7004cbc9865fab0c38e3ff5a4a5c107c14effb128ffd7297b7b35ad50ee8d61e

Sharing

Copy URL Twitter E-mail

General

Target

7004cbc9865fab0c38e3ff5a4a5c107c14effb128ffd7297b7b35ad50ee8d61e
Size

116KB
MD5

2d803b87feea4e4cfc91b685b530f800
SHA1

b2d8e4559f0e1556bb57d09e315a78a8c60272b4
SHA256

7004cbc9865fab0c38e3ff5a4a5c107c14effb128ffd7297b7b35ad50ee8d61e
SHA512

2e79a5308e4f23f172b296a524844babb3f9d1523e5d5d6735a6e68dce7da56f5b9e96ad26e3c8441f97f908c61384ff88dfd436764e951e747bbf4dca6659a0
SSDEEP

3072:6PEOW3j3p9LTGPRNtyKzi0dyT8/UdhcQXCFnD:zOW3NhwRjyKzi0HUIQOnD

Score

N/A

Malware Config

Signatures

Files

7004cbc9865fab0c38e3ff5a4a5c107c14effb128ffd7297b7b35ad50ee8d61e
.dll windows x86

c6e8befa50fcc4fa17a87972efe68550

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

xpcom_core

?assign_from_gs_contractid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByContractIDWithError@@ABUnsID@@@Z
?AppendUTF16toUTF8@@YAXPBGAAVnsACString_internal@@@Z
?assign_with_AddRef@nsCOMPtr_base@@QAEXPAVnsISupports@@@Z
?smprintf@nsTextFormatter@@SAPAGPBGZZ
?strdup@nsCRT@@SAPADPBD@Z
?free@nsCRT@@SAXPAD@Z
NS_Free_P
NS_Alloc_P
?Adopt@nsCSubstring@@QAEXPADI@Z
?sEmptyBuffer@?$nsCharTraits@D@@2PBDB
??1nsACString_internal@@QAE@XZ
?sCanonicalVTable@nsObsoleteACString@@2PBXB
??1nsCOMPtr_base@@QAE@XZ
?NS_NewGenericModule2@@YAIPBUnsModuleInfo@@PAPAVnsIModule@@@Z

nspr4

PR_AtomicIncrement
PR_AtomicDecrement

xpcom_compat

_NR_RegClose@4
_NR_RegEnumEntries@24
_NR_RegPack@12
_NR_RegSetUsername@4
_NR_RegDeleteEntry@12
_NR_RegGetEntryInfo@16
_NR_RegGetKeyRaw@16
_NR_RegDeleteKeyRaw@12
_NR_RegOpen@8
_NR_RegEnumSubkeys@24
_NR_RegDeleteKey@12
_NR_RegAddKeyRaw@16
_NR_RegAddKey@16
_NR_RegSetEntry@24
_NR_RegGetEntry@20
_NR_RegSetEntryString@16
_NR_RegGetEntryString@20
_NR_RegFlush@4
?Create@nsFileSpecImpl@@SGIPAVnsISupports@@ABUnsID@@PAPAX@Z
?Create@nsDirectoryIteratorImpl@@SGIPAVnsISupports@@ABUnsID@@PAPAX@Z
_NR_ShutdownRegistry@0
_NR_RegGetKey@16
_NR_StartupRegistry@0
_NR_RegGetUsername@4

msvcr80

_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
free
_encoded_null
_malloc_crt
_encode_pointer
_except_handler4_common
strcpy
??3@YAXPAX@Z
strchr
strncpy
??2@YAPAXI@Z

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

Exports

Exports

NSGetModule
NS_RegistryGetFactory

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c6e8befa50fcc4fa17a87972efe68550

Headers

File Characteristics

Imports

xpcom_core

nspr4

xpcom_compat

msvcr80

kernel32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text Size: 97KB - Virtual size: 100KB

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 97KB - Virtual size: 100KB