9a757a9841a73b78254eab4e2e7ec88acc6b2e943d787afde34a535dedb917fe

Sharing

Copy URL Twitter E-mail

General

Target

9a757a9841a73b78254eab4e2e7ec88acc6b2e943d787afde34a535dedb917fe
Size

986KB
MD5

f4f9cd82dfb23c77caab1bbc334bd7d0
SHA1

6c8f28f5a11582f424db46d0e4d544b6a3029e05
SHA256

9a757a9841a73b78254eab4e2e7ec88acc6b2e943d787afde34a535dedb917fe
SHA512

21314a504b656774c4ccdec6868d76f1adbfff3abbf354a16f0c234c715670e8404fbf9514d78211e10c2813c01bcb5d146da86c2642530133affb1cfae6b05a
SSDEEP

12288:Chz9W/xPq5z8n9btzYOKqyYMsJuTqwJMSbvtHYFjPxNqpllp3ceQ:Cd9W/I8nfzYOKqyYMsOZYFLqplK

Score

N/A

Malware Config

Signatures

Files

9a757a9841a73b78254eab4e2e7ec88acc6b2e943d787afde34a535dedb917fe
.dll regsvr32 windows x86

26bbf1bc1423fcd645a7f1f52f862b86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExA
GetUserNameA
OpenProcessToken
GetTokenInformation
EqualSid
AllocateAndInitializeSid
FreeSid
RegCreateKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
RegQueryValueExA
RegSetValueExA

gdi32

GetTextExtentPoint32W
SelectObject
GetDeviceCaps
GetObjectType
CreatePalette
GetPaletteEntries
SetEnhMetaFileBits
GetEnhMetaFileBits
CreateBitmap
GetBitmapBits
SetMetaFileBitsEx
GetMetaFileBitsEx
DeleteObject
CreateFontIndirectA
GetObjectA

kernel32

FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
GetCommandLineA
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
GetDriveTypeA
CreateMutexA
GetDriveTypeW
RtlMoveMemory
ReleaseMutex
GetTimeFormatA
GetLocaleInfoA
FileTimeToSystemTime
GetCurrentProcess
LocalAlloc
GetLocalTime
RemoveDirectoryA
FindNextFileA
CompareFileTime
SearchPathA
SystemTimeToFileTime
FormatMessageA
DeleteAtom
GetPrivateProfileIntA
GetPrivateProfileStringA
GetSystemTime
CreateThread
TerminateThread
TerminateProcess
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
ExitThread
GetSystemTimeAsFileTime
CopyFileA
GetSystemDirectoryA
GetUserDefaultLCID
GetSystemDefaultLCID
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
FindFirstFileA
GetFullPathNameA
SetLastError
CompareStringA
GetShortPathNameA
GetThreadLocale
lstrcatA
GetFileAttributesA
GetEnvironmentStrings
WriteFile
DeleteFileA
GetTempPathA
GlobalLock
GlobalSize
GlobalUnlock
CreateFileA
GetFileSize
GetFileTime
SetFilePointer
ReadFile
FindClose
QueryDosDeviceW
GetACP
FindAtomA
AddAtomA
CloseHandle
GetLastError
GetCurrentProcessId
LocalFree
GlobalAlloc
GlobalFree
LoadLibraryExA
GetProcessHeap
TlsAlloc
TlsFree
TlsGetValue
HeapAlloc
HeapFree
GetCurrentThreadId
lstrcpyA
lstrlenA
GetModuleFileNameA
lstrcmpA
lstrcmpiA
lstrcpynA
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
GetWindowsDirectoryA
GetVersionExA
GetSystemInfo
TlsSetValue
GetModuleHandleA
GetProcAddress
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
IsBadWritePtr
IsBadReadPtr
lstrlenW
LeaveCriticalSection
EnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
HeapSize
RtlUnwind
InterlockedExchange
VirtualQuery
InitializeCriticalSectionAndSpinCount
lstrcpynW
LoadLibraryW
UnhandledExceptionFilter
GetOEMCP
GetCPInfo
VirtualAlloc
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
FlushFileBuffers
VirtualProtect
SetStdHandle
QueryPerformanceCounter
GetTickCount
SetUnhandledExceptionFilter
CreateDirectoryA
RaiseException

ole32

CLSIDFromProgID
HWND_UserMarshal
CoFreeUnusedLibraries
StringFromGUID2
HWND_UserSize
CLSIDFromString
HWND_UserUnmarshal
HWND_UserFree
CoRegisterMessageFilter
StgOpenStorage
CoUnmarshalInterface
CoMarshalInterface
CoGetMarshalSizeMax
OleGetAutoConvert
ReleaseStgMedium
MonikerRelativePathTo
CreateGenericComposite
CoCreateInstance
CoGetClassObject
StringFromCLSID
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
GetClassFile
CoTaskMemFree
CoTaskMemAlloc
CreateBindCtx
MkParseDisplayName

rpcrt4

NdrCStdStubBuffer_Release
RpcRaiseException
NdrClientCall2
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
NdrDllRegisterProxy

shlwapi

PathRemoveFileSpecW
PathIsUNCServerShareW
SHStrDupW
StrTrimW
ord216
UrlCanonicalizeA
ord218
ord97
SHRegGetBoolUSValueA
StrCpyW
StrCmpNIW
ord215
StrCpyNW
ord431
ord378
ord107
ord395
SHRegGetValueW
ord125
ord158
PathFindFileNameW
ord80
wnsprintfA
PathCombineA
ord24
ord507
ord57
ord508
ord361
SHRegQueryInfoUSKeyW
SHRegEnumUSValueW
SHRegEnumUSKeyW
SHRegQueryUSValueW
SHRegOpenUSKeyW
SHRegCreateUSKeyW
SHRegCloseUSKey
ord457
PathIsPrefixW
ord309
ord472
ord219
SHRegGetUSValueW
ord83
UrlIsW
PathIsUNCW
PathStripToRootW
SHRegSetUSValueW
PathIsRootW
ord446
StrRChrW
ord398
ord143
StrDupW
ord29
SHRegDeleteEmptyUSKeyW
SHRegDeleteUSValueW
SHRegWriteUSValueW
ord335
ord558
ord120
ord130
ord559
StrCmpNA
PathFindExtensionA
ord441
StrCatBuffW
SHQueryValueExA
StrCatBuffA
PathFileExistsA
StrToIntW
PathRenameExtensionA
PathUndecorateA
ord435
ord52
ord75
ord65
PathIsUNCServerA
ord76
UrlGetPartA
StrToIntA
UrlCombineA
UrlGetLocationA
PathCreateFromUrlA
StrDupA
UrlUnescapeA
ord1
StrStrA
ord154
StrStrW
ord155
ord153
ord151
PathFindExtensionW
StrCmpIW
wnsprintfW
ord564
StrChrW
StrCmpNIA
ord124
ord128
ord59
ord220
ord138
UrlCanonicalizeW
UrlUnescapeW
UrlEscapeW
PathCreateFromUrlW
UrlCreateFromPathW
UrlGetLocationW
StrChrA
UrlCompareW
UrlCombineW
StrCmpW
UrlGetPartW
SHRegGetUSValueA
ord2
ord436
StrNCatA
StrCatW
StrStrIA
SHGetValueW

user32

RegisterClipboardFormatA
LoadStringA
wsprintfA
CharNextA
CharPrevA
DestroyWindow
PostMessageA
SetWindowLongA
DefWindowProcA
SendMessageA
GetWindowLongA
SetForegroundWindow
GetDlgItem
EndDialog
UnregisterClassA
RegisterClassA
CreateWindowExA
GetClipboardFormatNameA
PostQuitMessage
PeekMessageA
DispatchMessageA
TranslateMessage
GetQueueStatus
MsgWaitForMultipleObjects
FindWindowA
DialogBoxParamA
MapWindowPoints
SetWindowTextW
GetClientRect
GetWindowDC
SendMessageW
DrawTextExW
CharLowerA
IsDlgButtonChecked
CheckDlgButton
SendDlgItemMessageA
SetFocus
EnableWindow
GetWindowRect
GetDC
ReleaseDC
SetWindowPos
ShowWindow
MessageBoxW
GetActiveWindow
GetAsyncKeyState
CharUpperBuffA
SetTimer
KillTimer
OemToCharBuffA
SendNotifyMessageA
GetParent
GetLastActivePopup
SetDlgItemTextA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

AsyncGetClassBits
AsyncInstallDistributionUnit
BindAsyncMoniker
CDLGetLongPathNameA
CDLGetLongPathNameW
CoGetClassObjectFromURL
CoInstall
CoInternetCombineUrl
CoInternetCompareUrl
CoInternetCreateSecurityManager
CoInternetCreateZoneManager
CoInternetFeatureSettingsChanged
CoInternetGetProtocolFlags
CoInternetGetSecurityUrl
CoInternetGetSession
CoInternetIsFeatureEnabled
CoInternetIsFeatureEnabledForUrl
CoInternetIsFeatureZoneElevationEnabled
CoInternetParseUrl
CoInternetQueryInfo
CoInternetSetFeatureEnabled
CompareSecurityIds
CompatFlagsFromClsid
CopyBindInfo
CopyStgMedium
CreateAsyncBindCtx
CreateAsyncBindCtxEx
CreateFormatEnumerator
CreateURLMoniker
CreateURLMonikerEx
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Extract
FaultInIEFeature
FindMediaType
FindMediaTypeClass
FindMimeFromData
GetClassFileOrMime
GetClassURL
GetComponentIDFromCLSSPEC
GetMarkOfTheWeb
GetSoftwareUpdateInfo
HlinkGoBack
HlinkGoForward
HlinkNavigateMoniker
HlinkNavigateString
HlinkSimpleNavigateToMoniker
HlinkSimpleNavigateToString
InstallFlash
IsAsyncMoniker
IsJITInProgress
IsLoggingEnabledA
IsLoggingEnabledW
IsValidURL
MkParseDisplayNameEx
ObtainUserAgentString
PrivateCoInstall
RegisterBindStatusCallback
RegisterFormatEnumerator
RegisterMediaTypeClass
RegisterMediaTypes
ReleaseBindInfo
RevokeBindStatusCallback
RevokeFormatEnumerator
SetSoftwareUpdateAdvertisementState
URLDownloadA
URLDownloadToCacheFileA
URLDownloadToCacheFileW
URLDownloadToFileA
URLDownloadToFileW
URLDownloadW
URLOpenBlockingStreamA
URLOpenBlockingStreamW
URLOpenPullStreamA
URLOpenPullStreamW
URLOpenStreamA
URLOpenStreamW
UrlMkBuildVersion
UrlMkGetSessionOption
UrlMkSetSessionOption
WriteHitLogging
ZonesReInit

Sections

.text
Size: 445KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 411KB - Virtual size: 443KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26bbf1bc1423fcd645a7f1f52f862b86

Headers

File Characteristics

Imports

advapi32

gdi32

kernel32

ole32

rpcrt4

shlwapi

user32

version

Exports

Exports

Sections

.text Size: 445KB - Virtual size: 445KB

.orpc Size: 4KB - Virtual size: 3KB

.data Size: 411KB - Virtual size: 443KB

.rsrc Size: 105KB - Virtual size: 104KB

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 445KB - Virtual size: 445KB

.orpc
Size: 4KB - Virtual size: 3KB

.data
Size: 411KB - Virtual size: 443KB

.rsrc
Size: 105KB - Virtual size: 104KB

.reloc
Size: 19KB - Virtual size: 18KB