a731170e6b24dad0da47048ba9c5656e8be2bea0e197fa53be01b955d2e1d774

Sharing

Copy URL Twitter E-mail

General

Target

a731170e6b24dad0da47048ba9c5656e8be2bea0e197fa53be01b955d2e1d774
Size

52KB
MD5

5a596e8ce4bc4be3198fd53e0fb8ba30
SHA1

844abf999e41d94fba52eb8be93fad8578dbe0d8
SHA256

a731170e6b24dad0da47048ba9c5656e8be2bea0e197fa53be01b955d2e1d774
SHA512

2b5f18eaddb00a974a70837ae73890a6779ced9f980512c86f23fa66803019f02978e7026fb4de27f152dab289aef6f7d0180e01d3b50cd1ccc3c384f97f12af
SSDEEP

1536:LjTPNONLAdbEWUX7ZMaTByj0Jm4GdGNz:LsNWU4jXdGNz

Score

N/A

Malware Config

Signatures

Files

a731170e6b24dad0da47048ba9c5656e8be2bea0e197fa53be01b955d2e1d774
.dll regsvr32 windows x86

ded5aa0397f86cdd8a77c1280a44b33c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileA
WritePrivateProfileStringA
ExitProcess
GetCommandLineW
CloseHandle
GetSystemDirectoryA
Process32Next
Process32First
MoveFileA
CreateThread
GetExitCodeProcess
WaitForSingleObject
LocalFree
GetPrivateProfileStringA
EnterCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateDirectoryA
SetFileAttributesA
FindNextFileA
RemoveDirectoryA
CreateProcessA
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
GetProcAddress
LoadLibraryA
FreeLibrary
GetCurrentProcessId
Sleep
DeleteFileA
LeaveCriticalSection

advapi32

SetEntriesInAclA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegQueryValueExA
GetNamedSecurityInfoA

shell32

SHGetSpecialFolderPathA
CommandLineToArgvW

ole32

CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize

oleaut32

SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString

msvcrt

fopen
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_purecall
strncmp
strncpy
strlen
strcmp
memcpy
_access
strcpy
memcmp
??3@YAXPAX@Z
strstr
atoi
strchr
fclose
fread
memset
??2@YAPAXI@Z
ftell
fseek
_strupr
strcat
strrchr
sprintf
wcsstr
_wcslwr

shlwapi

SHSetValueA
SHDeleteKeyA
SHDeleteValueA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ded5aa0397f86cdd8a77c1280a44b33c

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 4KB

idata Size: 4KB - Virtual size: 4B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 4KB

idata
Size: 4KB - Virtual size: 4B

.reloc
Size: 4KB - Virtual size: 2KB