EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
a15ea7dc9b418f68475666ac90161f21c38e91ad40fde0a5c0f35a8f8ac28b52.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a15ea7dc9b418f68475666ac90161f21c38e91ad40fde0a5c0f35a8f8ac28b52.dll
Resource
win10v2004-20221111-en
General
-
Target
a15ea7dc9b418f68475666ac90161f21c38e91ad40fde0a5c0f35a8f8ac28b52
-
Size
291KB
-
MD5
c4040248cac4a079cc4830db1a375760
-
SHA1
a66f5eb591f583c5749d9319f99be5f84a159a88
-
SHA256
a15ea7dc9b418f68475666ac90161f21c38e91ad40fde0a5c0f35a8f8ac28b52
-
SHA512
ee96f47050784e76b05b4a212183d91c27a0d75f5440d07070f1bd905f61364153498d4c94c23aad153de1c9a035aec3a9de9f67dbded63be251cb02335b1fb1
-
SSDEEP
6144:9nZasW1UPlmdDW6fWtnltY2tiS9RS3SBIj+rasGAms+Vb:aV1UPlmDWwWtltY89RS3GenQ4Vb
Malware Config
Signatures
Files
-
a15ea7dc9b418f68475666ac90161f21c38e91ad40fde0a5c0f35a8f8ac28b52.dll windows x86
b8c3110172097a2dba08ab259ec50381
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreate
xprt5
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
??0TPtrArray@XPRT@@QAE@XZ
?Lock@TSpinLock@XPRT@@QAEXXZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
_XprtUninitialize@0
_XprtInitialize@8
xprt_strlen
xprt_memcpy
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
xprt_iswdigit
?GetLength@TBstr@XPRT@@QBEHXZ
??0TBstr@XPRT@@QAE@ABV01@@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
_XprtAtomicDecrement@4
_XprtMemAlloc@4
xprt_memmove
?Detach@TBstr@XPRT@@QAEPAGXZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?IsEmpty@TBstr@XPRT@@QBE_NXZ
??0TBstr@XPRT@@QAE@PBDPBG@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
xprt_strcmp
kSystemEncoding
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
_XprtAtomicIncrement@4
xprt_memset
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
??0TBstr@XPRT@@QAE@PBG@Z
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
??0TBstr@XPRT@@QAE@XZ
??1TBstr@XPRT@@QAE@XZ
_XprtMemFree@4
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtCreateThread@8
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
aolidlemon
ord2
ord3
ord1
msvcrt
memset
strcmp
qsort
_purecall
_snwprintf
_except_handler3
__dllonexit
_onexit
_initterm
_adjust_fdiv
strstr
malloc
free
_strlwr
_stricmp
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
strncmp
_mbstrlen
_mbschr
_mbsstr
_mbscmp
?terminate@@YAXXZ
strncpy
wcsrchr
strcat
printf
fopen
fwrite
fclose
tolower
getenv
time
strrchr
_getpid
_vsnprintf
_beginthreadex
sprintf
_snprintf
__CxxFrameHandler
_EH_prolog
memcpy
strcpy
strlen
atoi
kernel32
VirtualQuery
SuspendThread
GetThreadContext
GlobalAlloc
GlobalFree
GetCurrentProcessId
GetEnvironmentVariableA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetCurrentThread
GetVersion
ReadFile
WriteFile
HeapFree
HeapAlloc
CreateDirectoryA
MoveFileA
GetFileAttributesA
GetProcessHeap
IsBadWritePtr
OpenProcess
GetExitCodeProcess
OutputDebugStringA
Sleep
GetCurrentProcess
GetVersionExA
ResumeThread
WaitForMultipleObjects
TerminateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
CreateSemaphoreA
WaitForSingleObject
CreateEventA
CreateProcessA
SetLastError
GetLastError
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
InterlockedExchange
ExitProcess
OpenEventA
CompareStringA
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
GetSystemPowerStatus
FreeLibrary
GetTickCount
advapi32
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
user32
DispatchMessageA
GetMessageA
PostMessageA
DefWindowProcA
CreateWindowExA
SetTimer
KillTimer
TranslateMessage
MsgWaitForMultipleObjects
DestroyWindow
wsprintfA
UnregisterClassA
RegisterClassA
GetKeyState
ole32
CoCreateInstance
CreateBindCtx
CoUninitialize
CoRegisterMessageFilter
CoInitializeEx
CoTaskMemFree
StringFromCLSID
oleaut32
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayUnlock
SafeArrayCreate
SafeArrayLock
SafeArrayCopy
SafeArrayDestroy
VariantClear
VariantInit
VariantChangeType
SysAllocString
VariantCopy
Exports
Exports
Sections
.text Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 115KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE