CreatePlugin
Static task
static1
Behavioral task
behavioral1
Sample
78ecc16990a7a0cce1cf0efcf3c5f3ef8f31ec6964a59aa63e483e47ae3b0830.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
78ecc16990a7a0cce1cf0efcf3c5f3ef8f31ec6964a59aa63e483e47ae3b0830.dll
Resource
win10v2004-20220812-en
General
-
Target
78ecc16990a7a0cce1cf0efcf3c5f3ef8f31ec6964a59aa63e483e47ae3b0830
-
Size
196KB
-
MD5
892284a72b60495bb3de1af53f8f674e
-
SHA1
055107efa8c266ad1e0f131672525a377f6fabb4
-
SHA256
78ecc16990a7a0cce1cf0efcf3c5f3ef8f31ec6964a59aa63e483e47ae3b0830
-
SHA512
000a7aa4adf08704b126bedbda0efa3de5ee2d1b8d5524a825fff097122dbffcf6bec5b2aceabd307f3d056a6efd2a3e84e491cfacbf64f34150ce010ace9c98
-
SSDEEP
3072:d5lOlEX+yxA53KQ+W0iDwows9BI3pKox3tQKK8FR/yRZp:3pX+B53KQ4wws9q3AoRt7K8L/6b
Malware Config
Signatures
Files
-
78ecc16990a7a0cce1cf0efcf3c5f3ef8f31ec6964a59aa63e483e47ae3b0830.dll windows x86
8b4624231b7f42c288fd20f580c864c6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetIpAddrTable
GetAdaptersInfo
GetIfTable
ndisapi
NdisGetDeviceName
NdisConnect
NdisGetDeviceCount
NdisGetConnState
NdisOnPowerbroadcast
NdisCancelConnect
NdisDestroyInstance
NdisConnectionNotification
NdisDisconnect
NdisSelectDevice
setupapi
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
mfc71u
ord265
ord1473
ord1472
ord577
ord280
ord578
ord2313
ord304
ord283
ord2311
ord293
ord774
ord764
ord762
ord1079
ord1168
ord371
ord1093
ord2263
ord4079
ord6133
ord266
msvcr71
_itoa
__CxxFrameHandler
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??1exception@@UAE@XZ
??0exception@@QAE@XZ
strchr
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
__security_error_handler
free
_except_handler3
memset
wcsstr
time
__RTDynamicCast
swprintf
wcscmp
wcscpy
printf
_purecall
fseek
ftell
fread
strtol
strstr
sprintf
fopen
fclose
strncmp
kernel32
CreateMutexA
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
DeleteCriticalSection
InitializeCriticalSection
CreateThread
TerminateThread
ReleaseMutex
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
ResetEvent
CreateFileW
DeviceIoControl
CreateEventW
CloseHandle
Sleep
GetVersionExW
user32
wsprintfW
advapi32
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegQueryInfoKeyW
msvcp71
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
Exports
Exports
Sections
.text Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE