73190000[.]clr[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

73190000.clr.dll
Size

8.3MB
MD5

80bee57a642872d0964d039a92fcc7b7
SHA1

656f66c9d1b7dde234d3b5baa8cf53b14f66ca3c
SHA256

5e2966fe9ffa35a8663f7bc50572f884d5ccab987bbdea77fac78b233db4cd88
SHA512

38a0d0a04a295b4990c879c55bca9341f2d2b001ce0aded7a9ef9fa5027d3bbe21798633ed458af1e8a3cc90d9085c82733e2011a4305850b6568e1dd06a89c1
SSDEEP

196608:qYh0AS2Nm1uaiAQ5sKGKjltMC95nBHDDxJZ1S5EIwdhpJss/GPYu1S+0kClbcvp5:70n2N2u7AQ5sKGKjltMC95nBHDDxJZ1C

Score

N/A

Malware Config

Signatures

Files

73190000.clr.dll
.dll windows x86

064c64c634f520a79afc8922cea4cb43

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernelbase

QuirkIsEnabled3
SetSystemFileCacheSize

kernel32

FlsAlloc
FlsSetValue
FindNLSStringEx
ReleaseSRWLockExclusive
GetLocaleInfoEx
LocaleNameToLCID
LCIDToLocaleName
GetUserDefaultLocaleName
FlsFree
LCMapStringW
IsDBCSLeadByte
GetACP
GetCPInfo
SetConsoleTitleW
AllocConsole
FreeConsole
GetTempFileNameW
GetTempPathW
MoveFileExW
MoveFileW
FlushFileBuffers
CompareFileTime
GetFileTime
QueryInformationJobObject
IsProcessInJob
VirtualUnlock
OutputDebugStringA
DeleteFileW
SetThreadAffinityMask
SetThreadGroupAffinity
GetWriteWatch
ResetWriteWatch
SetThreadIdealProcessor
ReadProcessMemory
GetUserDefaultLCID
GetSystemDefaultLCID
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
GetSystemTimeAsFileTime
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
CreateMemoryResourceNotification
GetDriveTypeW
InterlockedFlushSList
InitializeSListHead
InterlockedPopEntrySList
PeekNamedPipe
GetProcessTimes
VerifyVersionInfoW
IsProcessorFeaturePresent
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
TerminateProcess
UnhandledExceptionFilter
SetThreadContext
GetThreadContext
ResetEvent
GetFileAttributesExW
ReadFile
SetFilePointer
GetThreadTimes
SuspendThread
Sleep
IsThreadAFiber
FindFirstFileW
FindClose
GetSystemDirectoryW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
GetWindowsDirectoryW
ReleaseActCtx
IsWow64Process
SizeofResource
LockResource
FindResourceExW
LoadResource
FindNextFileW
GetEnvironmentVariableA
CreateProcessW
QueryActCtxW
GetNativeSystemInfo
LoadLibraryW
EncodePointer
DecodePointer
EnumTimeFormatsW
CompareStringW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
EnumCalendarInfoExW
GetLocaleInfoW
GetCalendarInfoW
GetDateFormatW
SetUnhandledExceptionFilter
LoadLibraryA
MapViewOfFile
HeapReAlloc
LocalAlloc
LoadLibraryExA
SetFileAttributesW
CopyFileW
RemoveDirectoryW
GetFileSizeEx
SetEndOfFile
GetSystemDirectoryA
CreateFileA
SetFileTime
WritePrivateProfileStringW
DeviceIoControl
FindResourceW
GetLocalTime
GetVolumeInformationW
LocalFileTimeToFileTime
DosDateTimeToFileTime
SystemTimeToFileTime
lstrlen
GetDiskFreeSpaceA
GetWindowsDirectoryA
GetTimeFormatW
GetSystemTime
FlushViewOfFile
IsDBCSLeadByteEx
GetStringTypeW
CreateHardLinkW
SetPriorityClass
SetFilePointerEx
ExitThread
OpenFileMappingW
SearchPathW
GetTimeZoneInformation
GetNLSVersionEx
IsValidLocale
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
GetConsoleTitleW
InterlockedExchange
GetVersionExW
MultiByteToWideChar
FormatMessageW
ExitProcess
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
GetPrivateProfileIntW
GetLastError
GetTickCount
SetEvent
GetCurrentProcessorNumber
QueueUserAPC
CloseHandle
WaitForSingleObject
GlobalMemoryStatusEx
CreateIoCompletionPort
GetProcAddress
SetLastError
GetThreadLocale
QueryPerformanceCounter
QueryPerformanceFrequency
PostQueuedCompletionStatus
FlushProcessWriteBuffers
CreateThread
ResumeThread
SleepEx
WaitForMultipleObjectsEx
GetQueuedCompletionStatus
GetCurrentThread
OutputDebugStringW
DebugBreak
GetModuleHandleW
GetCurrentProcess
ReleaseMutex
ReleaseSemaphore
CreateMutexW
CreateEventW
CreateSemaphoreW
LocalFree
GetCurrentProcessId
OpenProcess
ProcessIdToSessionId
GetCurrentThreadId
SetConsoleCtrlHandler
GetTickCount64
GetCommandLineW
GetCurrentDirectoryW
lstrlenW
GetFullPathNameW
GetShortPathNameW
GetLongPathNameW
GetSystemInfo
TlsGetValue
GetUserDefaultLangID
GetEnvironmentVariableW
SetEnvironmentVariableW
GetProcessId
GetOverlappedResult
CancelIo
GetProcessHeap
HeapFree
InterlockedPushEntrySList
WriteFile
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
GetFileInformationByHandle
GetFileAttributesW
CreateDirectoryW
GetProcessAffinityMask
SetThreadLocale
MapViewOfFileEx
VirtualQuery
UnmapViewOfFile
SetErrorMode
FreeLibrary
FreeLibraryAndExitThread
IsDebuggerPresent
RaiseException
GetStringTypeExW
CreateFileMappingW
GetFileSize
TlsSetValue
GetModuleHandleA
TlsAlloc
TlsFree
HeapAlloc
FlushInstructionCache
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
WaitNamedPipeW
SetNamedPipeHandleState
OpenEventW
TransactNamedPipe
VirtualAlloc
VirtualFree
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
SwitchToThread
GetEnvironmentStringsW
FreeEnvironmentStringsW
DuplicateHandle
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
SignalObjectAndWait
SetThreadStackGuarantee

ntdll

NtSetSystemInformation
RtlEnterCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
vDbgPrintExWithPrefix
NtYieldExecution
RtlNtStatusToDosError
VerSetConditionMask
RtlUnwind
RtlCaptureContext
RtlLeaveCriticalSection

mscoree

ord24
CreateConfigStream

vcruntime140_clr0400

__CxxFrameHandler
wcsrchr
memcpy
_purecall
memcmp
strchr
memmove
wcsstr
strrchr
wcschr
memchr
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
__std_type_info_destroy_list
memset
_CxxThrowException

ucrtbase_clr0400

_flushall
__stdio_common_vfwprintf
iswspace
__stdio_common_vswprintf_p
_wcsnicmp
_itow_s
wcsnlen
atoi
toupper
_time64
_mbsdup
fopen
fwrite
_execute_onexit_table
fclose
fputs
_wfopen
wcsncmp
isalpha
fflush
_copysign
modf
towupper
__stdio_common_vswscanf
towlower
iswupper
_wtoi
__acrt_iob_func
wcstoull
__stdio_common_vsscanf
isdigit
_putws
strncpy_s
_errno
_invalid_parameter_noinfo
atoi
strnlen
wcstoul
iswascii
wcsncat_s
_wcslwr_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
strcat_s
__stdio_common_vfprintf
strcpy_s
strncmp
qsort
_controlfp_s
__stdio_common_vsprintf
_wcsicmp
strcmp
strlen
_itow_s
__stdio_common_vswprintf_s
_stricmp
__stdio_common_vswprintf
wcsncpy_s
wcscat_s
wcscpy_s
_crt_atexit
_cexit
terminate
strncat_s
wcstok_s
bsearch
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_strnicmp
_register_onexit_function
isxdigit
malloc
free
strtoul
_wmakepath_s
_wsplitpath_s
wmemcpy_s
iswxdigit
iswdigit
isupper
_isnan
fopen_s
__stdio_common_vsnprintf_s
_CIacos
_CIasin
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsinh
_CItanh

user32

DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
GetDesktopWindow
LoadStringW
GetUserObjectInformationW
GetProcessWindowStation
InSendMessage
GetFocus

shlwapi

PathCreateFromUrlW
UrlCanonicalizeW
PathAddBackslashW
UrlUnescapeW
StrCmpW
StrStrW
UrlCombineW
PathIsURLW
UrlGetPartW
StrRChrW
PathRemoveExtensionW
PathRemoveFileSpecW
StrChrW
StrToIntW
StrCmpNW
PathFindExtensionW
PathIsRelativeW
PathRemoveBackslashW
UrlEscapeW
PathIsUNCW
UrlIsW
PathCanonicalizeW
PathFindFileNameW
PathCombineW

advapi32

CryptEncrypt
CryptGetDefaultProviderW
CryptDecrypt
CryptDeriveKey
CryptSetKeyParam
DeleteAce
SaferCloseLevel
SetTokenInformation
CreateWellKnownSid
ConvertStringSidToSidW
SaferCreateLevel
AddAccessAllowedAceEx
SaferComputeTokenFromLevel
CryptVerifySignatureW
LookupAccountSidW
CryptEnumProvidersW
CryptGenKey
GetNamedSecurityInfoW
CryptSignHashW
CryptVerifySignatureA
CryptSetHashParam
RegQueryInfoKeyA
RegDeleteValueW
IsValidSid
GetSidIdentifierAuthority
CryptGetKeyParam
CryptImportKey
CryptGetProvParam
CryptAcquireContextA
CryptDestroyKey
CryptGetUserKey
CryptExportKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CopySid
DuplicateToken
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
GetSidSubAuthorityCount
GetSidSubAuthority
AddAccessAllowedAce
GetLengthSid
EventWriteTransfer
RegQueryInfoKeyW
RegQueryValueW
RegOpenKeyExW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
ImpersonateLoggedOnUser
EventUnregister
EventRegister
SetThreadToken
RevertToSelf
GetAce
InitializeAcl
GetSecurityDescriptorDacl
SetKernelObjectSecurity
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
EventWrite
CryptSetProvParam

combase

CoInitializeEx
RoInitialize
RoUninitialize

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Exports

Exports

AttachProfiler
CertCreateAuthenticodeLicense
CertFreeAuthenticodeSignerInfo
CertFreeAuthenticodeTimestamperInfo
CertTimestampAuthenticodeLicense
CertVerifyAuthenticodeLicense
ClearDownloadCache
ClrCreateManagedInstance
CoEEShutDownCOM
CoInitializeCor
CoInitializeEE
CoUninitializeCor
CoUninitializeEE
CompareAssemblyIdentity
CompareAssemblyIdentityWithConfig
CopyPDBs
CorDllMainForThunk
CorExitProcess
CorLaunchApplication
CorMarkThreadInThreadPool
CreateActContext
CreateApplicationContext
CreateAssemblyCache
CreateAssemblyConfigCookie
CreateAssemblyEnum
CreateAssemblyNameObject
CreateCMSFromXml
CreateHistoryReader
CreateInstallReferenceEnum
DeleteShadowCache
DestroyAssemblyConfigCookie
DllCanUnloadNowInternal
DllGetActivationFactoryImpl
DllGetClassObjectInternal
DllRegisterServerInternal
DllUnregisterServerInternal
EEDllRegisterServer
EEDllUnregisterServer
GetAddrOfContractShutoffFlag
GetAppIdAuthority
GetAssemblyIdentityFromFile
GetAssemblyMDImport
GetCLRFunction
GetCLRIdentityManager
GetCachePath
GetClassActivatorForApplicationImpl
GetHashFromAssemblyFile
GetHashFromAssemblyFileW
GetHashFromBlob
GetHashFromFile
GetHashFromFileW
GetHashFromHandle
GetHistoryFileDirectory
GetIdentityAuthority
GetMetaDataInternalInterface
GetMetaDataInternalInterfaceFromPublic
GetMetaDataPublicInterfaceFromInternal
GetPermissionRequests
GetPrivateContextsPerfCounters
GetUserStateManager
GetUserStore
IEE
InitializeFusion
InstallCustomModule
LegacyNGenCompile
LegacyNGenCreateZapper
LegacyNGenFreeZapper
LegacyNGenTryEnumerateFusionCache
LoadStringRC
LoadStringRCEx
LogHelp_LogAssert
LogHelp_NoGuiOnAssert
LogHelp_TerminateOnAssert
LookupHistoryAssembly
MetaDataGetDispenser
NGenCreateNGenWorker
NukeDownloadedCache
ParseManifest
PostErrorVA
PreBindAssembly
PreBindAssemblyEx
ReOpenMetaDataWithMemory
ReOpenMetaDataWithMemoryEx
SetMSIHandleForLogging
SetRuntimeInfo
StrongNameCompareAssemblies
StrongNameDigestEmbed
StrongNameDigestGenerate
StrongNameDigestSign
StrongNameErrorInfo
StrongNameFreeBuffer
StrongNameGetBlob
StrongNameGetBlobFromImage
StrongNameGetPublicKey
StrongNameGetPublicKeyEx
StrongNameHashSize
StrongNameKeyDelete
StrongNameKeyGen
StrongNameKeyGenEx
StrongNameKeyInstall
StrongNameSignatureGeneration
StrongNameSignatureGenerationEx
StrongNameSignatureSize
StrongNameSignatureVerification
StrongNameSignatureVerificationEx
StrongNameSignatureVerificationEx2
StrongNameSignatureVerificationFromImage
StrongNameTokenFromAssembly
StrongNameTokenFromAssemblyEx
StrongNameTokenFromPublicKey
TranslateSecurityAttributes
_AxlGetIssuerPublicKeyHash
_AxlPublicKeyBlobToPublicKeyToken
_AxlRSAKeyValueToPublicKeyToken
_CorDllMain
_CorExeMain
_CorExeMain2
_GC_Initialize@16
_GC_IsCompatibleWithRuntime@8
_IsOS@4

Sections

.text
Size: 7.8MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 393KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

064c64c634f520a79afc8922cea4cb43

Headers

DLL Characteristics

File Characteristics

Imports

kernelbase

kernel32

ntdll

mscoree

vcruntime140_clr0400

ucrtbase_clr0400

user32

shlwapi

advapi32

combase

version

Exports

Exports

Sections

.text Size: 7.8MB - Virtual size: 7.8MB

.data Size: 72KB - Virtual size: 72KB

.idata Size: 16KB - Virtual size: 16KB

.didat Size: 4KB - Virtual size: 4KB

.tls Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 393KB - Virtual size: 393KB

.text
Size: 7.8MB - Virtual size: 7.8MB

.data
Size: 72KB - Virtual size: 72KB

.idata
Size: 16KB - Virtual size: 16KB

.didat
Size: 4KB - Virtual size: 4KB

.tls
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 393KB - Virtual size: 393KB