enregistering[.]dat

Sharing

Copy URL

Twitter E-mail

General

Target

enregistering.dat
Size

352KB
MD5

ac5cf9e98eb327b7b347a2a26f1850ca
SHA1

92b1dbbc243c3c6bd4b4f9739bc777fadfcce5f3
SHA256

2fd37077734a03d479fa0781166142e9283689b066acbecddaf35f1b24f0280b
SHA512

2e1bb2692a573d01366fdcb130100adb65c6621d43fbd7b2dbf880bb3382c17cd8e20f85a81e52766042371aa087f3e35bea523c10ffdbe4981e2bb184f2cb79
SSDEEP

6144:S3FMevnrsIgeWvFTNKgxOkcIcVfSIzl0Hw3USlXeWcCT7n7rb1NbmpLC7Aar5z:S3FMEo75KPkcIcpN50C1NbmpGFr5z

Score

1^/10

Malware Config

Signatures

Files

enregistering.dat
.dll windows x64

5e281ea84a592466bb305907453ce7fe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapFree
GetProcessHeap
HeapAlloc
CompareStringOrdinal
CompareStringEx
GetFullPathNameW
GetFileAttributesW
CreateFileW
FindResourceW
LoadResource
SizeofResource
DeleteFileA
MoveFileExW
CompareStringW
LocalFree
WriteFile
WideCharToMultiByte
CompareStringA
GetEnvironmentVariableW
DeleteFileW
SetLastError
CloseHandle
AcquireSRWLockShared
ReleaseSRWLockShared
DosDateTimeToFileTime
GetTempPathW
LoadLibraryExW
LoadLibraryExA
DelayLoadFailureHook
GetModuleFileNameA
GetCurrentThread
FindStringOrdinal
LockResource
CopyFileW
ReplaceFileW
GetModuleHandleW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitOnceComplete
InitOnceBeginInitialize
FreeLibrary
GetProcAddress
GetModuleHandleExW
IsDebuggerPresent
FormatMessageW
GetCurrentThreadId
OutputDebugStringW
DebugBreak
GetLocalTime
GetStdHandle
DecodePointer
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLastError
RaiseException
FileTimeToDosDateTime
SystemTimeToFileTime

advapi32

EventRegister
EventUnregister
OpenThreadToken
RevertToSelf
ImpersonateLoggedOnUser
EventWriteTransfer
RegGetValueW

crypt32

CryptSIPAddProvider
CryptSIPRemoveProvider
CertFreeCertificateContext
CryptMsgClose
CertCloseStore
CertNameToStrW
CertGetSubjectCertificateFromStore
CryptMsgGetParam
CryptQueryObject
CryptFindOIDInfo
CryptEncodeObject

ntdll

RtlNtStatusToDosError
RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlInitUnicodeString
NtQuerySystemInformation
RtlNumberGenericTableElementsAvl
RtlCompareUnicodeString
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl

ole32

CoTaskMemFree
CreateStreamOnHGlobal
CoInitializeEx
IIDFromString
CoUninitialize
CoCreateInstance
CoTaskMemAlloc

oleaut32

SysAllocString
GetErrorInfo
SysFreeString
SetErrorInfo
CreateErrorInfo
VariantInit
SysStringLen
SysAllocStringLen

shlwapi

SHCreateStreamOnFileEx
PathIsURLW

bcrypt

BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptFinishHash
BCryptCreateHash
BCryptDestroyHash
BCryptHashData

Exports

Exports

appxBundleSipCreateIndirectData
appxBundleSipGetSignedDataMsg
appxBundleSipIsFileSupportedName
appxBundleSipPutSignedDataMsg
appxBundleSipRemoveSignedDataMsg
appxBundleSipVerifyIndirectData
appxSipCreateIndirectData
appxSipGetSignedDataMsg
appxSipIsFileSupportedName
appxSipPutSignedDataMsg
appxSipRemoveSignedDataMsg
appxSipVerifyIndirectData
allCanUnloadNow
allRegisterServer
allUnregisterServer
aappxBundleSipCreateIndirectData
aappxBundleSipGetSignedDataMsg
aappxBundleSipIsFileSupportedName
aappxBundleSipPutSignedDataMsg
aappxBundleSipRemoveSignedDataMsg
aappxBundleSipVerifyIndirectData
aappxSipCreateIndirectData
aappxSipGetSignedDataMsg
aappxSipIsFileSupportedName
aappxSipPutSignedDataMsg
aappxSipRemoveSignedDataMsg
aappxSipVerifyIndirectData
a7xSipCreateIndirectData
a7xSipGetSignedDataMsg
a7xSipIsFileSupportedName
a7xSipPutSignedDataMsg
a7xSipRemoveSignedDataMsg
ghto

Sections

.text
Size: 198KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5e281ea84a592466bb305907453ce7fe

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

crypt32

ntdll

ole32

oleaut32

shlwapi

bcrypt

Exports

Exports

Sections

.text Size: 198KB - Virtual size: 197KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 28KB - Virtual size: 27KB

.reloc Size: 1024B - Virtual size: 728B

.text
Size: 198KB - Virtual size: 197KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 1024B - Virtual size: 728B