ec17ff4a68ea0e92d055a1445cc7a9de6d731fc7f81a3e7a6b4824db1a50dc24

Sharing

Copy URL Twitter E-mail

General

Target

ec17ff4a68ea0e92d055a1445cc7a9de6d731fc7f81a3e7a6b4824db1a50dc24
Size

134KB
MD5

036e9bbb1ee0fd7eb0fd325226695bc0
SHA1

61c0a34e2cedafb2b77912a8340fec62253bc1da
SHA256

ec17ff4a68ea0e92d055a1445cc7a9de6d731fc7f81a3e7a6b4824db1a50dc24
SHA512

952000fbde84bdd0fa370e2cf627496d724e396e1d47c765bb9b344e93bd51044b0978e554b5a4c47e7030e8cc9ce289bfa7e70d637c2685554e63fa503faf57
SSDEEP

3072:kkEv8kYqQN8hx3vk2HvNyiikTSvVFkt8b:kkEFDW8hFvk2HvwiiGg

Score

N/A

Malware Config

Signatures

Files

ec17ff4a68ea0e92d055a1445cc7a9de6d731fc7f81a3e7a6b4824db1a50dc24
.dll regsvr32 windows x86

796bee80aade9295793f442e052c500b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DisableThreadLibraryCalls
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetVersionExA
lstrcpyA
WriteFile
InterlockedDecrement
WideCharToMultiByte
InterlockedIncrement
GetLastError
lstrlenW
CreateThread
WaitForSingleObject
SetEvent
Sleep
GetSystemTime
SystemTimeToFileTime
CompareFileTime
GetModuleHandleA
LocalAlloc
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
lstrcpynA
lstrlenA
LocalFree
CloseHandle

user32

IsWindow

advapi32

RegCloseKey

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemAlloc

oleaut32

SysFreeString
SysAllocString
LoadTypeLi
LoadRegTypeLi
SetErrorInfo
RegisterTypeLi
SysAllocStringLen
VariantClear

shlwapi

SHRegGetBoolUSValueW
ord90
ord89
ord57
PathRemoveFileSpecA
ord219
StrCpyW
wnsprintfW
ord107
ord217
StrCatBuffW
ord40
StrChrW
ord117
StrCmpNIW
ord366
ord125
ord169
StrCmpIW
ord51
ord199
ord24
ord80
ord121
ord124
ord309
StrDupW
StrDupA
wnsprintfA
ord215
StrToIntExW
ord52
ord312
StrCmpW
StrCpyNW

comctl32

ord152
ord401
ord386
ord403
ord327
ord323
ord332
ord320
ord324
ord400
ord328
ord339
ord334

wininet

InternetOpenUrlW
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
CreateUrlCacheEntryW
CommitUrlCacheEntryW
InternetCloseHandle
InternetCrackUrlW
GetUrlCacheEntryInfoW
SetUrlCacheEntryInfoW
InternetConnectW
InternetOpenW

Exports

Exports

AddEmailToAutoComplete
AutoDiscoverAndOpenEmail
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

796bee80aade9295793f442e052c500b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

comctl32

wininet

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 23KB

.data Size: - Virtual size: 272B

.rsrc Size: 107KB - Virtual size: 107KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 23KB

.data
Size: - Virtual size: 272B

.rsrc
Size: 107KB - Virtual size: 107KB

.reloc
Size: 2KB - Virtual size: 1KB