9826aa6300095480716ef61753bda5fdffb99291d02bb925e3560f9d1ef149af

Sharing

Copy URL

Twitter E-mail

General

Target

9826aa6300095480716ef61753bda5fdffb99291d02bb925e3560f9d1ef149af
Size

260KB
MD5

92c1e543ab63e8c79ee9d600881fc7be
SHA1

21da4fd637931bca86da1fa95b0feca9fb115f8d
SHA256

9826aa6300095480716ef61753bda5fdffb99291d02bb925e3560f9d1ef149af
SHA512

29ed01e6be0f38d4da62b3744dab376027027553192ce066b6fd125739f313fa56f40b41b12d23554e0a786e2efa37659db3ce7b1c7f31ffe6a6a23bd8caa5c3
SSDEEP

6144:qfsA2ltxcHYkhr8rsWKjOK7YyijhAUmA5/W:q0A23xUnArnFy+hAWY

Score

N/A

Malware Config

Signatures

Files

9826aa6300095480716ef61753bda5fdffb99291d02bb925e3560f9d1ef149af
.dll windows x86

275c9fec0206ad96ce4802d41254fd01

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupDiGetClassDevsW
CMP_WaitNoPendingInstallEvents
CM_Locate_DevNodeW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
CM_Get_DevNode_Registry_PropertyW
CM_Get_Device_IDW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiCallClassInstaller
SetupDiOpenDevRegKey

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

LoadResource
FindResourceW
FindResourceExW
LocalFree
LocalAlloc
GetLastError
CopyFileW
CreateDirectoryW
GetFileAttributesW
DeleteFileW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
WideCharToMultiByte
CreateFileW
InitializeCriticalSection
DeleteCriticalSection
QueryPerformanceFrequency
GetModuleFileNameW
ExpandEnvironmentStringsW
LockResource
WriteFile
lstrlenW
OutputDebugStringW
GetTickCount
QueryPerformanceCounter
CloseHandle
SetFilePointer
EnterCriticalSection
GetExitCodeProcess
CreateProcessW
WriteProfileStringW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcess
GetModuleHandleW
WaitForMultipleObjects
CreateThread
GetExitCodeThread
WaitForSingleObject
SetEvent
GetCurrentThreadId
FlushInstructionCache
SetLastError
RaiseException
Sleep
SizeofResource
GetPrivateProfileStringW
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
LeaveCriticalSection
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap

user32

DestroyWindow
DefWindowProcW
PostThreadMessageW
SetWindowLongW
KillTimer
IsWindow
GetMessageW
PostMessageW
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
PeekMessageW
GetWindowLongW
CallWindowProcW
CreateWindowExW
GetClassInfoExW
LoadCursorW
RegisterClassExW
SetTimer
UnregisterClassA

winspool.drv

ClosePrinter
XcvDataW
EnumMonitorsW
GetPrinterW
GetPrinterDataExW
EnumPortsW
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FindClosePrinterChangeNotification
AddPrinterDriverW
SetPrinterDataW
DeletePrinter
EnumPrintersW
GetPrinterDataW
GetPrinterDriverW
AddPrinterW
EnumPrinterDriversW
OpenPrinterW
GetPrinterDriverDirectoryW

advapi32

RegSetValueExW
RegDeleteValueW
RegCreateKeyW
RegQueryValueExA
RegEnumKeyW
RegQueryValueExW
RegOpenKeyExW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegOpenKeyW
RegCloseKey

shell32

SHFileOperationW
SHCreateDirectoryExW

ole32

CoUninitialize
CoInitializeEx
CoInitialize
CoCreateInstance
CLSIDFromString

oleaut32

DispCallFunc
SysAllocString
VariantClear
VariantInit
SysFreeString
SysStringLen

msvcp90

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$allocator@_W@std@@QAE@ABV01@@Z
?length@?$char_traits@_W@std@@SAIPB_W@Z
??0?$_String_val@_WV?$allocator@_W@std@@@std@@IAE@V?$allocator@_W@1@@Z
?assign@?$char_traits@_W@std@@SAPA_WPA_WI_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Xlen@_String_base@std@@SAXXZ
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?_Xran@_String_base@std@@SAXXZ
?_Move_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z
?_Copy_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

msvcr90

__CppXcptFilter
?terminate@@YAXXZ
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_vsnwprintf_s
__clean_type_info_names_internal
memmove_s
_wcsicmp
wcsncpy_s
wcscat_s
_wcslwr_s
towupper
wcschr
_recalloc
memcpy_s
??_V@YAXPAX@Z
_wtol
_wcsnicmp
memcmp
wcslen
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_invalid_parameter_noinfo
wcscpy_s
_snwprintf_s
_CxxThrowException
__CxxFrameHandler3
_vscwprintf
_unlock
vswprintf_s
wcsftime
_localtime64_s
_time64
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_purecall
memmove
swprintf_s
memset
??3@YAXPAX@Z
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
wcsrchr

shlwapi

SHDeleteKeyW
PathRemoveFileSpecW
StrChrW
StrTrimW
StrCmpNIW
StrStrIW
StrCmpIW
StrToIntW
PathStripPathW

Exports

Exports

AddFax
AddWinINIEntries
CloseFileVersionInfo
ConvertValueToMultiString
CreateDeviceInfoList
CreateFaxDirectories
CreateInstanceDataDir
DeleteFax
DeleteInstanceDir
DestroyDeviceInfoList
DisableWow64FsRedirection
ExpandContextStrings
GetCdromDriveAddress
GetCdromDriveValueName
GetConnectionType
GetContextID
GetDOT4GUID
GetDOT4MACAddress
GetDOT4PortID
GetDeviceFriendlyName
GetDeviceIPAddress
GetDeviceInfoAddress
GetDeviceInfoConnectionType
GetDeviceInfoContextID
GetDeviceInfoDatFile
GetDeviceInfoDriverName
GetDeviceInfoFriendlyName
GetDeviceInfoFunctions
GetDeviceInfoGUID
GetDeviceInfoInstallState
GetDeviceInfoMAC
GetDeviceInfoName
GetDeviceInfoProductClass
GetDeviceMACAddress
GetDeviceObjectName
GetFileVersionInfoValue
GetICEModelFile
GetICEModelValue
GetICEPreloadPath
GetImagingClassIndex
GetImagingClassIndexAndEmbedID
GetIniDirectory
GetInstanceID
GetInstanceIDFromDeviceDescSubString
GetNextDeviceInfo
GetPreviousDeviceInfo
GetPrinterFriendlyName
GetPrinterPortID
GetPrivateProfileMultiString
GetRootKey
GetStorageDriveAddress
GetStorageDriveValueName
GetUserCommand
IsDeviceNetworked
IsDeviceOnline
IsDevicePresent
IsDeviceWorking
IsDirectConnect
IsNetworkConnect
IsUserAdmin
IsWow64Process
LaunchErrorCLs
LaunchInstallCLs
LaunchPostCLs
LaunchPreCLs
LaunchProcess
LaunchUninstallCLs
LogFileVersion
LogMessage
OpenFileVersionInfo
PostUserCommand
RegisterDeviceChangeNotification
RegisterUserCommandNotification
RemoveScanSettings
RemoveUserCommands
RevertWow64FsRedirection
RunAs64
SaveDeviceInfo
SetDeviceInfoDatFile
SetDeviceInfoInstallState
SetDeviceInfoProductClass
SetLatestDefaultPrinter
SetRootKey
UninstallDevice
UninstallTWAIN
UnregisterDeviceChangeNotification
UnregisterUserCommandNotification
WaitForMultipleObjectsWMsgLoop

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

275c9fec0206ad96ce4802d41254fd01

Headers

File Characteristics

Imports

setupapi

version

kernel32

user32

winspool.drv

advapi32

shell32

ole32

oleaut32

msvcp90

msvcr90

shlwapi

Exports

Exports

Sections

.text Size: 161KB - Virtual size: 161KB

.rdata Size: 33KB - Virtual size: 32KB

.data Size: 54KB - Virtual size: 55KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 161KB - Virtual size: 161KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 54KB - Virtual size: 55KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 8KB