586475a4e6f2993e517e7674aff375bae4ef4db8a177d0572dccac1c08145c7e

Sharing

Copy URL

Twitter E-mail

General

Target

586475a4e6f2993e517e7674aff375bae4ef4db8a177d0572dccac1c08145c7e
Size

65KB
MD5

d25449822fba906ee4ec99f9874f3083
SHA1

9d896c743f4de6e5d6ebb89363d9aeb19651c14a
SHA256

586475a4e6f2993e517e7674aff375bae4ef4db8a177d0572dccac1c08145c7e
SHA512

58d225e199ba92c30d331028bac80b158c19df6d0be7f25ca641a5b4b2b6ee8da56319611fa1eab7b258fc7cacf2079c00a8a097e110c38ec108166973ebf76d
SSDEEP

1536:Kf2JvYbF8xXlK7XU3kN/Sffpiz6aP5Og/dilcDJux+N+PT:KuymsT9/SfhizDhO+m652T

Score

N/A

Malware Config

Signatures

Files

586475a4e6f2993e517e7674aff375bae4ef4db8a177d0572dccac1c08145c7e
.dll windows x86

4ce360ebfa402806bf2d429ee5f1802e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

idqml2a

IsResourceClassEqual
GetProperties
GetBinaryProperty
VerifyPropertyTable
StopService
SetPropertyTableEx
GetEnvironmentWithNetName
SetDwordValue
PropertyListFromParameterBlock
StartResourceService
TerminateServiceProcessFromResDll
IsPathValid
AddUnknownProperties
SetPrivatePropertyList
EnumResources

kernel32

GetStringTypeA
GetACP
FileTimeToLocalFileTime
lstrcatA
EnterCriticalSection
CreateEventA
SetFileTime
GlobalLock
SizeofResource
GetLocalTime
VirtualFree
SetLastError
HeapFree
GetVersion
IsValidCodePage
CloseHandle
GetFileSize
IsDBCSLeadByteEx
TlsGetValue
FormatMessageA
GlobalGetAtomNameA
LoadLibraryW
GetCurrentThreadId
GetEnvironmentStringsW
CreateFileMappingA
GetCommandLineW
lstrlenA
SystemTimeToFileTime
MapViewOfFile
IsBadCodePtr
RtlUnwind
FreeEnvironmentStringsW
GlobalUnlock
ResumeThread
FreeEnvironmentStringsA
GetVersion
GetStartupInfoW
GetFileAttributesA
InterlockedDecrement
InitializeCriticalSection
GlobalAddAtomW
GlobalSize
TlsAlloc
DeleteCriticalSection

ntdll

RtlCompareMemory
RtlCompareString
NtQueryInformationProcess
NtOpenSection
NtReadFile
RtlInitUnicodeString
ZwSetEvent
NtSetSystemInformation
RtlAddAce
RtlCancelTimer

Exports

Exports

CallBeginning
CreateProcessNotify
SyncDeviceIoControl
ReinitOverStruct
RefreshAppRegEnum
DowngradeAPL
FreeUnimodemTimer
SetupSave
MonitorHandle
SetActionName
SetActionLogMode
OpenAppRegEnum
SetActionLogFile
CancelUnimodemTimer
QueryApplication
ResetCallCount
GetCatalogObject
CreateOverStructPool
SetupOpen
SetActionLogModeSz
UpdateFromComponentChange
SetSetupSave
GetGlobalBabyJITEnabled
OpenComponentLibraryOnStreamEx

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ce360ebfa402806bf2d429ee5f1802e

Headers

DLL Characteristics

File Characteristics

Imports

idqml2a

kernel32

ntdll

Exports

Exports

Sections

.text Size: 51KB - Virtual size: 51KB

.data Size: 11KB - Virtual size: 11KB

.rsrc Size: 1024B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 51KB - Virtual size: 51KB

.data
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB