38391207816df8e73dcfd3c18a84a1d3a2502a9e34d7b8f36cb9f22b272f9c09

Sharing

Copy URL Twitter E-mail

General

Target

38391207816df8e73dcfd3c18a84a1d3a2502a9e34d7b8f36cb9f22b272f9c09
Size

1.3MB
MD5

8f954e5ffa7b5d0d10126700940d6238
SHA1

297cba79df5e74cb5e3d2a0ecc57bd651c34bac6
SHA256

38391207816df8e73dcfd3c18a84a1d3a2502a9e34d7b8f36cb9f22b272f9c09
SHA512

0273fe85cdf5b2554a5fef8b3e3328f2195508f232309f10af7715f49aedda4b11d72b84ae3253e774b99c2e4b9128c6031210bb7207de6de7c0804d9dffc441
SSDEEP

24576:/WkM8Tr8nEh3OKkbBDD5Bw0PJx9Xd6eHS93zNNVMqfoB:/W7EhNkbBDg0PJC3DV

Score

N/A

Malware Config

Signatures

Files

38391207816df8e73dcfd3c18a84a1d3a2502a9e34d7b8f36cb9f22b272f9c09
.dll regsvr32 windows x86

d6409d3e06cabcca0de12bbc04b7c0b1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

LoadStringW
GetThreadDesktop
MessageBoxW
wsprintfW
CloseDesktop
OpenDesktopW
PeekMessageW
DispatchMessageW
TranslateMessage
KillTimer
MsgWaitForMultipleObjects
SetTimer
SetThreadDesktop
GetWindowRect
GetClientRect
MapWindowPoints
SetWindowPos
GetDesktopWindow
SetProcessWindowStation
OpenWindowStationW
GetProcessWindowStation
CloseWindowStation
SetDlgItemTextW
EndDialog
DialogBoxParamW
CharNextW
CharPrevW

kernel32

ResetEvent
CreateTimerQueueTimer
OutputDebugStringW
IsDebuggerPresent
DuplicateHandle
InterlockedExchange
SetThreadPriority
InterlockedExchangeAdd
OpenEventW
RegisterWaitForSingleObject
UnregisterWait
LocalAlloc
PulseEvent
WideCharToMultiByte
QueueUserWorkItem
QueryPerformanceFrequency
GetThreadPriority
GetComputerNameExW
ReleaseMutex
MoveFileW
GetLocalTime
CompareFileTime
GetFileAttributesW
GetFileAttributesExW
GetDriveTypeW
GetLongPathNameW
CreateMutexW
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
RegisterWaitForSingleObjectEx
GlobalMemoryStatusEx
GetSystemWindowsDirectoryW
GetDiskFreeSpaceExW
WriteFile
SetFilePointer
GetVolumeInformationW
DeviceIoControl
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
CreateActCtxW
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
TlsSetValue
FormatMessageW
LocalFree
FindFirstFileW
lstrcmpW
DeleteFileW
FindNextFileW
FindClose
IsBadWritePtr
Sleep
CreateThread
SetEvent
TerminateThread
WaitForMultipleObjects
FreeLibraryAndExitThread
DelayLoadFailureHook
GetModuleHandleExW
LockResource
GetExitCodeProcess
CreateProcessW
InterlockedCompareExchange
GetLastError
GetVersionExW
VirtualProtect
VirtualAlloc
OutputDebugStringA
GetComputerNameW
GetQueuedCompletionStatus
CreateIoCompletionPort
PostQueuedCompletionStatus
ChangeTimerQueueTimer
LoadLibraryExA
RaiseException
GetThreadLocale
CreateEventA
CreateSemaphoreA
GetThreadContext
CreateDirectoryW
SetFileAttributesW
GetSystemInfo
VirtualQuery
MultiByteToWideChar
lstrlenW
lstrcpyW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
HeapDestroy
LoadLibraryW
GetModuleFileNameW
CreateEventW
DebugBreak
ExitProcess
CloseHandle
CreateFileW
OpenProcess
ExpandEnvironmentStringsW
lstrcpynW
GetModuleHandleW
FreeLibrary
GetProcAddress
TlsFree
InitializeCriticalSectionAndSpinCount
DisableThreadLibraryCalls
TlsAlloc
GetVersionExA
lstrcatW
lstrlenA
SizeofResource
DeleteTimerQueueTimer
GetCurrentThread
WaitForSingleObject
TlsGetValue
ReleaseSemaphore
CreateSemaphoreW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LoadLibraryA
LoadLibraryExW
FindResourceW
LoadResource

ole32

CoReactivateObject
CLSIDFromString
CoInitializeEx
CoUninitialize
CoGetApartmentID
CoWaitForMultipleHandles
CoGetCurrentLogicalThreadId
StringFromGUID2
CoGetMarshalSizeMax
CoMarshalInterface
CoCreateGuid
StringFromCLSID
CoCreateInstance
CoGetObjectContext
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoDeactivateObject
CoRevertToSelf
CreateBindCtx
CoGetClassObject
CoGetInterceptor
CoImpersonateClient
ProgIDFromCLSID
CLSIDFromProgID
CoGetCallContext
CoGetProcessIdentifier
StringFromIID
CoGetDefaultContext
CoFreeUnusedLibraries
CoDisconnectObject
CoCreateInstanceEx
CoUnmarshalInterface
CoRetireServer
CoGetObject
CoReleaseMarshalData
IIDFromString
OleSaveToStream
OleLoadFromStream
WriteClassStm
ReadClassStm
GetHGlobalFromStream
CreateStreamOnHGlobal
CreateGenericComposite
CreateAntiMoniker
MonikerCommonPrefixWith
MonikerRelativePathTo
MkParseDisplayName
CoPushServiceDomain
CoPopServiceDomain
CoSetProxyBlanket

oleaut32

SafeArrayCreate
LPSAFEARRAY_UserSize
GetErrorInfo
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree
VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserFree
VariantChangeType
CreateErrorInfo
SetErrorInfo
SysAllocStringByteLen
SysStringByteLen
VariantCopy
SysAllocStringLen
VariantClear
SafeArrayCreateVector
SafeArrayAccessData
VariantInit
SafeArrayUnaccessData
SafeArrayDestroy
LoadRegTypeLi
VarUI4FromStr
SysStringLen
RegisterTypeLi
LoadTypeLi
SysFreeString
SysAllocString
LPSAFEARRAY_UserMarshal

advapi32

GetSidIdentifierAuthority
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetSecurityDescriptorControl
ConvertStringSidToSidW
TraceEvent
EnableTrace
StartTraceW
StopTraceW
ControlTraceW
OpenTraceW
CloseTrace
QueryTraceW
ProcessTrace
InitializeSecurityDescriptor
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetKernelObjectSecurity
OpenSCManagerW
OpenServiceW
ControlService
CloseServiceHandle
RegNotifyChangeKeyValue
SetThreadToken
AccessCheck
OpenThreadToken
ImpersonateSelf
RevertToSelf
LookupAccountSidW
BuildTrusteeWithSidW
GetSecurityDescriptorDacl
GetAclInformation
GetEffectiveRightsFromAclW
CopySid
GetSecurityDescriptorLength
IsValidSecurityDescriptor
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
AllocateAndInitializeSid
FreeSid
GetLengthSid
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
LsaClose
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
RegEnumKeyExW
RegQueryValueExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
WmiNotificationRegistrationW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
EqualSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
LookupAccountNameW
AddAce
GetAce
AddAccessAllowedAceEx
DeleteAce
CheckTokenMembership
IsValidSid
CreateProcessAsUserW
DuplicateTokenEx

rpcrt4

CStdStubBuffer_QueryInterface
UuidToStringA
RpcStringFreeA
UuidFromStringW
UuidToStringW
RpcStringFreeW
NdrMesTypeDecode2
NdrMesTypeEncode2
MesEncodeDynBufferHandleCreate
MesDecodeBufferHandleCreate
MesHandleFree
UuidCreate
I_RpcBindingInqLocalClientPID
I_RpcBindingInqTransportType
NdrStubForwardingFunction
NdrStubCall2
I_RpcTurnOnEEInfoPropagation
UuidCreateSequential
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
NdrOleAllocate
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree

msvcrt

wcslen
_wcsdup
wcsncpy
wcsrchr
wcscpy
wcstombs
mbstowcs
wcscmp
time
_beginthreadex
memmove
wcsstr
_vsnwprintf
wcstok
wcscat
_wsplitpath
_wmakepath
_itow
iswdigit
_ltow
_beginthread
vswprintf
_wcsupr
iswalpha
_resetstkoflw
_initterm
_adjust_fdiv
?terminate@@YAXXZ
__dllonexit
_onexit
_ultoa
_waccess
_wstrtime
_wstrdate
wcsncat
_CIexp
_snwprintf
wcschr
_wcsicmp
_wtoi
_local_unwind2
realloc
free
malloc
_except_handler3
__CxxFrameHandler
_vsnprintf
??1type_info@@UAE@XZ
_CxxThrowException

ntdll

RtlInitAnsiString
RtlInitUnicodeString
RtlOemStringToUnicodeString
RtlDelete
RtlNtStatusToDosError
RtlDeleteCriticalSection
RtlInitializeCriticalSectionAndSpinCount
RtlSplay
RtlImageNtHeader
RtlFreeHeap
RtlAllocateHeap
RtlExtendedLargeIntegerDivide
RtlLargeIntegerDivide
NtQuerySystemInformation

Exports

Exports

CoCreateActivity
CoEnterServiceDomain
CoLeaveServiceDomain
CoLoadServices
ComSvcsExceptionFilter
ComSvcsLogError
CosGetCallContext
DispManGetContext
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetMTAThreadPoolMetrics
GetManagedExtensions
GetObjectContext
GetTrkSvrObject
MTSCreateActivity
MiniDumpW
RecycleSurrogate
RegisterComEvents
SafeRef

Sections

.text
Size: 961KB - Virtual size: 961KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 144KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d6409d3e06cabcca0de12bbc04b7c0b1

Headers

File Characteristics

Imports

user32

kernel32

ole32

oleaut32

advapi32

rpcrt4

msvcrt

ntdll

Exports

Exports

Sections

.text Size: 961KB - Virtual size: 961KB

.orpc Size: 5KB - Virtual size: 5KB

.data Size: 144KB - Virtual size: 165KB

.rsrc Size: 175KB - Virtual size: 175KB

.reloc Size: 57KB - Virtual size: 57KB

.text
Size: 961KB - Virtual size: 961KB

.orpc
Size: 5KB - Virtual size: 5KB

.data
Size: 144KB - Virtual size: 165KB

.rsrc
Size: 175KB - Virtual size: 175KB

.reloc
Size: 57KB - Virtual size: 57KB