b7760a72d0cf9e8f92180c11839d4e47f8b013879d2856491d2d1ad9136829f3

Sharing

Copy URL Twitter E-mail

General

Target

b7760a72d0cf9e8f92180c11839d4e47f8b013879d2856491d2d1ad9136829f3
Size

136KB
MD5

8d1bf7eb041275446b723c24de59e3a0
SHA1

06c7b352bd2957d15e8d42c5c37db9689fab0e61
SHA256

b7760a72d0cf9e8f92180c11839d4e47f8b013879d2856491d2d1ad9136829f3
SHA512

ad5e519c075eff22bc34da6fd13d9218be3cdbc4f21b976eaacb088f6439d05ded255b8b75781964661c34ad575e9ae9c22bbaf26272a72531ae71ef2cd16f9f
SSDEEP

3072:rgrpetKENxogTMPdZ8e6MfmsFTmidAaJRhGFZyT94sCU5JNm9T:gkzxI1Z8ZPkyzScFkTKUrNcT

Score

N/A

Malware Config

Signatures

Files

b7760a72d0cf9e8f92180c11839d4e47f8b013879d2856491d2d1ad9136829f3
.dll regsvr32 windows x86

02b117d744c07814c960a626525a010f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA
SHDeleteValueA
PathStripToRootA
PathAppendA
PathFileExistsA
PathIsUNCA
SHSetValueA
PathFindFileNameA
PathFindExtensionA
SHGetValueA
PathRemoveExtensionA
PathRemoveFileSpecA
PathRemoveBackslashA
PathRemoveBlanksA

kernel32

DeleteCriticalSection
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
LeaveCriticalSection
EnterCriticalSection
CreateFileA
lstrcpynA
GetVersionExA
GetCurrentThreadId
GetTickCount
CreateMutexA
FindClose
FindNextFileA
FindFirstFileA
GetLastError
lstrcmpA
lstrlenW
WideCharToMultiByte
InitializeCriticalSection
MultiByteToWideChar
FreeLibrary
WaitForSingleObject
TerminateThread
GetModuleFileNameA
VirtualQuery
lstrcmpiA
VirtualProtect
GetCurrentProcess
WriteProcessMemory
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32First
Module32Next
CloseHandle
GetModuleHandleA
InterlockedDecrement
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
OutputDebugStringA
GetFileAttributesW
LoadLibraryA
SetLastError
SetThreadPriority
Sleep
CreateThread
GetSystemInfo
GetProcAddress
GetVersion
GlobalSize
lstrcatA
GetSystemDirectoryA
lstrcpyA
lstrlenA
OpenMutexA
LocalFree
IsBadStringPtrW
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
DeviceIoControl
GetPrivateProfileStringA
MoveFileA
IsBadStringPtrA
GlobalLock
GetWindowsDirectoryA
MoveFileExA
WriteFile
DeleteFileA
GetTempFileNameA
GetTempPathA
InterlockedIncrement
InterlockedExchange
CreateProcessA
GetShortPathNameA
CopyFileA
WritePrivateProfileStructA
WritePrivateProfileStringA
GetPrivateProfileStructA
GetPrivateProfileIntA

user32

EnumChildWindows
RegisterWindowMessageA
GetClassNameA
SendMessageA
SetWindowTextA
IsWindow
GetParent
EnumWindows
MessageBoxA
InvalidateRect
ReleaseDC
DrawTextA
GetWindowTextA
FillRect
GetSysColor
GetDC
GetFocus
GetKeyState
SetWindowLongW
GetComboBoxInfo
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
WindowFromPoint
IsWindowVisible
GetWindowThreadProcessId
RemovePropA
DialogBoxParamA
GetWindow
GetWindowRect
SystemParametersInfoA
GetClientRect
MapWindowPoints
SetWindowPos
GetDlgItemTextA
EndDialog
GetWindowTextLengthA
GetDlgItem
EnableWindow
LoadStringA
SetWindowLongA
SendMessageTimeoutA
GetPropA
DefWindowProcA
CallWindowProcA
FindWindowExA
GetWindowLongA
SetPropA

advapi32

RegDeleteValueA
ControlService
OpenServiceA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegOpenKeyA
CloseServiceHandle
OpenSCManagerA
DeleteService

ole32

RevokeDragDrop
RegisterDragDrop
CoCreateGuid
ReleaseStgMedium
CoUninitialize
CoTaskMemFree
StringFromCLSID
CoInitialize

oleaut32

SysFreeString
VariantClear
SysAllocString

imagehlp

ImageDirectoryEntryToData

msvcrt

fopen
_mbclen
_ismbcdigit
malloc
atoi
_vsnprintf
_CxxThrowException
fwrite
rand
strrchr
_ltoa
srand
time
fread
fseek
??1type_info@@UAE@XZ
fputs
strstr
rewind
wcslen
_mbstok
__dllonexit
_onexit
_initterm
_adjust_fdiv
fgets
fclose
bsearch
_mbsnbicmp
_mbschr
strncpy
free
_snprintf
realloc
_mbsrchr
_mbslwr
_mbsstr
_mbscmp
_except_handler3
sprintf
_mbsnbcpy
_purecall
wcscpy
_mbsicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_stricmp
_wcsicmp
_strlwr
ftell

urlmon

IsValidURL
URLDownloadToFileA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

ws2_32

gethostbyname
inet_ntoa
inet_addr
WSAGetLastError
socket
WSAStartup
WSACleanup
closesocket
recv
setsockopt
send
htons
connect

gdi32

SetBkMode
GetStockObject
DeleteObject
CreateSolidBrush
SetTextColor
GetTextExtentPointA
SetPixel
LineTo
MoveToEx
CreatePen
SelectObject

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteA
SHGetSpecialFolderPathA

wininet

DeleteUrlCacheEntry
InternetCrackUrlA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Register
Uninstall

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02b117d744c07814c960a626525a010f

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

ole32

oleaut32

imagehlp

msvcrt

urlmon

version

ws2_32

gdi32

shell32

wininet

Exports

Exports

Sections

.text Size: 82KB - Virtual size: 82KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 82KB - Virtual size: 82KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 9KB - Virtual size: 8KB