4fdab5c462f3ddfd0add8c138d619d107b98de93ec7fe80f136a5c1de571e00d

Sharing

Copy URL Twitter E-mail

General

Target

4fdab5c462f3ddfd0add8c138d619d107b98de93ec7fe80f136a5c1de571e00d
Size

52KB
MD5

6e4d0038f60d5afc5b5609cffe2edac0
SHA1

1857a19fc8d6fceaf11604e30f24aacf3c002c10
SHA256

4fdab5c462f3ddfd0add8c138d619d107b98de93ec7fe80f136a5c1de571e00d
SHA512

79872e8d329650bb7b31a429b0156eebfe5e2bf15a813cbc8a3dbcb8325a10d4cb1ad0bbe8dc6ff6e57334319316fcd5139eb8f9a81200548bb4b777cfccbd6d
SSDEEP

768:L0N4olrTuTBQh+d+CNDC//QrZ6DQh/7829qc5rgDpJnRw5iqS4XDzIjfnEV:L0l6TbPNGXC6cl9qcpgD3Rw5I4QjfEV

Score

N/A

Malware Config

Signatures

Files

4fdab5c462f3ddfd0add8c138d619d107b98de93ec7fe80f136a5c1de571e00d
.dll regsvr32 windows x86

95c799f6f9e21966c20af20545a234ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
CreateThread
CreateDirectoryA
FindNextFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetSystemDirectoryA
lstrlenA
GetShortPathNameA
GetModuleHandleA
GetCurrentProcessId
GetCommandLineW
MoveFileA
ExitProcess
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
DeleteFileA
LoadLibraryA
FreeLibrary
lstrlenW
WideCharToMultiByte
Process32First
Process32Next
CloseHandle
GetModuleFileNameA
LocalFree
EnterCriticalSection
LeaveCriticalSection
WritePrivateProfileStringA
Sleep
MultiByteToWideChar

advapi32

DeleteService
ControlService
CloseServiceHandle
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
OpenSCManagerA
OpenServiceA

shell32

CommandLineToArgvW
SHGetSpecialFolderPathA

ole32

CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString

msvcrt

_wcslwr
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
memcmp
_purecall
memcpy
_access
strcat
fopen
fseek
ftell
fread
sprintf
strncpy
strchr
memset
strncmp
strlen
strcpy
??3@YAXPAX@Z
wcsstr
_stricmp
strcmp
strrchr
strstr
??2@YAPAXI@Z
atoi
fclose

shlwapi

SHDeleteKeyA
SHSetValueA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

cdata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

95c799f6f9e21966c20af20545a234ff

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 25KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 3KB

cdata Size: 4KB - Virtual size: 4B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 3KB

cdata
Size: 4KB - Virtual size: 4B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 1KB