EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
d73d7cb7effdfc9f43d43fcb19254ab1ec8e70c86659315d0be57d94dca5cd56.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d73d7cb7effdfc9f43d43fcb19254ab1ec8e70c86659315d0be57d94dca5cd56.dll
Resource
win10v2004-20220812-en
General
-
Target
d73d7cb7effdfc9f43d43fcb19254ab1ec8e70c86659315d0be57d94dca5cd56
-
Size
206KB
-
MD5
85aa644df8b5ce7682f72e0339a8fe5e
-
SHA1
9aab97329ac61f3ab2152002d2b680e4533e5aef
-
SHA256
d73d7cb7effdfc9f43d43fcb19254ab1ec8e70c86659315d0be57d94dca5cd56
-
SHA512
47b0b1bf933266852dd60f149492f6eef5b10d6eece9068938c7046167b0765e4c822d9f1a87ea3e481307ca07f79ade72133c74f743ca679a28c30f8d33247d
-
SSDEEP
3072:rxKkfmU8Wp8cFLbcxkuQ1mjQxowQugs/AzukA1ybBMcv2AgRbahWolM:JfT8WKcFLbcrQ1m0Ws/e7vBgRFolM
Malware Config
Signatures
Files
-
d73d7cb7effdfc9f43d43fcb19254ab1ec8e70c86659315d0be57d94dca5cd56.dll windows x86
f58b57481a2257a2ce68ace8403e0648
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
OpenProcess
GetLastError
DuplicateHandle
GetCurrentProcess
MapViewOfFile
GetCurrentProcessId
SetEvent
WaitForSingleObject
FreeLibrary
CompareStringA
UnmapViewOfFile
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
SetLastError
InterlockedCompareExchange
GetCurrentThreadId
ResetEvent
DisableThreadLibraryCalls
ExitProcess
InterlockedExchange
ReleaseMutex
user32
TranslateMessage
SetTimer
KillTimer
MsgWaitForMultipleObjects
xprt5
?Replace@TBstr@XPRT@@QAEHPBG0@Z
??0TBstr@XPRT@@QAE@PBDPBG@Z
kSystemEncoding
xprt_iswdigit
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
_XprtAtomicIncrement@4
_XprtAtomicDecrement@4
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
_XprtInitialize@8
_XprtUninitialize@0
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
?GetTm@TTime@XPRT@@QBE_NPAUtm@@@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?GetMinute@TTime@XPRT@@QBEHXZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
_XprtMemRealloc@8
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?ToInt@TBstr@XPRT@@QBEHH@Z
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
?Set@TTime@XPRT@@QAEXN@Z
?GetTickCount@TTime@XPRT@@SA?AV12@XZ
?GetTime64@TTime@XPRT@@QBE_JXZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?Set@TTime@XPRT@@QAEXHHHHHH@Z
?AppendFormat@TBstr@XPRT@@QAAXPBGZZ
?Tokenize@TBstr@XPRT@@QBE?AV12@PBGAAH@Z
?Format@TBstr@XPRT@@QAAXPBGZZ
_XprtGetMilliseconds@0
xprt_wcsncmp
xprt_wcslen
?Insert@TBstr@XPRT@@QAEHHPBG@Z
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?Find@TBstr@XPRT@@QBEHPBGH@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?GetEncodedByteLength@TBstr@XPRT@@QBEHPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBDHPBG@Z
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
_XprtMemAlloc@4
xprt_memset
xprt_memmove
_XprtMemFree@4
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?GetDayOfWeek@TTime@XPRT@@QBEHXZ
?GetYear@TTime@XPRT@@QBEHXZ
?GetMonth@TTime@XPRT@@QBEHXZ
?GetDay@TTime@XPRT@@QBEHXZ
?Format@TTime@XPRT@@QBE?AVTBstr@2@PBG@Z
?GetHour@TTime@XPRT@@QBEHXZ
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
??0TBstr@XPRT@@QAE@XZ
_XprtReleaseMessageId@4
_XprtUnregisterMessageCallback@4
_XprtRegisterMessageCallback@8
_XprtRequestMessageId@0
_XprtGetMessageQueue@0
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??1TBstr@XPRT@@QAE@XZ
?Append@TBstr@XPRT@@QAEAAV12@G@Z
_XprtCreateThread@8
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
msvcrt
qsort
_snwprintf
_except_handler3
__dllonexit
??2@YAPAXI@Z
_onexit
free
_initterm
malloc
_adjust_fdiv
strcmp
memset
_purecall
memmove
memcpy
??3@YAXPAX@Z
memcmp
ole32
CoRegisterMessageFilter
CoUninitialize
CreateBindCtx
CoCreateInstance
CoInitializeEx
oleaut32
VariantClear
VariantCopy
VarCmp
VariantTimeToSystemTime
SysAllocString
VariantChangeType
SystemTimeToVariantTime
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
SafeArrayCopy
VariantInit
Exports
Exports
Sections
.text Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 63KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE