e9939ebeb62f2a8924db8fd9fb840f769489b026db8857218fd72a511cbbf49c

Sharing

Copy URL Twitter E-mail

General

Target

e9939ebeb62f2a8924db8fd9fb840f769489b026db8857218fd72a511cbbf49c
Size

10.0MB
MD5

67e3e6752082c6ee58b7e770b318129e
SHA1

202433eabbcc3b57e86d19616d1d47f6f5f54ee2
SHA256

e9939ebeb62f2a8924db8fd9fb840f769489b026db8857218fd72a511cbbf49c
SHA512

b40b054e190ab39a1cb774f2505008dfd38143c7724d2dcbb7aa169b733f21a9e5c81edb46ec79e590431dca6c8af9721ca1319c6d1611343621642471423d24
SSDEEP

98304:AZCVZ+HhiYYENyuAaZua8sccABv2+jx79oxTqesuW8tDj6iC3SsYbTluTs0K+:AZCVcEYYU4AivzgTwdOTJuTs0K+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9939ebeb62f2a8924db8fd9fb840f769489b026db8857218fd72a511cbbf49c

Files

e9939ebeb62f2a8924db8fd9fb840f769489b026db8857218fd72a511cbbf49c
.dll regsvr32 windows x86

faf939479f6c8afa4ad0096f09acd36c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

DbgPrint
NtClose
NtOpenFile
NtQueryInformationFile
NtQueryVolumeInformationFile
RtlAssert
RtlCreateUnicodeStringFromAsciiz
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString
RtlGUIDFromString
RtlInitUnicodeString
RtlRaiseException
vDbgPrintExWithPrefix

advapi32

AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
CloseServiceHandle
CommandLineFromMsiDescriptor
ConvertSidToStringSidW
FreeSid
GetTokenInformation
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
RegCloseKey
RegCreateKeyExA
RegCreateKeyExW
RegCreateKeyW
RegDeleteKeyW
RegEnumKeyExW
RegEnumKeyW
RegEnumValueW
RegGetValueA
RegGetValueW
RegOpenKeyA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryValueA
RegQueryValueExA
RegQueryValueExW
RegQueryValueW
RegSetValueExW

comctl32

ord167
ord401
ord71
ord400
CreatePropertySheetPageW
ord328
ord336
ord329
ord386
ord332
ord334
ord339
ord338
ord320
ord327
ord388
ord387
ord323
ord324
ord403
ord169
ord73
ord152
ImageList_Add
ImageList_AddMasked
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_Draw
ImageList_EndDrag
ImageList_GetIcon
ImageList_Remove
ImageList_ReplaceIcon
InitCommonControls
InitCommonControlsEx
PropertySheetW

comdlg32

GetFileTitleW
GetOpenFileNameW

kernel32

ActivateActCtx
CancelIo
CloseHandle
CompareFileTime
CompareStringW
CopyFileExW
CopyFileW
CreateActCtxW
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateProcessW
CreateSemaphoreW
DeactivateActCtx
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DisableThreadLibraryCalls
DosDateTimeToFileTime
EnterCriticalSection
EnumResourceNamesW
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FlushInstructionCache
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetBinaryTypeW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatA
GetDateFormatW
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileTime
GetFullPathNameW
GetLastError
GetLocaleInfoW
GetLogicalDrives
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNumberFormatW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetProfileStringW
GetShortPathNameA
GetShortPathNameW
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetSystemWow64DirectoryW
GetThreadLocale
GetTickCount
GetTimeFormatA
GetTimeFormatW
GetVersion
GetVolumeInformationA
GetVolumeInformationW
GetWindowsDirectoryW
GlobalAddAtomW
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomW
GlobalFree
GlobalGetAtomNameW
GlobalLock
GlobalMemoryStatusEx
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
IsDebuggerPresent
IsWow64Process
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockResource
MapViewOfFile
MoveFileW
MoveFileWithProgressW
MulDiv
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
QueueUserAPC
RaiseException
ReadDirectoryChangesW
ReadFile
ReleaseSemaphore
RemoveDirectoryW
ResumeThread
SearchPathW
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetFileAttributesW
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
SetVolumeLabelW
SizeofResource
Sleep
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile
WritePrivateProfileStringW
lstrcatA
lstrcatW
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpyA
lstrcpyW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW

msvcrt

__dllonexit
_amsg_exit
_assert
_beginthreadex
_exit
_initterm
_iob
_isctype
_itoa
_itow
_lock
_memicmp
_onexit
_snprintf
_snwprintf
_stricmp
_strupr
_unlock
_vscwprintf
_vsnprintf
_vsnwprintf
_wcsdup
_wcsicmp
_wcslwr
_wcsnicmp
_wcsupr
_wtoi
abort
acos
atoi
bsearch
calloc
cos
free
fwrite
isprint
isspace
iswspace
malloc
memcmp
memcpy
memmove
memset
qsort
raise
realloc
sin
sprintf
strcat
strchr
strcmp
strcpy
strcspn
strncmp
strrchr
swprintf
tolower
towupper
vfprintf
vsprintf
vswprintf
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsrchr
wcsstr
wcstol
wcstoul

shlwapi

AssocQueryStringW
ord448
ord164
ord256
ord172
ord481
ord509
ord176
ord484
ord163
ord174
ord478
ord479
ord2
PathAddBackslashW
PathAddExtensionW
PathAppendA
PathAppendW
PathBuildRootW
PathCombineW
PathCreateFromUrlW
PathFileExistsA
ord446
ord4
PathFileExistsW
PathFindExtensionA
PathFindExtensionW
PathFindFileNameW
ord6
PathFindOnPathW
PathGetArgsW
PathGetCharTypeA
PathGetCharTypeW
PathGetDriveNumberW
PathIsDirectoryEmptyW
PathIsDirectoryW
PathIsFileSpecW
PathIsNetworkPathW
PathIsRelativeW
PathIsRootA
PathIsRootW
PathIsSameRootW
PathIsUNCW
PathIsURLW
ord456
PathMatchSpecW
PathParseIconLocationW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW
PathRemoveBlanksW
PathRemoveExtensionW
PathRemoveFileSpecA
PathRemoveFileSpecW
PathSearchAndQualifyW
PathSetDlgItemPathW
PathStripPathW
PathStripToRootW
PathUnExpandEnvStringsW
PathUnquoteSpacesA
PathUnquoteSpacesW
ord20
ord7
ord215
SHAutoComplete
SHCopyKeyW
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
ord16
ord278
SHDeleteKeyW
ord464
ord460
ord22
ord545
ord19
ord10
SHGetValueW
ord8
ord510
ord179
SHQueryValueExA
SHQueryValueExW
ord18
ord344
SHRegGetUSValueW
SHRegGetValueW
SHRegSetUSValueW
ord21
SHSetValueW
ord165
ord186
SHStrDupW
ord24
ord217
ord9
ord17
ord388
StrCatBuffW
StrChrW
StrCmpIW
StrCmpW
StrCpyNW
StrDupW
StrFormatByteSize64A
StrFormatByteSizeW
StrFormatKBSizeA
StrFormatKBSizeW
StrPBrkW
StrRChrW
StrRetToBSTR
StrRetToBufW
StrRetToStrW
StrToIntA
StrToIntW
StrTrimW
UrlIsW
wnsprintfW

gdi32

BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectW
CreateFontW
CreateICW
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
Ellipse
ExtTextOutW
GetDIBits
GetDeviceCaps
GetObjectW
GetStockObject
GetTextExtentPoint32W
GetTextMetricsW
LineTo
MaskBlt
MoveToEx
Pie
SelectObject
SetBkColor
SetBkMode
SetDIBits
SetPixel
SetTextColor
StretchBlt

user32

AdjustWindowRect
AppendMenuW
BeginDeferWindowPos
BeginPaint
BringWindowToTop
CallNextHookEx
CallWindowProcW
CharLowerBuffW
CharLowerW
CharPrevW
CheckMenuItem
CheckMenuRadioItem
CheckRadioButton
ClientToScreen
CloseClipboard
CopyIcon
CopyImage
CreateDialogParamW
CreateIconIndirect
CreateMenu
CreatePopupMenu
CreateWindowExW
DdeAccessData
DdeClientTransaction
DdeConnect
DdeCreateStringHandleW
DdeDisconnect
DdeFreeDataHandle
DdeFreeStringHandle
DdeGetLastError
DdeInitializeA
DdeInitializeW
DdeNameService
DdeQueryStringW
DdeUnaccessData
DdeUninitialize
DefWindowProcW
DeferWindowPos
DeleteMenu
DeregisterShellHookWindow
DestroyIcon
DestroyMenu
DestroyWindow
DialogBoxIndirectParamW
DialogBoxParamW
DispatchMessageW
DrawFocusRect
DrawFrameControl
DrawIconEx
DrawTextExW
DrawTextW
EnableMenuItem
EnableWindow
EndDeferWindowPos
EndDialog
EndPaint
EnumWindows
EqualRect
ExitWindowsEx
FillRect
FindWindowExW
FindWindowW
FrameRect
GetAncestor
GetAsyncKeyState
GetCapture
GetClassNameW
GetClientRect
GetClipboardData
GetClipboardFormatNameA
GetComboBoxInfo
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetDlgItemInt
GetDlgItemTextW
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyState
GetLastActivePopup
GetMenuDefaultItem
GetMenuInfo
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoW
GetMenuItemRect
GetMessagePos
GetMessageW
GetParent
GetPropW
GetScrollPos
GetShellWindow
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetWindow
GetWindowDC
GetWindowLongA
GetWindowLongW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
InflateRect
InsertMenuA
InsertMenuItemW
InsertMenuW
InvalidateRect
IsChild
IsDialogMessageW
IsDlgButtonChecked
IsWindow
IsWindowUnicode
IsWindowVisible
KillTimer
LoadAcceleratorsW
LoadBitmapW
LoadCursorA
LoadCursorW
LoadIconW
LoadImageW
LoadMenuW
LoadStringA
LoadStringW
MapWindowPoints
MessageBeep
MessageBoxA
MessageBoxW
MoveWindow
OffsetRect
OpenClipboard
PaintDesktop
PostMessageW
PostQuitMessage
PrivateExtractIconsW
PtInRect
RegisterClassExW
RegisterClipboardFormatA
RegisterClipboardFormatW
RegisterShellHookWindow
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
SendDlgItemMessageW
SendMessageA
SendMessageW
SendNotifyMessageW
SetCapture
SetClipboardData
SetCursor
SetDlgItemInt
SetDlgItemTextW
SetFocus
SetForegroundWindow
SetMenuDefaultItem
SetMenuInfo
SetMenuItemInfoW
SetParent
SetPropW
SetRect
SetShellWindowEx
SetTaskmanWindow
SetTimer
SetWindowLongA
SetWindowLongW
SetWindowPos
SetWindowTextA
SetWindowTextW
SetWindowsHookExW
ShowWindow
SystemParametersInfoW
TrackPopupMenu
TrackPopupMenuEx
TranslateAcceleratorW
TranslateMessage
UnhookWindowsHookEx
UpdateWindow
WaitForInputIdle
WinHelpW
WindowFromPoint
wsprintfW

