9290257bd98dcf457ff89814ae8993d3c49a0926bda2ce15482c47690b3affdf

Sharing

Copy URL

Twitter E-mail

General

Target

9290257bd98dcf457ff89814ae8993d3c49a0926bda2ce15482c47690b3affdf
Size

242KB
MD5

e60e8c3a0fbceed28c8492fc6c30bc18
SHA1

906374adc330818959c16d075af6d1116396a87b
SHA256

9290257bd98dcf457ff89814ae8993d3c49a0926bda2ce15482c47690b3affdf
SHA512

fd1a7ec4a7363e9f1758850bbdbe10b3b60b692cf6b54a9cbf45a1ac4c408adc5569407a312c38a71d16ab76fa2702279384df05c3e0efe6cbab0b7f9c5ae892
SSDEEP

3072:RzSe+fHfLe7HvG52Pkn/xw9esJ5ie5xQOPChxw/XvwiiJlZjiJX:RzVRHQi72eRS4ZiJlZjiJX

Score

N/A

Malware Config

Signatures

Files

9290257bd98dcf457ff89814ae8993d3c49a0926bda2ce15482c47690b3affdf
.dll regsvr32 windows x86

ac544d5aee87758d9037606aa1ee94fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetThreadPriority
GetCurrentThread
TerminateThread
DuplicateHandle
IsBadReadPtr
VirtualProtect
VirtualAlloc
IsBadCodePtr
VirtualFree
Thread32Next
Thread32First
SetThreadPriority
HeapFree
HeapAlloc
GetProcessHeap
SetLastError
OpenThread
CreateThread
ResetEvent
CreateEventW
SetEvent
FreeLibraryAndExitThread
LoadLibraryW
GetProcAddress
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
ProcessIdToSessionId
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
GetModuleHandleW
LoadLibraryExW
FreeLibrary
lstrcmpiW
GetLastError
DisableThreadLibraryCalls
UnmapViewOfFile
InterlockedExchangeAdd
GetComputerNameW
LocalFree
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetModuleFileNameW
InterlockedExchange
DeleteCriticalSection
LocalFileTimeToFileTime
FileTimeToSystemTime
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
ReleaseMutex
WaitForSingleObject
lstrlenW
CloseHandle
CreateMutexW
CreateToolhelp32Snapshot
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetModuleFileNameA
GetStdHandle
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetCPInfo
LCMapStringW
LCMapStringA
HeapCreate
ExitProcess
lstrcpynW
WriteFile
CreateFileW
DeleteFileW
ReadFile
GetFileSize
GetTempFileNameW
CreateMutexA
lstrcpynA
lstrlenA
GetTickCount
WideCharToMultiByte
GetSystemTime
GlobalUnlock
GlobalLock
GlobalSize
GetTempPathW
CreateSemaphoreW
CreateDirectoryW
lstrcatW
lstrcpyW
GetSystemTimeAsFileTime
ReleaseSemaphore
Sleep
GetTimeZoneInformation
SetFilePointer
GlobalAlloc
GlobalFree
GlobalReAlloc
CreateFileA
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapDestroy
HeapReAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCommandLineA
GetModuleHandleA

user32

CharLowerBuffW
CharLowerW
GetDesktopWindow
UnregisterClassA
SetTimer
KillTimer
PostThreadMessageW
PeekMessageW
MsgWaitForMultipleObjects
DispatchMessageW
CharNextW

advapi32

RevertToSelf
LookupPrivilegeValueW
OpenProcessToken
OpenThreadToken
ImpersonateLoggedOnUser
SetNamedSecurityInfoW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegGetKeySecurity
RegOpenKeyW
RegSetKeySecurity
RegQueryValueExW
LookupAccountNameW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExW
RegCreateKeyW
RegSetValueExW
RegCloseKey
ConvertStringSidToSidW
CryptDestroyKey
CryptEncrypt
CryptDecrypt
CryptDeriveKey
AdjustTokenPrivileges

ole32

CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoUnmarshalInterface
CoTaskMemFree
StringFromCLSID
CreateStreamOnHGlobal
GetHGlobalFromStream
CoMarshalInterThreadInterfaceInStream
CoTaskMemRealloc
CoCreateInstance
CoGetInterfaceAndReleaseStream

oleaut32

SafeArrayCreate
SafeArrayGetElement
SafeArrayPutElement
SafeArrayDestroy
VarBstrCmp
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysStringLen
SysFreeString
VarBstrCat
SysAllocStringLen
VariantInit
VariantClear
VariantChangeType
SysAllocString
SystemTimeToVariantTime
SysAllocStringByteLen
VarUI4FromStr

shlwapi

SHCreateStreamOnFileW
PathStripPathW
PathFileExistsW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSCloseServer
WTSOpenServerW

netapi32

NetApiBufferFree
NetWkstaUserEnum

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac544d5aee87758d9037606aa1ee94fc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

wtsapi32

netapi32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 124KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 16KB - Virtual size: 20KB

.rsrc Size: 24KB - Virtual size: 23KB

.reloc Size: 20KB - Virtual size: 18KB

.text
Size: 128KB - Virtual size: 124KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 16KB - Virtual size: 20KB

.rsrc
Size: 24KB - Virtual size: 23KB

.reloc
Size: 20KB - Virtual size: 18KB