bdf15e941db38d5912f46ce44052441148a91abeb6b948955fe24cc2dc4053f5

Sharing

Copy URL Twitter E-mail

General

Target

bdf15e941db38d5912f46ce44052441148a91abeb6b948955fe24cc2dc4053f5
Size

172KB
MD5

4bbc8df15cd7b81224f88ff9f8eae220
SHA1

9727db49dd1b49ef13ae555038a3e12bedb248a2
SHA256

bdf15e941db38d5912f46ce44052441148a91abeb6b948955fe24cc2dc4053f5
SHA512

b9c837025b8ebe91e725b79d981828d72d2c9b643d8ff06b83c22bc3443cf04574f677e259f68ec6cad8410507a579a34f00fe85a21bd24e577de97f8748e3b3
SSDEEP

3072:zsO0cwzu/AJhyD3kQ1tqQiW2Nq8JihG0eOQlDbApRJ6wZOz66n:zsOKz6QEQtHFJihGDxbrwZOz66n

Score

N/A

Malware Config

Signatures

Files

bdf15e941db38d5912f46ce44052441148a91abeb6b948955fe24cc2dc4053f5
.dll regsvr32 windows x86

a34cf9731fec3e83935c07443a65e226

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetModuleBaseNameA
EnumProcessModules
EnumProcesses

advapi32

SetSecurityInfo
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegOpenKeyExA
SetEntriesInAclA
GetSecurityInfo

version

GetFileVersionInfoSizeA
GetFileVersionInfoA

wininet

InternetOpenUrlA
InternetOpenA
InternetReadFile
InternetSetOptionA
InternetCloseHandle
HttpQueryInfoA

shlwapi

StrStrIA
SHGetValueA
SHSetValueA

oleaut32

VariantClear
SysAllocString
SysFreeString
GetErrorInfo

ole32

CoTaskMemAlloc
CoCreateGuid
CoInitialize
CoCreateInstance
CoTaskMemFree

rpcrt4

UuidToStringA

netapi32

Netbios

user32

GetWindowThreadProcessId
EnumChildWindows
EnumWindows
RegisterClassExA
GetClassNameA
ShowWindow
GetMessageA
TranslateMessage
DispatchMessageA
OpenClipboard
CloseClipboard
wsprintfA
DefWindowProcA
SetTimer
KillTimer
SetWindowPos
SystemParametersInfoA
CreateWindowExA

winmm

timeGetTime

msvcrt

??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
??1exception@@UAE@XZ
??2@YAPAXI@Z
ispunct
tolower
printf
isalpha
strchr
strncpy
islower
malloc
isupper
isspace
?what@exception@@UBEPBDXZ
wcslen
wcscmp
isgraph
__mb_cur_max
isalnum
isxdigit
strerror
free
wctomb
strstr
toupper
strtok
fclose
fwrite
fopen
tmpnam
atoi
strtol
__dllonexit
_onexit
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv

kernel32

GetLastError
LocalFree
GetWindowsDirectoryA
HeapFree
GetCurrentThread
DeleteFileA
CreateProcessA
WaitForSingleObject
MoveFileExA
lstrcpyA
CreateFileA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcessId
Sleep
GetThreadTimes
GetTickCount
QueryPerformanceCounter
OpenProcess
CloseHandle
GetLocalTime
lstrcmpA
lstrcmpiA
GetEnvironmentStrings
FreeEnvironmentStringsA
LoadLibraryA
QueryPerformanceFrequency
GetCurrentDirectoryA
GetProcAddress
FreeLibrary
GetSystemInfo
SleepEx
lstrcpynA
HeapAlloc
HeapSize
GetProcessHeap
GetCurrentProcess
GetProcessTimes
GetSystemDirectoryA
GetModuleHandleA
GetModuleFileNameA
GetVersionExA
MultiByteToWideChar
GetFullPathNameA
lstrlenA
SetLastError
FormatMessageA
GetVersion

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a34cf9731fec3e83935c07443a65e226

Headers

File Characteristics

Imports

psapi

advapi32

version

wininet

shlwapi

oleaut32

ole32

rpcrt4

netapi32

user32

winmm

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 103KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 24KB - Virtual size: 24KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 104KB - Virtual size: 103KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 24KB - Virtual size: 24KB

.reloc
Size: 12KB - Virtual size: 8KB