d06509e484c329a1a76365bdd776ed0e0a56febf49efc2120c559d125092065f

Sharing

Copy URL Twitter E-mail

General

Target

d06509e484c329a1a76365bdd776ed0e0a56febf49efc2120c559d125092065f
Size

48KB
MD5

69c18fbbf320856656311ac8aa0decbf
SHA1

35377b7ea4ba8b28dbeca47105fdfbf8884eb986
SHA256

d06509e484c329a1a76365bdd776ed0e0a56febf49efc2120c559d125092065f
SHA512

fee66fb5e112e0b2f10fe2bab845f65f9cae5b3a6a1b266aeaa2187c3ced436aabd74dbe6344ac7d2acfbeda19cfe6ebd8d4ebdd9e1d1a2c2e75adba4dc86fa0
SSDEEP

768:dZgwEm5Ahe8PZC379incGgIjDxe2g0WLK6vEt822YJu0Gh26ZhBQ5+M7S8EkD8UU:dZly2OjgyDxeV0ME2dh26ZbAjEPUr

Score

N/A

Malware Config

Signatures

Files

d06509e484c329a1a76365bdd776ed0e0a56febf49efc2120c559d125092065f
.dll regsvr32 windows x86

d28e692c036dc305e50e3ab0b999271a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
lstrlenW
GetShortPathNameA
GetModuleHandleA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
WideCharToMultiByte
RemoveDirectoryA
DeleteCriticalSection
Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
GetCommandLineW
ExitProcess
CreateDirectoryA
WritePrivateProfileStringA
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteFileA
MoveFileA
lstrlenA
MultiByteToWideChar
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
GetCurrentProcessId
Process32First
Process32Next
CloseHandle
LocalFree
SetFileAttributesA
CreateThread

advapi32

RegCreateKeyExA
RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegDeleteKeyA
RegQueryInfoKeyA

shell32

SHGetSpecialFolderPathA
CommandLineToArgvW

ole32

CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance

oleaut32

SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString

msvcrt

memcmp
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
atoi
strncmp
strchr
strncpy
wcsstr
_wcslwr
strcpy
??3@YAXPAX@Z
memset
sprintf
strlen
memcpy
_purecall
??2@YAPAXI@Z
_strlwr
strstr
strrchr
strcat
strcmp
_access

shlwapi

SHSetValueA
SHDeleteValueA
SHDeleteKeyA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

idata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d28e692c036dc305e50e3ab0b999271a

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 4KB

idata Size: 4KB - Virtual size: 4B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 4KB

idata
Size: 4KB - Virtual size: 4B

.reloc
Size: 4KB - Virtual size: 2KB