9611e40d5f667c01e3586338c94e2db6d37902b36f51f7330a9ca0f83c3b29ec

Sharing

Copy URL Twitter E-mail

General

Target

9611e40d5f667c01e3586338c94e2db6d37902b36f51f7330a9ca0f83c3b29ec
Size

2.5MB
MD5

d07456469ab76b2675b3942d37df474d
SHA1

10a3c8931a25c9dee8027775bf6904ff276f0706
SHA256

9611e40d5f667c01e3586338c94e2db6d37902b36f51f7330a9ca0f83c3b29ec
SHA512

9b41c4d08b3f644881272ab9b59897b6f80ba0651979908eb145d474df24c6bdc26a7a8c7e8696443d52f204a47a8f50bc7c3d84bd84367796741e91de5c79e7
SSDEEP

24576:1cMEiBKXxCrvDsn7eIAmVf/UKTbEz5rzZi86kyTvtKZ0s:b3BKXc47eI/9WRti8zyTvtKZj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9611e40d5f667c01e3586338c94e2db6d37902b36f51f7330a9ca0f83c3b29ec

Files

9611e40d5f667c01e3586338c94e2db6d37902b36f51f7330a9ca0f83c3b29ec
.dll windows:4 windows x86

f0ad0f7f2dd450b16fef7bf81e28f435

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

ntdll

ApiSetQueryApiSetPresenceEx
DbgBreakPoint
DbgUiConnectToDbg
DbgUiContinue
DbgUiConvertStateChangeStructure
DbgUiDebugActiveProcess
DbgUiGetThreadDebugObject
DbgUiStopDebugging
DbgUiWaitStateChange
LdrAccessResource
LdrAddDllDirectory
LdrAddRefDll
LdrDisableThreadCalloutsForDll
LdrFindResourceDirectory_U
LdrFindResource_U
LdrGetDllFullName
LdrGetDllHandleEx
LdrGetDllPath
LdrGetProcedureAddress
LdrLoadDll
LdrRemoveDllDirectory
LdrResolveDelayLoadedAPI
LdrSetDefaultDllDirectories
LdrUnloadDll
NtAccessCheck
NtAdjustGroupsToken
NtAdjustPrivilegesToken
NtAllocateLocallyUniqueId
NtAllocateVirtualMemory
NtAllocateVirtualMemoryEx
NtCancelIoFile
NtCancelIoFileEx
NtCancelSynchronousIoFile
NtCancelTimer
NtClose
NtCompareObjects
NtCreateEvent
NtCreateFile
NtCreateIoCompletion
NtCreateKey
NtCreateMutant
NtCreateNamedPipeFile
NtCreateSection
NtCreateSemaphore
NtCreateSymbolicLinkObject
NtCreateTimer
NtCreateUserProcess
NtDelayExecution
NtDeleteKey
NtDeleteValueKey
NtDeviceIoControlFile
NtDuplicateObject
NtDuplicateToken
NtEnumerateKey
NtEnumerateValueKey
NtFilterToken
NtFlushBuffersFile
NtFlushInstructionCache
NtFlushKey
NtFlushVirtualMemory
NtFreeVirtualMemory
NtFsControlFile
NtGetContextThread
NtGetNlsSectionPtr
NtGetTickCount
NtGetWriteWatch
NtImpersonateAnonymousToken
NtIsProcessInJob
NtLoadKey
NtLockFile
NtLockVirtualMemory
NtMakeTemporaryObject
NtMapViewOfSection
NtMapViewOfSectionEx
NtNotifyChangeDirectoryFile
NtNotifyChangeKey
NtOpenDirectoryObject
NtOpenEvent
NtOpenFile
NtOpenKey
NtOpenKeyEx
NtOpenMutant
NtOpenProcess
NtOpenProcessToken
NtOpenSection
NtOpenSemaphore
NtOpenSymbolicLinkObject
NtOpenThread
NtOpenThreadToken
NtOpenTimer
NtPrivilegeCheck
NtProtectVirtualMemory
NtPulseEvent
NtQueryAttributesFile
NtQueryDefaultLocale
NtQueryDefaultUILanguage
NtQueryDirectoryFile
NtQueryDirectoryObject
NtQueryFullAttributesFile
NtQueryInformationFile
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInformationToken
NtQueryInstallUILanguage
NtQueryKey
NtQueryObject
NtQueryPerformanceCounter
NtQuerySecurityObject
NtQuerySymbolicLinkObject
NtQuerySystemInformation
NtQuerySystemInformationEx
NtQuerySystemTime
NtQueryValueKey
NtQueryVirtualMemory
NtQueryVolumeInformationFile
NtQueueApcThread
NtReadFile
NtReadFileScatter
NtReadVirtualMemory
NtReleaseMutant
NtReleaseSemaphore
NtRemoveIoCompletion
NtRemoveIoCompletionEx
NtResetEvent
NtResetWriteWatch
NtResumeThread
NtSaveKey
NtSetContextThread
NtSetEvent
NtSetInformationFile
NtSetInformationObject
NtSetInformationProcess
NtSetInformationThread
NtSetInformationToken
NtSetInformationVirtualMemory
NtSetIoCompletion
NtSetSecurityObject
NtSetSystemInformation
NtSetSystemTime
NtSetTimer
NtSetValueKey
NtSignalAndWaitForSingleObject
NtSuspendThread
NtTerminateProcess
NtTerminateThread
NtUnloadKey
NtUnlockFile
NtUnlockVirtualMemory
NtUnmapViewOfSection
NtUnmapViewOfSectionEx
NtWaitForMultipleObjects
NtWriteFile
NtWriteFileGather
NtWriteVirtualMemory
NtYieldExecution
RtlAcquirePebLock
RtlActivateActivationContext
RtlAddAccessAllowedAce
RtlAddAccessAllowedAceEx
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedAce
RtlAddAccessDeniedAceEx
RtlAddAccessDeniedObjectAce
RtlAddAce
RtlAddAuditAccessAce
RtlAddAuditAccessAceEx
RtlAddAuditAccessObjectAce
RtlAddMandatoryAce
RtlAddRefActivationContext
RtlAllocateAndInitializeSid
RtlAllocateHeap
RtlAnsiStringToUnicodeString
RtlAreAllAccessesGranted
RtlAreAnyAccessesGranted
RtlAreBitsSet
RtlCharToInteger
RtlClearBits
RtlCompactHeap
RtlCompareUnicodeStrings
RtlConvertSidToUnicodeString
RtlConvertToAutoInheritSecurityObject
RtlCopyContext
RtlCopySid
RtlCreateAcl
RtlCreateActivationContext
RtlCreateEnvironment
RtlCreateHeap
RtlCreateProcessParametersEx
RtlCreateSecurityDescriptor
RtlCreateTimer
RtlCreateTimerQueue
RtlCreateUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlCreateUserStack
RtlCreateUserThread
RtlDeactivateActivationContext
RtlDeleteAce
RtlDeleteCriticalSection
RtlDeleteSecurityObject
RtlDeleteTimer
RtlDeleteTimerQueueEx
RtlDeregisterWaitEx
RtlDestroyEnvironment
RtlDestroyHeap
RtlDestroyProcessParameters
RtlDetermineDosPathNameType_U
RtlDoesFileExists_U
RtlDosPathNameToNtPathName_U
RtlDosPathNameToNtPathName_U_WithStatus
RtlDosSearchPath_U
RtlDowncaseUnicodeChar
RtlDuplicateUnicodeString
RtlEnterCriticalSection
RtlEqualPrefixSid
RtlEqualSid
RtlExitUserProcess
RtlExitUserThread
RtlExpandEnvironmentStrings_U
RtlFindActivationContextSectionGuid
RtlFindActivationContextSectionString
RtlFindClearBitsAndSet
RtlFindMessage
RtlFirstFreeAce
RtlFlsAlloc
RtlFlsFree
RtlFlsGetValue
RtlFlsSetValue
RtlFormatMessage
RtlFreeActivationContextStack
RtlFreeAnsiString
RtlFreeHeap
RtlFreeSid
RtlFreeUnicodeString
RtlFreeUserStack
RtlGUIDFromString
RtlGetAce
RtlGetActiveActivationContext
RtlGetControlSecurityDescriptor
RtlGetCurrentDirectory_U
RtlGetCurrentPeb
RtlGetDaclSecurityDescriptor
RtlGetEnabledExtendedFeatures
RtlGetExePath
RtlGetExtendedContextLength2
RtlGetExtendedFeaturesMask
RtlGetFullPathName_U
RtlGetGroupSecurityDescriptor
RtlGetLocaleFileMappingAddress
RtlGetNativeSystemInformation
RtlGetOwnerSecurityDescriptor
RtlGetProductInfo
RtlGetProcessHeaps
RtlGetProcessPreferredUILanguages
RtlGetSaclSecurityDescriptor
RtlGetSearchPath
RtlGetSystemPreferredUILanguages
RtlGetSystemTimePrecise
RtlGetThreadErrorMode
RtlGetThreadPreferredUILanguages
RtlGetUserPreferredUILanguages
RtlGetVersion
RtlIdentifierAuthoritySid
RtlIdnToAscii
RtlIdnToNameprepUnicode
RtlIdnToUnicode
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlImpersonateSelf
RtlInitAnsiString
RtlInitCodePageTable
RtlInitUnicodeString
RtlInitializeCriticalSection
RtlInitializeCriticalSectionAndSpinCount
RtlInitializeCriticalSectionEx
RtlInitializeExtendedContext2
RtlInitializeSid
RtlIsDosDeviceName_U
RtlIsNameLegalDOS8Dot3
RtlIsNormalizedString
RtlIsProcessorFeaturePresent
RtlLeaveCriticalSection
RtlLengthRequiredSid
RtlLengthSecurityDescriptor
RtlLengthSid
RtlLocalTimeToSystemTime
RtlLocateExtendedFeature
RtlLockHeap
RtlMakeSelfRelativeSD
RtlMapGenericMask
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlNewSecurityObject
RtlNewSecurityObjectEx
RtlNewSecurityObjectWithMultipleInheritance
RtlNormalizeProcessParams
RtlNormalizeString
RtlNtStatusToDosError
RtlOemStringToUnicodeString
RtlOpenCurrentUser
RtlPcToFileHeader
RtlProcessFlsData
RtlQueryActivationContextApplicationSettings
RtlQueryDynamicTimeZoneInformation
RtlQueryEnvironmentVariable_U
RtlQueryHeapInformation
RtlQueryInformationAcl
RtlQueryInformationActivationContext
RtlQueryTimeZoneInformation
RtlQueryUnbiasedInterruptTime
RtlQueueWorkItem
RtlRaiseException
RtlRaiseStatus
RtlReAllocateHeap
RtlRegisterWait
RtlReleaseActivationContext
RtlReleasePath
RtlReleasePebLock
RtlRunOnceBeginInitialize
RtlRunOnceComplete
RtlRunOnceExecuteOnce
RtlSelfRelativeToAbsoluteSD
RtlSetControlSecurityDescriptor
RtlSetCurrentDirectory_U
RtlSetCurrentEnvironment
RtlSetDaclSecurityDescriptor
RtlSetEnvironmentVariable
RtlSetExtendedFeaturesMask
RtlSetGroupSecurityDescriptor
RtlSetHeapInformation
RtlSetOwnerSecurityDescriptor
RtlSetProcessPreferredUILanguages
RtlSetSaclSecurityDescriptor
RtlSetThreadErrorMode
RtlSetThreadPreferredUILanguages
RtlSetTimeZoneInformation
RtlSetUserValueHeap
RtlSleepConditionVariableCS
RtlSleepConditionVariableSRW
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlSystemTimeToLocalTime
RtlTimeFieldsToTime
RtlTimeToTimeFields
RtlUTF8ToUnicodeN
RtlUnicodeStringToAnsiSize
RtlUnicodeStringToAnsiString
RtlUnicodeStringToInteger
RtlUnicodeStringToOemSize
RtlUnicodeStringToOemString
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
RtlUnicodeToOemN
RtlUnicodeToUTF8N
RtlUnlockHeap
RtlUnwind
RtlUpcaseUnicodeString
RtlUpdateTimer
RtlValidAcl
RtlValidSecurityDescriptor
RtlValidSid
RtlValidateHeap
RtlWaitOnAddress
RtlWalkHeap
RtlWow64EnableFsRedirection
RtlWow64EnableFsRedirectionEx
RtlWow64GetProcessMachines
RtlZombifyActivationContext
TpAllocCleanupGroup
TpAllocIoCompletion
TpAllocPool
TpAllocTimer
TpAllocWait
TpAllocWork
TpCallbackMayRunLong
TpQueryPoolStackInformation
TpSetPoolStackInformation
TpSimpleTryPost
_strnicmp
_vsnprintf
_vsnwprintf
_wcsicmp
_wcsnicmp
isalnum
isalpha
isxdigit
memcmp
memcpy
memmove
memset
strcat
strchr
strcmp
strcpy
strlen
strncmp
strrchr
strtol
tolower
towupper
wcscat
wcschr
wcscmp
wcscpy
wcscspn
wcslen
wcsncmp
wcsnlen
wcspbrk
wcsrchr
wcsspn
wcsstr
wcstol
wcstoul
__wine_dbg_get_channel_flags
__wine_dbg_header
__wine_dbg_output
__wine_dbg_strdup

Exports

Exports

AccessCheck
AccessCheckAndAuditAlarmW
AccessCheckByType
AccessCheckByTypeAndAuditAlarmW
AccessCheckByTypeResultList
AccessCheckByTypeResultListAndAuditAlarmByHandleW
AccessCheckByTypeResultListAndAuditAlarmW
AcquireSRWLockExclusive
AcquireSRWLockShared
ActivateActCtx
AddAccessAllowedAce
AddAccessAllowedAceEx
AddAccessAllowedObjectAce
AddAccessDeniedAce
AddAccessDeniedAceEx
AddAccessDeniedObjectAce
AddAce
AddAuditAccessAce
AddAuditAccessAceEx
AddAuditAccessObjectAce
AddConsoleAliasA
AddConsoleAliasW
AddDllDirectory
AddMandatoryAce
AddRefActCtx
AddVectoredContinueHandler
AddVectoredExceptionHandler
AdjustTokenGroups
AdjustTokenPrivileges
AllocConsole
AllocateAndInitializeSid
AllocateLocallyUniqueId
AllocateUserPhysicalPages
AllocateUserPhysicalPagesNuma
AppPolicyGetMediaFoundationCodecLoading
AppPolicyGetProcessTerminationMethod
AppPolicyGetShowDeveloperDiagnostic
AppPolicyGetThreadInitializationType
AppPolicyGetWindowingModel
AreAllAccessesGranted
AreAnyAccessesGranted
AreFileApisANSI
AttachConsole
BaseCheckAppcompatCache
BaseCleanupAppcompatCacheSupport
BaseDllFreeResourceId
BaseDllMapResourceIdW
BaseDumpAppcompatCache
BaseFlushAppcompatCache
BaseGetNamedObjectDirectory
BaseGetProcessDllPath
BaseGetProcessExePath
BaseInitAppcompatCacheSupport
BaseInvalidateDllSearchPathCache
BaseInvalidateProcessSearchPathCache
BaseReleaseProcessDllPath
BaseReleaseProcessExePath
BaseUpdateAppcompatCache
Beep
BemCopyReference
BemCreateContractFrom
BemCreateReference
BemFreeContract
BemFreeReference
CallNamedPipeW
CallbackMayRunLong
CancelIo
CancelIoEx
CancelSynchronousIo
CancelThreadpoolIo
CancelWaitableTimer
ChangeTimerQueueTimer
CharLowerA
CharLowerBuffA
CharLowerBuffW
CharLowerW
CharNextA
CharNextExA
CharNextW
CharPrevA
CharPrevExA
CharPrevW
CharUpperA
CharUpperBuffA
CharUpperBuffW
CharUpperW
CheckGroupPolicyEnabled
CheckRemoteDebuggerPresent
CheckTokenMembership
ChrCmpIA
ChrCmpIW
ClearCommBreak
ClearCommError
CloseHandle
ClosePseudoConsole
CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolIo
CloseThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolWork
CompareFileTime
CompareObjectHandles
CompareStringA
CompareStringEx
CompareStringOrdinal
CompareStringW
ConnectNamedPipe
ContinueDebugEvent
ConvertDefaultLocale
ConvertFiberToThread
ConvertThreadToFiber
ConvertThreadToFiberEx
ConvertToAutoInheritPrivateObjectSecurity
CopyContext
CopyFileExW
CopyFileW
CopySid
CreateActCtxW
CreateBoundaryDescriptorW
CreateConsoleScreenBuffer
CreateDirectoryA
CreateDirectoryExW
CreateDirectoryW
CreateEventA
CreateEventExA
CreateEventExW
CreateEventW
CreateFiber
CreateFiberEx
CreateFile2
CreateFileA
CreateFileMappingFromApp
CreateFileMappingNumaW
CreateFileMappingW
CreateFileW
CreateHardLinkA
CreateHardLinkW
CreateIoCompletionPort
CreateMemoryResourceNotification
CreateMutexA
CreateMutexExA
CreateMutexExW
CreateMutexW
CreateNamedPipeW
CreatePipe
CreatePrivateObjectSecurity
CreatePrivateObjectSecurityEx
CreatePrivateObjectSecurityWithMultipleInheritance
CreateProcessA
CreateProcessAsUserA
CreateProcessAsUserW
CreateProcessInternalA
CreateProcessInternalW
CreateProcessW
CreatePseudoConsole
CreateRemoteThread
CreateRemoteThreadEx
CreateRestrictedToken
CreateSemaphoreExW
CreateSemaphoreW
CreateSymbolicLinkW
CreateThread
CreateThreadpool
CreateThreadpoolCleanupGroup
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
CreateTimerQueue
CreateTimerQueueTimer
CreateWaitableTimerExW
CreateWaitableTimerW
CreateWellKnownSid
