d4a4b677241f5d485eb6b3e0549798cb7b34e24672e881836d519b5e78868fa1

Sharing

Copy URL Twitter E-mail

General

Target

d4a4b677241f5d485eb6b3e0549798cb7b34e24672e881836d519b5e78868fa1
Size

2.9MB
MD5

26c182e025171cdf19987e64162f70ab
SHA1

e15d5664c91d67833967be6ce404939ee96c7a99
SHA256

d4a4b677241f5d485eb6b3e0549798cb7b34e24672e881836d519b5e78868fa1
SHA512

3b3289a3ee70433d70297d82f643c968819f367123c7ecaa59bb78ec138988185b606839d328326960b51e26c8cad25127ff6d2393960684e92553347844fb57
SSDEEP

49152:XaN/xCESzSymYgZgoS+CF6Gd7kyea3lozF3q0pTJdjRFSjr62sA7zsD:XaNJCE4cYgZBSTF6GdIyDo9Bb

Score

N/A

Malware Config

Signatures

Files

d4a4b677241f5d485eb6b3e0549798cb7b34e24672e881836d519b5e78868fa1
.dll regsvr32 windows x86

e0b6f158aeeaa7babafcc69be7376165

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptAcquireContextA
RegQueryValueExA
RegOpenKeyA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegFlushKey
CryptReleaseContext
RegCloseKey
CryptGenRandom

gdi32

GetEnhMetaFileW
CreatePolygonRgn
PtInRegion
GetBkColor
GetGlyphOutlineW
GetEnhMetaFileA
CreateEnhMetaFileW
SetDIBitsToDevice
SetMetaFileBitsEx
SetEnhMetaFileBits
GetEnhMetaFilePaletteEntries
DeleteObject
OffsetRgn
GetViewportOrgEx
SetViewportOrgEx
ExtEscape
GetDeviceCaps
EqualRgn
GetRgnBox
CreateRectRgnIndirect
RestoreDC
SaveDC
SelectPalette
GetStockObject
SelectClipRgn
GetObjectType
CombineRgn
RealizePalette
CreatePalette
GetRegionData
GetClipBox
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
CreateSolidBrush
SelectObject
GdiFlush
CreateRectRgn
CreatePen
UnrealizeObject
DeleteMetaFile
GetTextCharset
EnumFontsW
SetBkColor
SetTextColor
ExtTextOutW
CloseMetaFile
SetWindowExtEx
SetWindowOrgEx
SetMapMode
CreateMetaFileA
DeleteEnhMetaFile
CloseEnhMetaFile
CreateEnhMetaFileA
LPtoDP
GetWindowExtEx
GetWindowOrgEx
PlayMetaFile
SetViewportExtEx
BitBlt
GetDIBits
GetPaletteEntries
SetStretchBltMode
CreatePatternBrush
GetClipRgn
CreateBitmap
Ellipse
CreateEllipticRgn
GetCurrentObject
GetTextAlign
SetTextAlign
GetEnhMetaFileHeader
OffsetViewportOrgEx
CreateHatchBrush
PatBlt
ExtCreateRegion
Polygon
ExtSelectClipRgn
MoveToEx
LineTo
Polyline
Rectangle
GetCurrentPositionEx
MaskBlt
SetDIBits
StretchBlt
StretchDIBits
ExcludeClipRect
IntersectClipRect
SetBrushOrgEx
PlayEnhMetaFile
SetBkMode
SetROP2
ExtTextOutA
Escape
GetCharWidthA
GetNearestColor
GetTextColor
GetCharABCWidthsA
GetCharABCWidthsW
GetCharWidthW
GetTextExtentPointW
TranslateCharsetInfo
GetGlyphOutlineA
SetDIBColorTable
GetTextCharsetInfo
EnumObjects
GetNearestPaletteIndex
CreateDIBSection
GetDIBColorTable

kernel32

CreateFiber
TerminateThread
RaiseException
lstrcatW
GetLocalTime
lstrcpyW
InitializeCriticalSectionAndSpinCount
ConvertThreadToFiber
LoadLibraryA
lstrcpyA
lstrlenA
lstrlenW
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
TlsGetValue
LocalFree
LocalAlloc
GetProcAddress
GetModuleHandleA
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
CloseHandle
UnmapViewOfFile
TlsFree
MapViewOfFile
OpenFileMappingA
GetCurrentProcessId
TlsAlloc
TlsSetValue
MulDiv
GetTickCount
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetPrivateProfileStringA
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryExA
FreeLibrary
FindAtomW
GetModuleFileNameA
GetProfileIntA
WriteFile
SetFilePointer
ReadFile
GlobalSize
GetFileSize
GetSystemInfo
GetSystemDefaultLCID
GetUserDefaultLCID
GetCPInfo
GetLastError
InterlockedExchange
SystemTimeToFileTime
GetSystemTime
FindClose
IsDBCSLeadByteEx
GetFileType
GetVersion
SetEvent
WaitForSingleObject
CreateThread
CreateEventA
GetCommandLineW
GlobalDeleteAtom
GetProcessHeap
HeapFree
VirtualFree
HeapAlloc
VirtualAlloc
GetVersionExA
GetModuleHandleW
SearchPathA
GetFullPathNameA
SwitchToFiber
GetLocaleInfoW
IsValidCodePage
GetACP
FileTimeToSystemTime
FileTimeToLocalFileTime
HeapSize
HeapReAlloc
FreeResource
SizeofResource
LockResource
LoadResource
SetErrorMode
GetUserDefaultLangID
VirtualQuery
SetEndOfFile
_lread
Sleep
GlobalFlags
GetLocaleInfoA
FlushViewOfFile
CreateFileMappingA
CreateFileA
CreateDirectoryA
ReleaseMutex
CreateMutexA
LCMapStringA
GetExitCodeThread
DeleteFiber

msls31

ord20
ord39
ord53
ord10
ord7
ord6
ord15
ord19
ord17
ord55
ord41
ord27
ord68
ord11
ord12
ord13
ord14
ord79
ord75
ord52
ord50
ord51
ord49
ord42
ord43
ord73
ord72
ord48
ord3
ord5
ord1
ord62
ord63
ord66
ord61
ord71
ord2
ord44
ord16
ord40

msvcrt

bsearch
_ftol
qsort
wcsstr
_ultow
wcstol
wcschr
_wtol
wcsncpy
_except_handler3
_purecall
wcslen
wcscat
wcsrchr
__dllonexit
free
_initterm
malloc
_adjust_fdiv
wcscpy
_wcsicmp
_ultoa
wcstok
wcsncat
strrchr
strtol
_wcsrev
wcsspn
wcstoul
_ltow
atoi
_itow
memmove
_onexit
_vsnprintf

ole32

OleSaveToStream
MkParseDisplayName
CoGetClassObject
OleRun
StgOpenStorage
CoGetTreatAsClass
IIDFromString
OleCreateFromData
OleRegGetUserType
CoFileTimeNow
DoDragDrop
OleQueryCreateFromData
OleQueryLinkFromData
StringFromGUID2
ProgIDFromCLSID
OleIsCurrentClipboard
OleSetClipboard
OleFlushClipboard
CoCreateGuid
GetHGlobalFromStream
CoRegisterClassObject
CoRevokeClassObject
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CreateDataCache
StgCreateDocfile
WriteClassStg
WriteFmtUserTypeStg
CreateDataAdviseHolder
WriteClassStm
OleTranslateAccelerator
RevokeDragDrop
OleGetIconOfClass
CreateOleAdviseHolder
RegisterDragDrop
OleInitialize
OleUninitialize
CreateBindCtx
OleGetClipboard
CreateStreamOnHGlobal
CoTaskMemAlloc
ReleaseStgMedium
StringFromCLSID
CoUnmarshalInterface
CoMarshalInterface
CoGetMarshalSizeMax
CoFreeUnusedLibraries
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance

psapi

GetModuleBaseNameW

shdocvw

ord233
ord218
ord167
ord231
ord234
DoFileDownload

shlwapi

ord143
ord104
ord93
ord337
ord48
ord28
ord63
ord389
ord403
ord53
ord55
ord47
ord335
ord56
ord102
ord106
ord98
ord425
ord340
ord564
ord558
ord397
ord149
ord65
ord313
ord135
ord74
ord138
ord75
ord2
ord50
ord112
ord79
ord60
ord127
ord163
ord76
ord145
ord136
ord148
ord100
ord46
ord38
ord122
ord376
ord95
ord57
ord90
ord89
ord52
ord42
ord105
ord435
ord231
ord132
ord71
ord133
ord59
ord124
ord141
ord94
ord398
ord154
ord107
ord378
ord117
ord436
ord309
ord176
ord361
ord306
ord123
ord134
ord142
ord87
ord140
ord83
ord80
ord118
ord351
ord352
ord167
ord418
ord125
ord128
ord81
PathParseIconLocationW
SHQueryValueExW
StrRChrW
wnsprintfW
wnsprintfA
PathCombineW
PathFileExistsA
SHCreateShellPalette
SHGetInverseCMAP
HashData
StrCmpNIW
AssocQueryStringW
ord29
PathFindExtensionW
PathUnquoteSpacesW
StrToIntW
UrlApplySchemeW
StrTrimW
PathCanonicalizeW
PathGetCharTypeW
UrlCombineW
UrlIsOpaqueW
StrCmpW
UrlUnescapeW
UrlGetPartW
ord39
AssocQueryKeyW
PathIsUNCW
PathGetDriveNumberW
StrCmpNW
StrStrIW
PathStripPathW
UrlCompareW
PathUndecorateW
ord16
PathFileExistsW
StrCpyW
StrCatW
SHRegGetUSValueW
UrlGetLocationW
UrlCreateFromPathW
UrlIsW
SHRegGetBoolUSValueW
StrStrW
StrChrW
ord15
ord78
ord36
ord37
ord217
ord13
ord402
ord54
ord40
ord97
ord379
ord82
PathIsRelativeW
SHRegGetValueW
UrlCanonicalizeW
StrCpyNW
SHEnumValueW
StrCmpIW
ord116
ord426
ord27
ord92
ord110
ord350
ord159
ord61
ord69
ord84
ord68
ord101
ord427
ord77
ord51
ord43
ord315
ord314
ord147
ord66
ord111
ord489
ord480
ord413
ord164
ord281
ord25
ord34
ord33
ord45
ord30
ord130
ord120
ord121
ord318
ord131
ord67
ord490
ord370
ord103
PathFindFileNameW
PathRemoveArgsW
PathCreateFromUrlW
ord158
ord156
SHGetValueW
StrStrIA
SHSetValueW

user32

GetIconInfo
GetActiveWindow
AppendMenuA
CreateWindowExA
TrackMouseEvent
InSendMessage
MessageBoxA
SubtractRect
MsgWaitForMultipleObjects
GetComboBoxInfo
SendMessageA
CreatePopupMenu
CheckMenuRadioItem
SetRectEmpty
CreateCaret
SetCaretPos
DrawTextA
DrawFrameControl
DrawFocusRect
FrameRect
GetSysColorBrush
SetRect
MessageBeep
DestroyCursor
LoadCursorA
GetCursor
ShowCursor
RegisterClipboardFormatA
GetSysColor
HideCaret
ShowCaret
GetKeyboardLayoutList
CharNextW
CharNextA
SystemParametersInfoA
GetWindowPlacement
GetSystemMetrics
IsWindowVisible
GetLastActivePopup
GetAncestor
GetSystemMenu
RemoveMenu
BringWindowToTop
MoveWindow
EnableWindow
PostQuitMessage
ChildWindowFromPointEx
LockWindowUpdate
ValidateRgn
EqualRect
GetWindowDC
GetUpdateRect
FillRect
SetCapture
GetDC
InflateRect
GetWindowThreadProcessId
GetDlgItem
DestroyCaret
IsWindowUnicode
GetCapture
ReleaseCapture
GetSubMenu
SetCursor
GetMenuState
CopyRect
OffsetRect
SetParent
IsIconic
ShowWindow
SetForegroundWindow
IsChild
GetAsyncKeyState
WindowFromPoint
GetMenuItemCount
GetMenuItemID
CheckMenuItem
EnableMenuItem
WindowFromDC
InvalidateRgn
MapWindowPoints
BeginPaint
EndPaint
RedrawWindow
IsRectEmpty
PtInRect
GetMessageTime
GetMessagePos
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyExW
ToAsciiEx
GetForegroundWindow
TranslateMessage
KillTimer
SetFocus
EndDialog
ClientToScreen
GetKeyState
GetCursorPos
GetClientRect
GetDesktopWindow
EnumChildWindows
GetFocus
SetTimer
wvsprintfW
GetParent
SetActiveWindow
GetDCEx
GetUpdateRgn
ValidateRect
ScrollDC
ReleaseDC
SetWindowPos
BeginDeferWindowPos
IsWindow
DeferWindowPos
EndDeferWindowPos
GetWindowRgn
SetWindowRgn
InvalidateRect
GetWindowRect
ScreenToClient
CallNextHookEx
IntersectRect
UnionRect
wsprintfA
GetWindow
DestroyWindow
UnhookWindowsHookEx
UpdateWindow
DrawEdge

Exports

Exports

CreateHTMLPropertyPage
DllCanUnloadNow
DllEnumClassObjects
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
MatchExactGetIDsOfNames
PrintHTML
RNIGetCompatibleVersion
RunHTMLApplication
ShowHTMLDialog
ShowHTMLDialogEx
ShowModalDialog
ShowModelessHTMLDialog
com_ms_osp_ospmrshl_classInit
com_ms_osp_ospmrshl_copyToExternal
com_ms_osp_ospmrshl_releaseByValExternal
com_ms_osp_ospmrshl_toJava

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 126KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.boxer
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e0b6f158aeeaa7babafcc69be7376165

Headers

File Characteristics

Imports

advapi32

gdi32

kernel32

msls31

msvcrt

ole32

psapi

shdocvw

shlwapi

user32

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.data Size: 39KB - Virtual size: 52KB

.rsrc Size: 125KB - Virtual size: 128KB

.reloc Size: 126KB - Virtual size: 128KB

.boxer Size: 1KB - Virtual size: 4KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 39KB - Virtual size: 52KB

.rsrc
Size: 125KB - Virtual size: 128KB

.reloc
Size: 126KB - Virtual size: 128KB

.boxer
Size: 1KB - Virtual size: 4KB