NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
d396d1ae187b8e9a10a453c625d70af44e18c38485dc468fad4e15399c828520.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d396d1ae187b8e9a10a453c625d70af44e18c38485dc468fad4e15399c828520.dll
Resource
win10v2004-20220812-en
General
-
Target
d396d1ae187b8e9a10a453c625d70af44e18c38485dc468fad4e15399c828520
-
Size
236KB
-
MD5
98e3107b9c7a47d508878f8ab7a47170
-
SHA1
4650b8199896d70bcbdfc7ac391e13aae6a96ce2
-
SHA256
d396d1ae187b8e9a10a453c625d70af44e18c38485dc468fad4e15399c828520
-
SHA512
18d15bd30456853a878578aa874a89f8fda5cd5757d7127e8f76e675cc88616638c7d9745dae78070fdd635c7011bccebf908ac7b2249f4990d3160ceb7771d6
-
SSDEEP
6144:7O4Me4VrOlNGZ7xmWNpXcoCDGeo55WCelE1XEx:RMe4TFmOpXPeY5slE1Xa
Malware Config
Signatures
Files
-
d396d1ae187b8e9a10a453c625d70af44e18c38485dc468fad4e15399c828520.dll windows x86
de7ee0a95274dd6ea3547fcf4befeadd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
xpcom_core
??1nsCOMArray_base@@IAE@XZ
?ReplaceObjectAt@nsCOMArray_base@@IAEHPAVnsISupports@@H@Z
?Sort@nsVoidArray@@QAEXP6AHPBX0PAX@Z1@Z
?InsertObjectAt@nsCOMArray_base@@IAEHPAVnsISupports@@H@Z
?Compare@@YAHABVnsACString_internal@@0ABVnsCStringComparator@@@Z
??_7nsDefaultCStringComparator@@6B@
NS_QuickSort
?Equals@nsCSubstring@@QBEHABV1@@Z
?StringEndsWith@@YAHABVnsACString_internal@@0ABVnsCStringComparator@@@Z
??_7nsCaseInsensitiveCStringComparator@@6B@
??0nsCOMArray_base@@IAE@H@Z
?NS_CreateServicesFromCategory@@YAIPBDPAVnsISupports@@0@Z
??1nsCStringArray@@UAE@XZ
?Assign@nsACString_internal@@QAEXABVnsCSubstringTuple@@@Z
PL_DHashTableInit
PL_DHashTableFinish
PL_DHashTableOperate
?AppendInt@nsCString@@QAEXHH@Z
PL_DHashFinalizeStub
PL_DHashMoveEntryStub
PL_DHashStringKey
PL_DHashGetKeyStub
PL_DHashFreeTable
PL_DHashAllocTable
??0nsCreateInstanceByCID@@QAE@ABUnsID@@PAVnsISupports@@PAI@Z
?strcmp@nsCRT@@SAHPBD0@Z
NS_NewNativeLocalFile_P
?Equals@nsCSubstring@@QBEHPBD@Z
?RemoveElementsAt@nsVoidArray@@QAEHHH@Z
?RemoveCStringAt@nsCStringArray@@QAEHH@Z
?GrowArrayBy@nsVoidArray@@MAEHH@Z
?Compact@nsAutoVoidArray@@UAEXXZ
?SizeTo@nsAutoVoidArray@@UAEHH@Z
?Clear@nsAutoVoidArray@@UAEXXZ
?InsertCStringAt@nsCStringArray@@QAEHABVnsACString_internal@@H@Z
?FindCharInReadable@@YAHDAAV?$nsReadingIterator@D@@ABV1@@Z
?EmptyCString@@YAABVnsCString@@XZ
?NS_NewGenericModule2@@YAIPBUnsModuleInfo@@PAPAVnsIModule@@@Z
?AssignASCII@nsSubstring@@QAEXPBD@Z
?CStringAt@nsCStringArray@@QBEXHAAVnsACString_internal@@@Z
?ReplaceElementAt@nsVoidArray@@QAEHPAXH@Z
??0nsCStringArray@@QAE@XZ
?assign_from_gs_contractid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByContractIDWithError@@ABUnsID@@@Z
?EmptyString@@YAABVnsString@@XZ
?ToNewUnicode@@YAPAGABVnsAString_internal@@@Z
??0nsAutoVoidArray@@QAE@XZ
??1nsVoidArray@@UAE@XZ
PL_DHashTableEnumerate
?ElementAt@nsVoidArray@@QBEPAXH@Z
?Clone@nsMemory@@SAPAXPBXI@Z
?NS_GetWeakReference@@YAPAVnsIWeakReference@@PAVnsISupports@@PAI@Z
?AppendUTF8toUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?AppendUTF16toUTF8@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?AppendASCIItoUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?Assign@nsCSubstring@@QAEXABV1@@Z
?assign_from_qi@nsCOMPtr_base@@QAEXVnsQueryInterface@@ABUnsID@@@Z
?Assign@nsCSubstring@@QAEXABVnsACString_internal@@@Z
?Assign@nsACString_internal@@QAEXABV1@@Z
?InsertElementAt@nsVoidArray@@QAEHPAXH@Z
?ToNewCString@@YAPADABVnsACString_internal@@@Z
??0nsQueryReferent@@QAE@PAVnsIWeakReference@@PAI@Z
NS_Alloc_P
?Adopt@nsCSubstring@@QAEXPADI@Z
?Assign@nsCSubstring@@QAEXPBDI@Z
?Adopt@nsSubstring@@QAEXPAGI@Z
?sEmptyBuffer@?$nsCharTraits@G@@2PBGB
??1nsACString_internal@@QAE@XZ
?SetLength@nsCSubstring@@QAEXI@Z
?sEmptyBuffer@?$nsCharTraits@D@@2PBDB
?Replace@nsCSubstring@@QAEXIIPBDI@Z
?sCanonicalVTable@nsObsoleteACString@@2PBXB
?assign_with_AddRef@nsCOMPtr_base@@QAEXPAVnsISupports@@@Z
??0nsSupportsWeakReference@@QAE@XZ
?assign_from_helper@nsCOMPtr_base@@QAEXABVnsCOMPtr_helper@@ABUnsID@@@Z
?assign_from_gs_contractid@nsCOMPtr_base@@QAEXVnsGetServiceByContractID@@ABUnsID@@@Z
?assign_from_qi_with_error@nsCOMPtr_base@@QAEXABVnsQueryInterfaceWithError@@ABUnsID@@@Z
NS_Free_P
?GetWeakReference@nsSupportsWeakReference@@UAGIPAPAVnsIWeakReference@@@Z
??_7nsSupportsWeakReference@@6B@
??1nsCOMPtr_base@@QAE@XZ
??1nsAString_internal@@QAE@XZ
?sCanonicalVTable@nsObsoleteAString@@2PBXB
?strcmp@nsCRT@@SAHPBG0@Z
??0nsCreateInstanceByContractID@@QAE@PBDPAVnsISupports@@PAI@Z
nspr4
PR_Free
PR_AtomicDecrement
PR_Calloc
PR_AtomicIncrement
plc4
PL_strlen
PL_strncmp
PL_strdup
plds4
PL_FinishArenaPool
PL_InitArenaPool
PL_ArenaAllocate
msvcr80
_except_handler4_common
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
isspace
isdigit
free
atoi
realloc
malloc
memcpy
strcmp
memset
strlen
??2@YAPAXI@Z
??3@YAXPAX@Z
_onexit
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
Exports
Exports
Sections
.text Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE