EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
b4d40014968c183b604dcf157c9f7bab0d855facf2a19aa6af951cd45f9172ae.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b4d40014968c183b604dcf157c9f7bab0d855facf2a19aa6af951cd45f9172ae.dll
Resource
win10v2004-20221111-en
General
-
Target
b4d40014968c183b604dcf157c9f7bab0d855facf2a19aa6af951cd45f9172ae
-
Size
333KB
-
MD5
8587ccb80a17ea765eaaa52a51be4400
-
SHA1
d9a28758e02ddf63ab13a7c9c879919c6eca15af
-
SHA256
b4d40014968c183b604dcf157c9f7bab0d855facf2a19aa6af951cd45f9172ae
-
SHA512
60d03142b07a422ce512a7fd0e4e006e2c86a14df1776cea253fb90156f65d55b01f5377ead20921230ba62e819e9def09d9b796583d86c9db9d0f3199ccea19
-
SSDEEP
6144:jSmVDZBnrfr5Dh1EfZvkeAryWEQznD6WTnJo+PW2Bz1T5pcMFy:7ZBnTr5DLEueAry9U6WTJvlBJXq
Malware Config
Signatures
Files
-
b4d40014968c183b604dcf157c9f7bab0d855facf2a19aa6af951cd45f9172ae.dll windows x86
0ff4809bd50d03f27c439a4139848a20
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreate
xprt5
_XprtInitialize@8
xprt_strlen
xprt_memcpy
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?Add@TPtrArray@XPRT@@QAEHPAX@Z
xprt_iswdigit
?GetLength@TBstr@XPRT@@QBEHXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
_XprtUninitialize@0
?GetAt@TBstr@XPRT@@QBEGH@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TBstr@XPRT@@QAE@ABV01@@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
_XprtAtomicDecrement@4
_XprtMemAlloc@4
xprt_memmove
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
?Compare@TBstr@XPRT@@QBEHPBG@Z
xprt_strcmp
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
_XprtAtomicIncrement@4
xprt_memset
XprtTrace
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBDPBG@Z
?Format@TBstr@XPRT@@QAAXPBGZZ
kSystemEncoding
??0TBstr@XPRT@@QAE@PBG@Z
??0TBstr@XPRT@@QAE@XZ
??1TBstr@XPRT@@QAE@XZ
_XprtMemFree@4
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
aolidlemon
ord2
ord3
ord1
msvcrt
strncpy
memset
strcmp
qsort
_snwprintf
_purecall
_except_handler3
__dllonexit
_onexit
_initterm
_adjust_fdiv
strstr
free
_stricmp
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
strncmp
_mbstrlen
_mbschr
_mbsstr
_mbscmp
?terminate@@YAXXZ
_strlwr
malloc
wcsrchr
strcat
printf
fopen
fwrite
fclose
tolower
getenv
time
strrchr
_getpid
_vsnprintf
_beginthreadex
sprintf
_snprintf
atoi
__CxxFrameHandler
memcpy
strcpy
strlen
kernel32
VirtualQuery
SuspendThread
GetThreadContext
GlobalAlloc
GlobalFree
GetCurrentProcessId
GetEnvironmentVariableA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetCurrentThread
GetVersion
ReadFile
WriteFile
HeapFree
HeapAlloc
CreateDirectoryA
MoveFileA
GetFileAttributesA
OpenEventA
IsBadWritePtr
OpenProcess
GetExitCodeProcess
OutputDebugStringA
Sleep
GetCurrentProcess
GetVersionExA
ResumeThread
WaitForMultipleObjects
TerminateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
CreateSemaphoreA
WaitForSingleObject
CreateEventA
CreateProcessA
SetLastError
GetLastError
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
InterlockedExchange
CompareStringA
GetCurrentThreadId
ExitProcess
GetProcessHeap
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
GetSystemPowerStatus
FreeLibrary
GetTickCount
advapi32
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
user32
DispatchMessageA
GetMessageA
PostMessageA
DefWindowProcA
CreateWindowExA
SetTimer
KillTimer
TranslateMessage
MsgWaitForMultipleObjects
DestroyWindow
wsprintfA
UnregisterClassA
RegisterClassA
GetKeyState
ole32
CoCreateInstance
CreateBindCtx
CoUninitialize
CoRegisterMessageFilter
CoInitializeEx
CoTaskMemFree
StringFromCLSID
oleaut32
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayUnlock
SafeArrayCreate
SafeArrayLock
SafeArrayCopy
SafeArrayDestroy
VariantClear
VariantChangeType
SysAllocString
VariantCopy
VariantInit
Exports
Exports
Sections
.text Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE