EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
ae985b0afff2953a5d423c0b58e3875ef3d6e34b0b6cb4d752ba7b0765947cf5.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ae985b0afff2953a5d423c0b58e3875ef3d6e34b0b6cb4d752ba7b0765947cf5.dll
Resource
win10v2004-20220812-en
General
-
Target
ae985b0afff2953a5d423c0b58e3875ef3d6e34b0b6cb4d752ba7b0765947cf5
-
Size
256KB
-
MD5
f64d6cc2b887f89a68a54d76d8ae5293
-
SHA1
062caed64313a3cca6ad8d01d3721560f071fe6a
-
SHA256
ae985b0afff2953a5d423c0b58e3875ef3d6e34b0b6cb4d752ba7b0765947cf5
-
SHA512
14e25d583bef6546fe978db3ee5e2658c8e8d7b7f270d065b81009a38128f81375c3c075470129573bf13d413f315db1eed866959312ed45078518d18fec691b
-
SSDEEP
6144:T/TBIJyrwflZF0fnq97GEiEC8/8PHkLsatt:T/1Iaw9v0vqQEiEC8/EKtt
Malware Config
Signatures
Files
-
ae985b0afff2953a5d423c0b58e3875ef3d6e34b0b6cb4d752ba7b0765947cf5.dll windows x86
ebe45b25e58b4afb9a31d0a95651f3e0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
xprt5
_XprtAtomicDecrement@4
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?Open@TFile@XPRT@@QAE_NPBGI_N@Z
?IsOpen@TFile@XPRT@@QBE_NXZ
??1TFile@XPRT@@UAE@XZ
??0TFile@XPRT@@QAE@XZ
_XprtMemRealloc@8
xprt_iswdigit
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?Replace@TBstr@XPRT@@QAEHPBG0@Z
xprt_strlen
_XprtInitialize@8
_XprtUninitialize@0
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
deflateInit2_
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
xprt_memset
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
_XprtMemAlloc@4
?Init@TFileInfo@XPRT@@IAEXPBGI_JABVTTime@2@22@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
_XprtMemFree@4
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
?GetInfo@TFile@XPRT@@SA_NPBGAAVTFileInfo@2@@Z
?SetLastWriteTime@TFile@XPRT@@SA_NPBGABVTTime@2@@Z
?CreatePath@TFile@XPRT@@SA_NPBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?Set@TTime@XPRT@@QAEXHHHHHH@Z
inflateInit2_
unzGoToFilePos
unzClose
unzGetGlobalInfo
unzCloseCurrentFile
unzOpen2
xprt_memmove
xprt_strcmp
_XprtAtomicIncrement@4
?Detach@TBstr@XPRT@@QAEPAGXZ
_XprtFreeString@4
deflate
??0TBstr@XPRT@@QAE@PBDPBG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
kSystemEncoding
?AddTrailingSeparator@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?FileNameFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
??0TFileFinder@XPRT@@QAE@XZ
??1TFileFinder@XPRT@@UAE@XZ
?Find@TFileFinder@XPRT@@QAE_NPBGI@Z
?FindNext@TFileFinder@XPRT@@QAE_NI@Z
?GetFileSpec@TFileFinder@XPRT@@QBE?AVTBstr@2@XZ
?GetYear@TTime@XPRT@@QBEHXZ
?GetMonth@TTime@XPRT@@QBEHXZ
?GetDay@TTime@XPRT@@QBEHXZ
?GetHour@TTime@XPRT@@QBEHXZ
?GetMinute@TTime@XPRT@@QBEHXZ
?GetSecond@TTime@XPRT@@QBEHXZ
?GetTm@TTime@XPRT@@QBE_NPAUtm@@@Z
?GetTickCount@TTime@XPRT@@SA?AV12@XZ
deflateEnd
unzOpenCurrentFile3
unzGoToNextFile
xprt_iswalnum
_XprtHashString@4
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
_XprtCompareString@8
_XprtCreateThread@8
_XprtAllocString@4
unzGetCurrentFileInfo
inflateEnd
unzGetFilePos
inflate
kUtf8Encoding
??0TBstr@XPRT@@QAE@PBG@Z
??0TBstr@XPRT@@QAE@GH@Z
??0TBstr@XPRT@@QAE@XZ
??1TBstr@XPRT@@QAE@XZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?IsEmpty@TBstr@XPRT@@QBE_NXZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
crc32
xprt_memcpy
unzReadCurrentFile
kernel32
ExitProcess
SetLastError
GetLastError
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
InterlockedExchange
CompareStringA
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
FreeLibrary
DisableThreadLibraryCalls
user32
MsgWaitForMultipleObjects
KillTimer
SetTimer
TranslateMessage
msvcrt
_initterm
??2@YAPAXI@Z
free
malloc
strcmp
qsort
_snwprintf
_purecall
memcpy
_except_handler3
strlen
fopen
fread
fwrite
ftell
fseek
fclose
__dllonexit
_adjust_fdiv
??3@YAXPAX@Z
_onexit
ole32
CoCreateInstance
CoUninitialize
CoRegisterMessageFilter
CreateBindCtx
CoInitializeEx
oleaut32
VariantClear
VariantCopy
VariantTimeToSystemTime
SysAllocString
VariantChangeType
VariantInit
SystemTimeToVariantTime
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
SafeArrayDestroy
SafeArrayCopy
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
Exports
Exports
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 155KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE