bd95ae275a485ee8cdba4992c99849f5e5f7ec89b486485e830871742bb1f7cc

Sharing

Copy URL

Twitter E-mail

General

Target

bd95ae275a485ee8cdba4992c99849f5e5f7ec89b486485e830871742bb1f7cc
Size

60KB
MD5

4e6cfeca386801edd31317111acf3679
SHA1

4ce14ab300c83548b8795a15b1602f674a8c050c
SHA256

bd95ae275a485ee8cdba4992c99849f5e5f7ec89b486485e830871742bb1f7cc
SHA512

ebe1d77d556ac49c7e25cf8b1705fc434eddad2ef41c4f4c9c04aca218eed885ad9742b1c624d56ed2a6c26bc1eaa7e5230a4e0da7af7b4df44266b324362856
SSDEEP

1536:dei1dXF4NHvzW/CKT04YTIPyczqyFvTs:J8va5HYWyzyFvTs

Score

N/A

Malware Config

Signatures

Files

bd95ae275a485ee8cdba4992c99849f5e5f7ec89b486485e830871742bb1f7cc
.dll regsvr32 windows x86

880d1927e4b3e20068d52a9ff6b13bb3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileStringA
FindFirstFileA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
GetProcAddress
WideCharToMultiByte
lstrlenW
GetCommandLineW
Sleep
SetFileAttributesA
MoveFileA
GetCurrentProcessId
RemoveDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
WritePrivateProfileStringA
DeleteFileA
FindNextFileA
EnterCriticalSection
LeaveCriticalSection
LocalFree
Process32First
Process32Next
CloseHandle
lstrlenA
MultiByteToWideChar
GetModuleFileNameA
CreateDirectoryA
CreateThread
FreeLibrary
LoadLibraryA
ExitProcess

advapi32

RegQueryInfoKeyA
RegEnumKeyExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA

shell32

SHGetSpecialFolderPathA
CommandLineToArgvW

ole32

CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream

oleaut32

SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString

msvcrt

strncpy
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strcmp
_wcslwr
wcsstr
_purecall
memcpy
fopen
fseek
ftell
??2@YAPAXI@Z
??3@YAXPAX@Z
_access
strcat
memset
strlen
sprintf
strcpy
strstr
strrchr
memcmp
_strlwr
strchr
strncmp
atoi
fclose
fread

shlwapi

SHSetValueA
SHDeleteValueA
SHDeleteKeyA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mdata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bdata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

880d1927e4b3e20068d52a9ff6b13bb3

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 4KB

mdata Size: 4KB - Virtual size: 4B

bdata Size: 4KB - Virtual size: 4B

idata Size: 4KB - Virtual size: 4B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 4KB

mdata
Size: 4KB - Virtual size: 4B

bdata
Size: 4KB - Virtual size: 4B

idata
Size: 4KB - Virtual size: 4B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 2KB