c81562b15801e2f6df46f3a9c49496479d8f55be5182ab2e81334b205b50e569

Sharing

Copy URL Twitter E-mail

General

Target

c81562b15801e2f6df46f3a9c49496479d8f55be5182ab2e81334b205b50e569
Size

424KB
MD5

bbc99e21ec7f120d0dbb96f4f3e549b0
SHA1

4188a75225299e1e6ef928b6273ebdb55d8c0713
SHA256

c81562b15801e2f6df46f3a9c49496479d8f55be5182ab2e81334b205b50e569
SHA512

f168c6d8ca0e09e4d3be1bccab305b8bb81d437882f34c575a6866ba50ff961ff6be2e1d3f714aa9a72ce007f5094af0abe25a265191eda3133f1052254dea56
SSDEEP

12288:zk8qdTpCzUgBKNAhP7+JTQRek9suR+XF:wbdIpBlqk9sl

Score

N/A

Malware Config

Signatures

Files

c81562b15801e2f6df46f3a9c49496479d8f55be5182ab2e81334b205b50e569
.dll windows x86

2ffabcae9cab3ad30d5606d51bc8c632

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wstdcommon

??1calException@@UAE@XZ
?GetRuntimeClass@calException@@UBEPAUCRuntimeClass@@XZ
??0calException@@QAE@W4calExceptionType@0@VwstdCString@@@Z

interopframeworkcore

pProxyCache

msvcr90

memset
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_onexit
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?terminate@@YAXXZ
_invalid_parameter_noinfo
?what@exception@std@@UBEPBDXZ
??2@YAPAXI@Z
abort
_CxxThrowException
??_V@YAXPAX@Z
??3@YAXPAX@Z
__CxxFrameHandler3
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
__FrameUnwindFilter
_lock
__dllonexit
_unlock
_except_handler4_common
_purecall
_crt_debugger_hook
_cexit
__CxxQueryExceptionSize
__clean_type_info_names_internal
??0exception@std@@QAE@ABQBD@Z
memmove_s
??0exception@std@@QAE@XZ
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter

mfc90

ord1258
ord1254
ord316
ord300
ord601
ord910
ord1143
ord599
ord819
ord274
ord3726
ord1303
ord321
ord1087
ord1137
ord2948
ord5926
ord2949
ord392

kernel32

GetProcessHeap
HeapFree
DisableThreadLibraryCalls
GetLastError
lstrlenW
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
GetSystemInfo
GetSystemTimeAsFileTime
SwitchToThread
InterlockedExchange
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement

oleaut32

GetErrorInfo
SysFreeString
VariantCopy
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear
CreateErrorInfo
SetErrorInfo
VariantChangeType

msvcp90

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?_Lockit_ctor@_Lockit@std@@SAXH@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Lockit_dtor@_Lockit@std@@SAXH@Z
??0?$allocator@_W@std@@QAE@ABV01@@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ

msvcm90

?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z

mscoree

_CorDllMain

Exports

Exports

??0IAutodownloadMgrIOPProxy@@QAE@ABU0@@Z
??0IAutodownloadMgrIOPProxy@@QAE@XZ
??1IAutodownloadMgrIOPProxy@@UAE@XZ
??4IAutodownloadMgrIOPProxy@@QAEAAU0@ABU0@@Z
??_7IAutodownloadMgrIOPProxy@@6B@
?CreateProxy@IAutodownloadMgrIOPProxy@@SA?AV?$ProxyPtr@UIAutodownloadMgrIOPProxy@@VIOPRefCounter@InteropFrameworkCore@@@InteropFrameworkCore@@XZ
?GetProxy@IAutodownloadMgrIOPProxy@@SA?AV?$ProxyPtr@UIAutodownloadMgrIOPProxy@@VIOPRefCounter@InteropFrameworkCore@@@InteropFrameworkCore@@XZ
?RemoveProxy@IAutodownloadMgrIOPProxy@@SAXXZ

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 166KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ffabcae9cab3ad30d5606d51bc8c632

Headers

DLL Characteristics

File Characteristics

Imports

wstdcommon

interopframeworkcore

msvcr90

mfc90

kernel32

oleaut32

msvcp90

msvcm90

mscoree

Exports

Exports

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 210KB - Virtual size: 210KB

.data Size: 166KB - Virtual size: 169KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 210KB - Virtual size: 210KB

.data
Size: 166KB - Virtual size: 169KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 3KB - Virtual size: 2KB