Exports

Exports

Activate_RunDLL
AppCompat_RunDLLW
CDefFolderMenu_Create
CDefFolderMenu_Create2
CallCPLEntry16
CheckEscapesA
CheckEscapesW
CommandLineToArgvW
Control_FillCache_RunDLL
Control_FillCache_RunDLLA
Control_FillCache_RunDLLW
Control_RunDLL
Control_RunDLLA
Control_RunDLLAsUserW
Control_RunDLLW
DAD_AutoScroll
DAD_DragEnterEx
DAD_DragEnterEx2
DAD_DragLeave
DAD_DragMove
DAD_SetDragImage
DAD_ShowDragImage
DllCanUnloadNow
DllGetClassObject
DllGetVersion
DllInstall
DllRegisterServer
DllUnregisterServer
DoEnvironmentSubstA
DoEnvironmentSubstW
DragAcceptFiles
DragFinish
DragQueryFile
DragQueryFileA
DragQueryFileAorW
DragQueryFileW
DragQueryPoint
DriveType
DuplicateIcon
ExtractAssociatedIconA
ExtractAssociatedIconExA
ExtractAssociatedIconExW
ExtractAssociatedIconW
ExtractIconA
ExtractIconEx
ExtractIconExA
ExtractIconExW
ExtractIconResInfoA
ExtractIconResInfoW
ExtractIconW
ExtractVersionResource16W
FindExeDlgProc
FindExecutableA
FindExecutableW
FreeIconList
GetFileNameFromBrowse
ILAppendID
ILClone
ILCloneFirst
ILCombine
ILCreateFromPath
ILCreateFromPathA
ILCreateFromPathW
ILFindChild
ILFindLastID
ILFree
ILGetNext
ILGetSize
ILIsEqual
ILIsParent
ILLoadFromStream
ILRemoveLastID
ILSaveToStream
InternalExtractIconListA
InternalExtractIconListW
IsLFNDrive
IsLFNDriveA
IsLFNDriveW
IsNetDrive
IsUserAnAdmin
OpenAs_RunDLL
OpenAs_RunDLLA
OpenAs_RunDLLW
OpenRegStream
Options_RunDLL
Options_RunDLLA
Options_RunDLLW
PathCleanupSpec
PathGetShortPath
PathIsExe
PathIsSlowA
PathIsSlowW
PathMakeUniqueName
PathProcessCommand
PathQualify
PathResolve
PathYetAnotherMakeUniqueName
PickIconDlg
PifMgr_CloseProperties
PifMgr_GetProperties
PifMgr_OpenProperties
PifMgr_SetProperties
PrintersGetCommand_RunDLL
PrintersGetCommand_RunDLLA
PrintersGetCommand_RunDLLW
ReadCabinetState
RealDriveType
RealShellExecuteA
RealShellExecuteExA
RealShellExecuteExW
RealShellExecuteW
RegenerateUserEnvironment
RestartDialog
RestartDialogEx
SHAddFromPropSheetExtArray
SHAddToRecentDocs
SHAlloc
SHAllocShared
SHAppBarMessage
SHBindToParent
SHBrowseForFolder
SHBrowseForFolderA
SHBrowseForFolderW
SHCLSIDFromString
SHChangeNotification_Lock
SHChangeNotification_Unlock
SHChangeNotify
SHChangeNotifyDeregister
SHChangeNotifyRegister
SHChangeNotifySuspendResume
SHCloneSpecialIDList
SHCoCreateInstance
SHCreateDirectory
SHCreateDirectoryExA
SHCreateDirectoryExW
SHCreateFileExtractIconW
SHCreateLocalServerRunDll
SHCreateProcessAsUserW
SHCreatePropSheetExtArray
SHCreateQueryCancelAutoPlayMoniker
SHCreateShellFolderView
SHCreateShellFolderViewEx
SHCreateShellItem
SHCreateStdEnumFmtEtc
SHDefExtractIconA
SHDefExtractIconW
SHDestroyPropSheetExtArray
SHDoDragDrop
SHEmptyRecycleBinA
SHEmptyRecycleBinW
SHEnableServiceObject
SHEnumerateUnreadMailAccountsW
SHExtractIconsW
SHFileOperation
SHFileOperationA
SHFileOperationW
SHFindFiles
SHFind_InitMenuPopup
SHFlushClipboard
SHFlushSFCache
SHFormatDrive
SHFree
SHFreeNameMappings
SHFreeShared
SHGetDataFromIDListA
SHGetDataFromIDListW
SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHGetDiskFreeSpaceExA
SHGetDiskFreeSpaceExW
SHGetFileInfo
SHGetFileInfoA
SHGetFileInfoW
SHGetFolderLocation
SHGetFolderPathA
SHGetFolderPathAndSubDirA
SHGetFolderPathAndSubDirW
SHGetFolderPathW
SHGetIconOverlayIndexA
SHGetIconOverlayIndexW
SHGetImageList
SHGetInstanceExplorer
SHGetMalloc
SHGetNewLinkInfo
SHGetNewLinkInfoA
SHGetNewLinkInfoW
SHGetPathFromIDList
SHGetPathFromIDListA
SHGetPathFromIDListW
SHGetRealIDL
SHGetSetFolderCustomSettingsW
SHGetSetSettings
SHGetSettings
SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
SHGetUnreadMailCountW
SHHandleUpdateImage
SHHelpShortcuts_RunDLL
SHHelpShortcuts_RunDLLA
SHHelpShortcuts_RunDLLW
SHILCreateFromPath
SHInvokePrinterCommandA
SHInvokePrinterCommandW
SHIsFileAvailableOffline
SHLimitInputEdit
SHLoadInProc
SHLoadNonloadedIconOverlayIdentifiers
SHLoadOLE
SHLockShared
SHMapIDListToImageListIndexAsync
SHMapPIDLToSystemImageListIndex
SHMultiFileProperties
SHObjectProperties
SHOpenFolderAndSelectItems
SHOpenPropSheetW
SHParseDisplayName
SHPathPrepareForWriteA
SHPathPrepareForWriteW
SHPropStgCreate
SHPropStgReadMultiple
SHPropStgWriteMultiple
SHQueryRecycleBinA
SHQueryRecycleBinW
SHReplaceFromPropSheetExtArray
SHRestricted
SHRunControlPanel
SHSetInstanceExplorer
SHSetLocalizedName
SHSetUnreadMailCountW
SHShellFolderView_Message
SHSimpleIDListFromPath
SHStartNetConnectionDialogW
SHTestTokenMembership
SHUnlockShared
SHUpdateImageA
SHUpdateImageW
SHUpdateRecycleBinIcon
SHValidateUNC
SheChangeDirA
SheChangeDirExA
SheChangeDirExW
SheChangeDirW
SheConvertPathW
SheFullPathA
SheFullPathW
SheGetCurDrive
SheGetDirA
SheGetDirExW
SheGetDirW
SheGetPathOffsetW
SheRemoveQuotesA
SheRemoveQuotesW
SheSetCurDrive
SheShortenPathA
SheShortenPathW
ShellAboutA
ShellAboutW
ShellExec_RunDLL
ShellExec_RunDLLA
ShellExec_RunDLLW
ShellExecuteA
ShellExecuteEx
ShellExecuteExA
ShellExecuteExW
ShellExecuteW
ShellHookProc
ShellMessageBoxA
ShellMessageBoxW
Shell_GetCachedImageIndex
Shell_GetImageLists
Shell_MergeMenus
Shell_NotifyIcon
Shell_NotifyIconA
Shell_NotifyIconW
SignalFileOpen
StrChrA
StrChrIA
StrChrIW
StrChrW
StrCmpNA
StrCmpNIA
StrCmpNIW
StrCmpNW
StrCpyNA
StrCpyNW
StrNCmpA
StrNCmpIA
StrNCmpIW
StrNCmpW
StrNCpyA
StrNCpyW
StrRChrA
StrRChrIA
StrRChrIW
StrRChrW
StrRStrA
StrRStrIA
StrRStrIW
StrRStrW
StrStrA
StrStrIA
StrStrIW
StrStrW
WOWShellExecute
Win32DeleteFile
WriteCabinetState

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ATL
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rossym
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

faf939479f6c8afa4ad0096f09acd36c

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

advapi32

comctl32

comdlg32

kernel32

msvcrt

shlwapi

gdi32

user32

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.data Size: 10KB - Virtual size: 9KB

ATL Size: 512B - Virtual size: 8B

.rdata Size: 237KB - Virtual size: 237KB

.bss Size: - Virtual size: 11KB

.edata Size: 14KB - Virtual size: 13KB

.idata Size: 20KB - Virtual size: 20KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 7.2MB - Virtual size: 7.2MB

.reloc Size: 80KB - Virtual size: 80KB

.rossym Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 10KB - Virtual size: 9KB

ATL
Size: 512B - Virtual size: 8B

.rdata
Size: 237KB - Virtual size: 237KB

.bss
Size: - Virtual size: 11KB

.edata
Size: 14KB - Virtual size: 13KB

.idata
Size: 20KB - Virtual size: 20KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 7.2MB - Virtual size: 7.2MB

.reloc
Size: 80KB - Virtual size: 80KB

.rossym
Size: 1.4MB - Virtual size: 1.4MB