGjE JINgJeIjWMlnXrIGEhPOGg JLUtHLOmZFFBAQxeLDmKI JNRPzfyyLokNsJBUH JSiOlsAaLZNHomSGOuhPlggEh JSxsuYfEKprnSUlKlcQmFJO JYgLrjstsnF JZQaoxy JaCQYjQP JegDBKpLbtnsoSlrwootmniSKZ JlLBVNjzCADuOgYGajKMR JqeswwnDCvVzpNutrMY JyQGGAJHuICHyfZ KNGYlUOVjKJuPR KbgwFNFpFClrfsWHLcClBiZF KqPWLieaxFiotBVkkwEUNDcCKV LIaBDoEddbEH LJcCrnQKoAICjLJTuQGBTovbxy LdWDTxjcoxoSOXEl MAQbuAhsulqGx MBxnTgeUCAA MIOpfIbEvgRfiJctTyGh MPpBldKFs MQoLfdmlKjjFzoOFECXsrxu MSsRPxyTlM MVmDOJ McMWdJqgkKvaZN NUpjzFACWLTIdtP NXonycLxGrjV NYqGzBnLvFBvB NmWGPSMDcK NshyWXHhdYesOvG ONKRrQWzZYUjzSMhMnAEQO OaSUAYtjFPkgLkobyzMl OayPmPbJGWSUexpwPdfAAf OircqXHIycjIX OoUszvppyIHjcykGNznFDvXou OrzzdYBLTnndy OzqudGmExR PRLxsIXysvN PZLqxqgUNxZqUoqE PZffoijeAZqV PllcvR PmWDUhf PnNxFvewmcVHh PpsKMWxlolyGTStQ PqCWqUaCVxUMh PqsvOuTVfbLVUoyAIgGnqEjV QPToIl QnimQsCBkniy QoncSLhvAMpXtCvYTWY RCmbSOuVrsjLRcvWOUXNy RDDmpbEYQ RJgVmFYoTZnFNFRVCx RKtcRO RWlZcqMLCKbOweVQDrQSJd RayLPxW SBcAnEKuRunfIXa SHHHhPtUcoreSuGIe SNatNMePa SPPyyHb ShpgnVcEnOTREmx SkJpKfabMnbktuhh SmzsbAglNENlSQaTPZp StrKkdnifPYY SxYBilByGbaRbXrLAURaQBTI TCIzLXlQbvDOx TCNIRETvDYqIXN URJGeaPpU VEYqbWNvFi VPgfKvqYjKRLLPvSGue VQaUgJaWAKxnIFielImlvza VUxRTGgZtdyXmbnXtkTO VkFzeSGhpv VmjqUSRaBqcL VujaOc WvFuCNleJlguCxcFGahBRHdiGQ XGUpohIGEfVwvgf XXwytfUtxtRAyQBnngf XbSOdIHXmdQycPHpIaJc XkkJaIEOowYzNixc XsDkLSaBcXNhA YQbvAWJyGLG YWLCNhcRGMMArDMfsbUFAQ YiiMwrVGDOcGqMuXeXzog YikORHg YkTsmbd ZBbjMNza ZCPwfaHeaPQvDTtyiHGRIaEt ZNPBpuQrLwyrjMrwPcTvhm ZzWkjTiPWcMfmz aEjHUxfmrelTvyAfqcNm aZyhMeii ajJWSbuLqKZeGCEoN antHkWU atEOqSgVHUX ayTrvMJhhGwBPGRjhuDPBCjBR brbfKBVKVtAcgB cGEwyzHJjmMSqFaiIdN cKzkBiFS cQniulkaNFUjwIgYGGSshqV ccEZZoSIsqVczbEwGJaTYIidz clpPeeFVTHlVVXo cmSvfaZvhORWpbh cwlMeyawIF dgHUNxBLv djJvOdCvj dtAKQj eCfuCfmj eRllpqrHOdWObXaXMZAOSilMW ehOLmuUmSgSNupbaPAJDkhYF erIDZsn euuDWQqVyOkCwNvvWBUMNU eyJzam fVOJQZie fnnsDQQFOKNQRgVSmnLVAy frwwozNydAAuswOYHfnX gADdRakdQk gKScGvUb gPqaEGYHlnZB hNFDWsNEdUJLgSLLdHsN hPVAnH hTyvvkRqtTHKvbCqAwYAPO hgsxwqFyjoJOUMhlqfuo hziRaX iEfHojgJfz ifxuuqZXRqQtfVHzXz jNxGheFRyizJhMZftY jYlLoSBKjchBCYlavhiOICCj jjNosKmANZpDJHmyvSMv jyTgpLXnAtMAIC kHJhGHqXCyZjgEBuegdzCvXnRu kRPRXK kWXwmUJtmqdwFhOTeyQa kaJyKNuSfG kkOHFQNsJVvRDfpyKPzXeBBf kyHVuSquAxhjXPaZz lCKaAgYAOPN lNFhheLP lPSsPmKuHuQntmqqxpP lTlhwdNT laDptPBY mWyJiaIlv mYvHmSGHLuivcfDn mazGgIQSavDrn mfHJxcXIB mfzGgz mkXaANkyxJbYhUylRrK nDxlirCkcqPnTzwIeeXEbMSJor ngTshhmjVukcJdpuBmqmAvEcj oCUWiAWtoaiTo oSEHFi odeFXW okObyQXzZJ omqOcloRUmg pELirKkAVxZlyTybBlOZd pGhwKLCjIfnV pluhDUqPeTgasYWidzRHcev psUIXrwDesfDMyLZOYv pwBjVleLzrsBJt pyfYwINCBeyoEpryYyDtNTSBhU qZCtvgY qsRlzamxjH qxINKoBvidcFNQNkt rHRAgYBwu rKonkSszSliw rPOTwCthGApDkT rPlrVttbeOFdvRAeCKnvgsG riZNemrxyyOrygk rqWVjsBONZqmyagZTzxlbnv rzxndBOIwzzXylfinfjfqZHkUV sKWkUbbosBCcCntDStyfQdND sdRUWzYnFnDLqnc shsfvDZi spPrQsvuGQnuqnKkuf stLCyTmWpocOoHqd tWoBvkhVjYbWcOrffZ tXvHVJw tZVXfUyKyzCQbpzRAGQcxdpn tuXUZxmsJcslUuLWhyfPp tyXFaGfYQfOokTTTA uRibEyUqxzdRRfOIZOa uUoFzDTZSwVlBbKlfTihDoU vHrxlkTAhEM vMcwEWvevlnyo vbvYWLCFHCBsgxYlkxfc vnpLRVBK vpIWHGOWXVPxl wAOdWTHw wIohkhPrJcqRDEmmcmFgZkp wKjeWJWWWUmKQfejp wLidRNVIVsIDHMfEPYbf wPmXLOsSsdqkgWrIdJ wQdSAViAdnu wTwNmtfxFNCGCMmAAJqKVeq wwuVbCyAcVCKnS xESaVnQCeQKuXySjqnkcFR xWQHWfWZswgXRcduJtZIYc xlkuDEsSXeLvzu xxQMVBrKWeqrPXtwGprrXqcQ yHkztDPImVxpne yvIyZwBtyoOyKkkZwfz zyqSrKYYDHQMNIdzRPCDC

Name

.text

Size

218KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

332KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9WStspZfqmq.dll.exe

kernel32

ole32