56ed0efe35e9db97eaad49f6fbe9df4305ddae15dc76329245adf81b91c82338

Sharing

Copy URL Twitter E-mail

General

Target

56ed0efe35e9db97eaad49f6fbe9df4305ddae15dc76329245adf81b91c82338
Size

52KB
MD5

f46320dae826f5afe3f783e6a99310f0
SHA1

0755641b9ff0631940eec4ee8cac349a25ca94af
SHA256

56ed0efe35e9db97eaad49f6fbe9df4305ddae15dc76329245adf81b91c82338
SHA512

a3b8245828e13b8c1af611a4d4129762584d991371bf408d8b61304d8904a944a1194f863b2ea01f931e0bfa67accba81aa97cf57ff98237d370b7a4bf1671e3
SSDEEP

1536:z48PAAbOFPKVNKazuNWj4henpArq6zd89zTZ:F7PV0aP4IArZx89z1

Score

N/A

Malware Config

Signatures

Files

56ed0efe35e9db97eaad49f6fbe9df4305ddae15dc76329245adf81b91c82338
.dll regsvr32 windows x86

0f47b63fe27ce267a1319c2ba8cc22b5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
CloseHandle
GetSystemDirectoryA
GetProcAddress
Sleep
LeaveCriticalSection
EnterCriticalSection
WritePrivateProfileStringA
CreateDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
GetModuleFileNameA
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
MoveFileA
GetCommandLineW
Process32Next
Process32First
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcessId
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
LoadLibraryA
FreeLibrary
DeleteFileA
RemoveDirectoryA
CreateProcessA
CreateThread
ExitProcess
LocalFree
SetFileAttributesA
DeleteCriticalSection

advapi32

RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegDeleteKeyA
RegQueryValueExA

shell32

SHGetSpecialFolderPathA
CommandLineToArgvW

ole32

CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream

oleaut32

VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString

msvcrt

strlen
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
_purecall
fopen
fseek
ftell
fread
fclose
??2@YAPAXI@Z
??3@YAXPAX@Z
strstr
strcat
strcpy
memset
_access
sprintf
memcmp
memcpy
strrchr
_stricmp
atoi
strchr
strcmp
strncpy
strncmp

shlwapi

SHDeleteValueA
SHSetValueA
SHDeleteKeyA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f47b63fe27ce267a1319c2ba8cc22b5

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 4KB

idata Size: 4KB - Virtual size: 4B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 4KB

idata
Size: 4KB - Virtual size: 4B

.reloc
Size: 4KB - Virtual size: 2KB