78e6d7490da96d60438a127e57b6b42b1219c5387f58fbea2a3eeac7ac6150a8

Sharing

Copy URL Twitter E-mail

General

Target

78e6d7490da96d60438a127e57b6b42b1219c5387f58fbea2a3eeac7ac6150a8
Size

148KB
MD5

6a9ee34456f2b85831a5433ddf17ec28
SHA1

63baf9386b0e37d304a25cd3e7870fea87657400
SHA256

78e6d7490da96d60438a127e57b6b42b1219c5387f58fbea2a3eeac7ac6150a8
SHA512

1dd122d95975515351c8be665f9d9f40d93856e3c75f8c42963ca7b7c1d40fdccf5d71a480a28c49cbde0d0d646e76a33500ed558f81f6cf9141e3a544f10f01
SSDEEP

3072:LDH8W3sgdJ4OwZt5pBFI2C4VVW5URuETldP/zAJGDO/z5J:LD1sM4pVFFNVVkonTrP/z0MO/zH

Score

N/A

Malware Config

Signatures

Files

78e6d7490da96d60438a127e57b6b42b1219c5387f58fbea2a3eeac7ac6150a8
.dll windows x86

44f0ab49f73c0b6af5de4fdd62807ae7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

termina

ord1

advapi32

SetSecurityDescriptorDacl
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegOpenCurrentUser
RegEnumValueW
RegOpenKeyExW
IsValidSecurityDescriptor
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
GetSecurityDescriptorDacl
RegSetValueExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
GetSecurityDescriptorLength
MakeSelfRelativeSD
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey

gdi32

CreateDCW
GetDeviceCaps
DeleteDC

kernel32

GetTempPathW
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryW
SetLastError
GetModuleFileNameW
GetSystemDirectoryW
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
LocalFree
lstrcmpW
WriteFile
GetCurrentProcessId
CloseHandle
DeactivateActCtx
LoadLibraryExW
ActivateActCtx
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateThread
CreateEventW
ReleaseActCtx
GetFileAttributesW
InterlockedIncrement
InterlockedDecrement
LocalAlloc
GetFileType
CreateFileW
GetFullPathNameW
lstrcmpiW
VirtualFree
VirtualAlloc
LoadLibraryA
GetVersionExW
GetTickCount
CreateActCtxW
WaitForSingleObject
ReleaseMutex
Sleep
CreateProcessW
GetSystemWindowsDirectoryW
CreateMutexW
ProcessIdToSessionId
lstrlenW
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetModuleHandleW
FormatMessageW
SearchPathW
GetCurrentDirectoryW
FindClose
FindFirstFileW
ResetEvent
WriteProfileStringW
GetProfileStringW
GlobalFree
GlobalAlloc
DnsHostnameToComputerNameW
GetTempFileNameW
DelayLoadFailureHook
GetFileSize
SetEndOfFile
ReadFile
SetFilePointer
DeleteFileW
HeapDestroy
HeapAlloc
HeapCreate
HeapFree
InterlockedCompareExchange
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateDirectoryW
lstrcpynW
GetSystemInfo
CopyFileW

msvcrt

wcslen
_wcsicmp
memmove
wcschr
_wcsnicmp
wcsncmp
wcsncpy
wcsrchr
wcspbrk
wcscmp
??3@YAXPAX@Z
??2@YAPAXI@Z
free
_initterm
malloc
_adjust_fdiv
_vsnwprintf
_except_handler3

ntdll

NtQueryInformationProcess
NtFsControlFile

rpcrt4

RpcMgmtIsServerListening
RpcSmDestroyClientContext
NdrClientCall2
I_RpcExceptionFilter
RpcBindingFree
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW

user32

GetWindowLongW
GetDesktopWindow
EndDialog
BringWindowToTop
SetWindowLongW
SendDlgItemMessageW
GetDlgItemTextW
MessageBoxW
GetForegroundWindow
SendNotifyMessageW
AllowSetForegroundWindow
GetMessageW
LoadStringW
GetProcessWindowStation
GetUserObjectInformationW
FindWindowW
DialogBoxParamW
PostMessageW
GetGUIThreadInfo
GetParent
GetWindow
WinHelpW
GetLastActivePopup
EnableWindow
MsgWaitForMultipleObjects
SetFocus
SetForegroundWindow
PeekMessageW
DispatchMessageW
TranslateMessage

Exports

Exports

ADVANCEDSETUPDIALOG
AbortPrinter
AddFormA
AddFormW
AddJobA
AddJobW
AddMonitorA
AddMonitorW
AddPortA
AddPortExA
AddPortExW
AddPortW
AddPrintProcessorA
AddPrintProcessorW
AddPrintProvidorA
AddPrintProvidorW
AddPrinterA
AddPrinterConnectionA
AddPrinterConnectionW
AddPrinterDriverA
AddPrinterDriverExA
AddPrinterDriverExW
AddPrinterDriverW
AddPrinterW
AdvancedDocumentPropertiesA
AdvancedDocumentPropertiesW
AdvancedSetupDialog
ClosePrinter
CloseSpoolFileHandle
CommitSpoolData
ConfigurePortA
ConfigurePortW
ConnectToPrinterDlg
ConvertAnsiDevModeToUnicodeDevmode
ConvertUnicodeDevModeToAnsiDevmode
CreatePrinterIC
DEVICECAPABILITIES
DEVICEMODE
DeleteFormA
DeleteFormW
DeleteMonitorA
DeleteMonitorW
DeletePortA
DeletePortW
DeletePrintProcessorA
DeletePrintProcessorW
DeletePrintProvidorA
DeletePrintProvidorW
DeletePrinter
DeletePrinterConnectionA
DeletePrinterConnectionW
DeletePrinterDataA
DeletePrinterDataExA
DeletePrinterDataExW
DeletePrinterDataW
DeletePrinterDriverA
DeletePrinterDriverExA
DeletePrinterDriverExW
DeletePrinterDriverW
DeletePrinterIC
DeletePrinterKeyA
DeletePrinterKeyW
DevQueryPrint
DevQueryPrintEx
DeviceCapabilities
DeviceCapabilitiesA
DeviceCapabilitiesW
DeviceMode
DevicePropertySheets
DocumentEvent
DocumentPropertiesA
DocumentPropertiesW
DocumentPropertySheets
EXTDEVICEMODE
EndDocPrinter
EndPagePrinter
EnumFormsA
EnumFormsW
EnumJobsA
EnumJobsW
EnumMonitorsA
EnumMonitorsW
EnumPortsA
EnumPortsW
EnumPrintProcessorDatatypesA
EnumPrintProcessorDatatypesW
EnumPrintProcessorsA
EnumPrintProcessorsW
EnumPrinterDataA
EnumPrinterDataExA
EnumPrinterDataExW
EnumPrinterDataW
EnumPrinterDriversA
EnumPrinterDriversW
EnumPrinterKeyA
EnumPrinterKeyW
EnumPrintersA
EnumPrintersW
ExtDeviceMode
FindClosePrinterChangeNotification
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FlushPrinter
FreePrinterNotifyInfo
GetDefaultPrinterA
GetDefaultPrinterW
GetFormA
GetFormW
GetJobA
GetJobW
GetPrintProcessorDirectoryA
GetPrintProcessorDirectoryW
GetPrinterA
GetPrinterDataA
GetPrinterDataExA
GetPrinterDataExW
GetPrinterDataW
GetPrinterDriverA
GetPrinterDriverDirectoryA
GetPrinterDriverDirectoryW
GetPrinterDriverW
GetPrinterW
GetSpoolFileHandle
IsValidDevmodeA
IsValidDevmodeW
OpenPrinterA
OpenPrinterW
PerfClose
PerfCollect
PerfOpen
PlayGdiScriptOnPrinterIC
PrinterMessageBoxA
PrinterMessageBoxW
PrinterProperties
QueryColorProfile
QueryRemoteFonts
QuerySpoolMode
ReadPrinter
ResetPrinterA
ResetPrinterW
ScheduleJob
SeekPrinter
SetAllocFailCount
SetDefaultPrinterA
SetDefaultPrinterW
SetFormA
SetFormW
SetJobA
SetJobW
SetPortA
SetPortW
SetPrinterA
SetPrinterDataA
SetPrinterDataExA
SetPrinterDataExW
SetPrinterDataW
SetPrinterW
SplDriverUnloadComplete
SpoolerDevQueryPrintW
SpoolerInit
SpoolerPrinterEvent
StartDocDlgA
StartDocDlgW
StartDocPrinterA
StartDocPrinterW
StartPagePrinter
WaitForPrinterChange
WritePrinter
XcvDataW

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.detour
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

44f0ab49f73c0b6af5de4fdd62807ae7

Headers

File Characteristics

Imports

termina

advapi32

gdi32

kernel32

msvcrt

ntdll

rpcrt4

user32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 127KB

.data Size: 6KB - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.detour Size: 5KB - Virtual size: 5KB

.text
Size: 128KB - Virtual size: 127KB

.data
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

.detour
Size: 5KB - Virtual size: 5KB