EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
ea30d9e87bf8d571a13c422c284e39ac5cae973a8985c7b21ae3699f717bd14a.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ea30d9e87bf8d571a13c422c284e39ac5cae973a8985c7b21ae3699f717bd14a.dll
Resource
win10v2004-20220901-en
General
-
Target
ea30d9e87bf8d571a13c422c284e39ac5cae973a8985c7b21ae3699f717bd14a
-
Size
239KB
-
MD5
76d1629d27d243fa8a24bd6916f78596
-
SHA1
70974a0855ae9121e557e6d74467cfd8c633b9f1
-
SHA256
ea30d9e87bf8d571a13c422c284e39ac5cae973a8985c7b21ae3699f717bd14a
-
SHA512
6868eda769f83308ca29b675a64ace1b7a3e716e65494e9516450dcc0dd48c1d1fb5ef062a4651e2a619b9b15e897beb8ae93f2b6b259be27578705d7e387995
-
SSDEEP
3072:hy+qXmD0V4eov6ow0BndFR5vAI5gia2xzYfZSMBKAjth9vWHeArUisxZ4ca7s7PC:xSmVDZBnrfr5Dh1EfZvkeAryWIy7Hb9
Malware Config
Signatures
Files
-
ea30d9e87bf8d571a13c422c284e39ac5cae973a8985c7b21ae3699f717bd14a.dll windows x86
0ff4809bd50d03f27c439a4139848a20
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreate
xprt5
_XprtInitialize@8
xprt_strlen
xprt_memcpy
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?Add@TPtrArray@XPRT@@QAEHPAX@Z
xprt_iswdigit
?GetLength@TBstr@XPRT@@QBEHXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
_XprtUninitialize@0
?GetAt@TBstr@XPRT@@QBEGH@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TBstr@XPRT@@QAE@ABV01@@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
_XprtAtomicDecrement@4
_XprtMemAlloc@4
xprt_memmove
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
?Compare@TBstr@XPRT@@QBEHPBG@Z
xprt_strcmp
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
_XprtAtomicIncrement@4
xprt_memset
XprtTrace
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBDPBG@Z
?Format@TBstr@XPRT@@QAAXPBGZZ
kSystemEncoding
??0TBstr@XPRT@@QAE@PBG@Z
??0TBstr@XPRT@@QAE@XZ
??1TBstr@XPRT@@QAE@XZ
_XprtMemFree@4
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
aolidlemon
ord2
ord3
ord1
msvcrt
strncpy
memset
strcmp
qsort
_snwprintf
_purecall
_except_handler3
__dllonexit
_onexit
_initterm
_adjust_fdiv
strstr
free
_stricmp
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
strncmp
_mbstrlen
_mbschr
_mbsstr
_mbscmp
?terminate@@YAXXZ
_strlwr
malloc
wcsrchr
strcat
printf
fopen
fwrite
fclose
tolower
getenv
time
strrchr
_getpid
_vsnprintf
_beginthreadex
sprintf
_snprintf
atoi
__CxxFrameHandler
memcpy
strcpy
strlen
kernel32
VirtualQuery
SuspendThread
GetThreadContext
GlobalAlloc
GlobalFree
GetCurrentProcessId
GetEnvironmentVariableA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetCurrentThread
GetVersion
ReadFile
WriteFile
HeapFree
HeapAlloc
CreateDirectoryA
MoveFileA
GetFileAttributesA
OpenEventA
IsBadWritePtr
OpenProcess
GetExitCodeProcess
OutputDebugStringA
Sleep
GetCurrentProcess
GetVersionExA
ResumeThread
WaitForMultipleObjects
TerminateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
CreateSemaphoreA
WaitForSingleObject
CreateEventA
CreateProcessA
SetLastError
GetLastError
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
InterlockedExchange
CompareStringA
GetCurrentThreadId
ExitProcess
GetProcessHeap
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
GetSystemPowerStatus
FreeLibrary
GetTickCount
advapi32
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
user32
DispatchMessageA
GetMessageA
PostMessageA
DefWindowProcA
CreateWindowExA
SetTimer
KillTimer
TranslateMessage
MsgWaitForMultipleObjects
DestroyWindow
wsprintfA
UnregisterClassA
RegisterClassA
GetKeyState
ole32
CoCreateInstance
CreateBindCtx
CoUninitialize
CoRegisterMessageFilter
CoInitializeEx
CoTaskMemFree
StringFromCLSID
oleaut32
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayUnlock
SafeArrayCreate
SafeArrayLock
SafeArrayCopy
SafeArrayDestroy
VariantClear
VariantChangeType
SysAllocString
VariantCopy
VariantInit
Exports
Exports
Sections
.text Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 62KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE