1954f749e77f34d506db410a5409e4719cf264bced4b24ab315fb61bdaa9a0d8

Sharing

Copy URL Twitter E-mail

General

Target

1954f749e77f34d506db410a5409e4719cf264bced4b24ab315fb61bdaa9a0d8
Size

1.1MB
MD5

3b18075c5ed8b152caf9c0c5ca8fe1a0
SHA1

5ac2cf5e887a5227dad69a6e527fa40f77419833
SHA256

1954f749e77f34d506db410a5409e4719cf264bced4b24ab315fb61bdaa9a0d8
SHA512

e8f5a2324b2b97ffa1f3fc4000446ae9e781ba1e5118878f960d5f3bacb4b9c021a7741c693a6b73f7bcc68062fb1cbfa4a7b523ce2ad2a71521b0c64cc1380c
SSDEEP

24576:7jaCgkwaHC0okYNfRuScDadtLUzNFeeTka27DnnoXy9:vtY0RYMkawn8y9

Score

N/A

Malware Config

Signatures

Files

1954f749e77f34d506db410a5409e4719cf264bced4b24ab315fb61bdaa9a0d8
.exe regsvr32 windows x86

29cc9e87f875e0422d9c59f79a873b3c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

bdcommon

?CreateObjectAgrgtByIID@Com@Util@@YGJABU_GUID@@PAPAXPAUIUnknown@@@Z
?CreateObjectByIID@Com@Util@@YGJABU_GUID@@PAPAX@Z
?LoadStringW@String@Help@@YAPB_WPB_W@Z
?EraseTimerCallback@Timer@Common@Util@@YAJPAUITimerCallback@@I@Z
?GetHexCode@String@Help@@YA_WHH@Z
?CreateObjectByInterface@Com@Util@@YGJPA_WPAPAX@Z
?RegObject@Com@Util@@YGJABU_GUID@@0PA_W1@Z
?RegService@Com@Util@@YGJABU_GUID@@0PA_W1@Z
?SetATLModule@Com@Util@@YGJPAX@Z
?SetOneTimer@Timer@Common@Util@@YAJIPAUITimerCallback@@I@Z
GetLogController
?SetMulTimer@Timer@Common@Util@@YAJIPAUITimerCallback@@I@Z
?InsertStringTable@String@Help@@YAJPAY01QB_WI@Z
?UnInitWinService@Com@Util@@YGJXZ
?GetService@Com@Util@@YGJABU_GUID@@PAPAX@Z
?ClearService@Com@Util@@YGJXZ

wininet

InternetSetCookieExW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

msimg32

AlphaBlend

psapi

GetModuleFileNameExW
EnumProcesses
EnumProcessModules

shlwapi

PathFileExistsW
StrCmpW
PathRemoveFileSpecW
SHGetValueW

comctl32

InitCommonControlsEx

kernel32

RaiseException
LocalFree
GetModuleFileNameW
GetFileAttributesW
GetModuleHandleW
GetProcAddress
GetLastError
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
CreateProcessW
CloseHandle
GetCurrentProcessId
GetCurrentProcess
OpenProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetPrivateProfileStringW
ExitProcess
CreateMutexW
ReleaseMutex
HeapAlloc
GetProcessHeap
HeapFree
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
SetUnhandledExceptionFilter
GetLocalTime
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
ResumeThread
Thread32Next
VirtualQuery
IsBadWritePtr
LoadLibraryW
GetModuleHandleA
CreateFileW
ReadFile
GlobalFindAtomW
TerminateProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
lstrcmpiW
FlushInstructionCache
GetVersionExW
WideCharToMultiByte
GetTickCount
SetProcessWorkingSetSize
lstrlenA
WriteFile
GetFileSize
CreateDirectoryW
FindClose
FindFirstFileW
ProcessIdToSessionId
FreeLibrary
QueryInformationJobObject
IsProcessInJob
SetEvent
GlobalAddAtomW
CreateEventW
LoadLibraryExW
SetThreadLocale
GetThreadLocale
GetCurrentThread
ExpandEnvironmentStringsW
InterlockedExchangeAdd
VirtualProtect
VirtualAlloc
InterlockedCompareExchange
SetThreadContext
GetThreadContext
LoadLibraryA
GetStringTypeW
CreateThread
HeapSetInformation
GetStartupInfoW
RtlUnwind
GetSystemTimeAsFileTime
LCMapStringW
GetCPInfo
HeapCreate
GetStdHandle
GetLocaleInfoW
TlsAlloc
TlsGetValue
UnhandledExceptionFilter
TlsSetValue
TlsFree
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetConsoleCP
IsDebuggerPresent
InterlockedExchange
Sleep
EncodePointer
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
IsProcessorFeaturePresent
GetConsoleMode
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
SetStdHandle
FlushFileBuffers
WriteConsoleW
SetEndOfFile
lstrlenW
ExitThread

user32

IsIconic
EnumThreadWindows
GetActiveWindow
GetParent
MonitorFromRect
UnregisterClassA
SetWindowPos
GetSystemMetrics
GetClassNameW
GetWindow
SystemParametersInfoW
EqualRect
SetWindowLongW
SetWindowTextW
GetWindowLongW
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetWindowPlacement
IsWindow
IsWindowVisible
CopyRect
PostMessageW
LoadImageW
CharLowerBuffW
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
FindWindowW
SetForegroundWindow
ScreenToClient
GetAncestor
EnableWindow
IsZoomed
OffsetRect
MonitorFromPoint
RegisterClassExW
IsRectEmpty
CharNextW
CloseWindowStation
DestroyWindow
CreateWindowExW
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
CloseDesktop
OpenInputDesktop
FindWindowExW
AllowSetForegroundWindow
wsprintfW
IsWindowEnabled
ShowWindow
MapWindowPoints
SendMessageW
GetClientRect
SendMessageTimeoutW
UnregisterClassW
DefWindowProcW
MessageBoxW
GetCursorPos
GetForegroundWindow
PtInRect
SetWindowPlacement

gdi32

SelectObject
CreateCompatibleDC
CreateDIBSection
DeleteObject
DeleteDC

advapi32

SetSecurityDescriptorDacl
RegQueryInfoKeyW
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
SetSecurityDescriptorSacl
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
InitializeSecurityDescriptor
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl

shell32

SHGetFileInfoW
SHGetMalloc
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW

ole32

CoInitialize
OleInitialize
OleUninitialize
CoUninitialize
CoTaskMemFree
StringFromCLSID
CoSetProxyBlanket
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance

oleaut32

VariantClear
SysFreeString
SysAllocStringLen
RegisterTypeLi
UnRegisterTypeLi
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantInit
VarBstrCmp
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 534KB - Virtual size: 534KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 278KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 83KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 149KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

29cc9e87f875e0422d9c59f79a873b3c

Headers

DLL Characteristics

File Characteristics

Imports

bdcommon

wininet

version

msimg32

psapi

shlwapi

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 534KB - Virtual size: 534KB

.rdata Size: 278KB - Virtual size: 277KB

.data Size: 83KB - Virtual size: 93KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 48KB - Virtual size: 48KB

.reloc Size: 149KB - Virtual size: 152KB

.text
Size: 534KB - Virtual size: 534KB

.rdata
Size: 278KB - Virtual size: 277KB

.data
Size: 83KB - Virtual size: 93KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 48KB - Virtual size: 48KB

.reloc
Size: 149KB - Virtual size: 152KB