CtrlRoutine
DeactivateActCtx
DebugActiveProcess
DebugActiveProcessStop
DebugBreak
DecodePointer
DecodeSystemPointer
DefineDosDeviceW
DelayLoadFailureHook
DeleteAce
DeleteCriticalSection
DeleteFiber
DeleteFileA
DeleteFileW
DeleteProcThreadAttributeList
DeleteTimerQueueEx
DeleteTimerQueueTimer
DeleteVolumeMountPointW
DestroyPrivateObjectSecurity
DeviceIoControl
DisablePredefinedHandleTableInternal
DisableThreadLibraryCalls
DisassociateCurrentThreadFromCallback
DiscardVirtualMemory
DisconnectNamedPipe
DnsHostnameToComputerNameExW
DuplicateHandle
DuplicateToken
DuplicateTokenEx
EmptyWorkingSet
EncodePointer
EncodeSystemPointer
EnterCriticalSection
EnumCalendarInfoExEx
EnumCalendarInfoExW
EnumCalendarInfoW
EnumDateFormatsExEx
EnumDateFormatsExW
EnumDateFormatsW
EnumDeviceDrivers
EnumDynamicTimeZoneInformation
EnumLanguageGroupLocalesW
EnumPageFilesA
EnumPageFilesW
EnumProcessModules
EnumProcessModulesEx
EnumProcesses
EnumResourceLanguagesExA
EnumResourceLanguagesExW
EnumResourceNamesExA
EnumResourceNamesExW
EnumResourceNamesW
EnumResourceTypesExA
EnumResourceTypesExW
EnumSystemCodePagesW
EnumSystemFirmwareTables
EnumSystemGeoID
EnumSystemLanguageGroupsW
EnumSystemLocalesA
EnumSystemLocalesEx
EnumSystemLocalesW
EnumTimeFormatsEx
EnumTimeFormatsW
EnumUILanguagesW
EqualDomainSid
EqualPrefixSid
EqualSid
EscapeCommFunction
EventActivityIdControl
EventEnabled
EventProviderEnabled
EventRegister
EventSetInformation
EventUnregister
EventWrite
EventWriteString
EventWriteTransfer
ExitProcess
ExitThread
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
ExpungeConsoleCommandHistoryA
ExpungeConsoleCommandHistoryW
FatalAppExitA
FatalAppExitW
FileTimeToLocalFileTime
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FillConsoleOutputCharacterW
FindActCtxSectionGuid
FindActCtxSectionStringW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstFreeAce
FindFirstStreamW
FindFirstVolumeW
FindNLSString
FindNLSStringEx
FindNextChangeNotification
FindNextFileA
FindNextFileW
FindNextStreamW
FindNextVolumeW
FindResourceExW
FindResourceW
FindStringOrdinal
FindVolumeClose
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushConsoleInputBuffer
FlushFileBuffers
FlushInstructionCache
FlushProcessWriteBuffers
FlushViewOfFile
FoldStringW
FormatMessageA
FormatMessageW
FreeConsole
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
FreeLibraryWhenCallbackReturns
FreeResource
FreeSid
FreeUserPhysicalPages
GenerateConsoleCtrlEvent
GetACP
GetAcceptLanguagesA
GetAcceptLanguagesW
GetAce
GetAclInformation
GetApplicationRestartSettings
GetCPFileNameFromRegistry
GetCPHashNode
GetCPInfo
GetCPInfoExW
GetCalendar
GetCalendarInfoEx
GetCalendarInfoW
GetCommConfig
GetCommMask
GetCommModemStatus
GetCommProperties
GetCommState
GetCommTimeouts
GetCommandLineA
GetCommandLineW
GetCompressedFileSizeA
GetCompressedFileSizeW
GetComputerNameExA
GetComputerNameExW
GetConsoleAliasA
GetConsoleAliasExesLengthA
GetConsoleAliasExesLengthW
GetConsoleAliasW
GetConsoleAliasesLengthA
GetConsoleAliasesLengthW
GetConsoleCP
GetConsoleCommandHistoryA
GetConsoleCommandHistoryLengthA
GetConsoleCommandHistoryLengthW
GetConsoleCommandHistoryW
GetConsoleCursorInfo
GetConsoleDisplayMode
GetConsoleFontSize
GetConsoleInputExeNameA
GetConsoleInputExeNameW
GetConsoleMode
GetConsoleOriginalTitleA
GetConsoleOriginalTitleW
GetConsoleOutputCP
GetConsoleProcessList
GetConsoleScreenBufferInfo
GetConsoleScreenBufferInfoEx
GetConsoleTitleA
GetConsoleTitleW
GetConsoleWindow
GetCurrencyFormatEx
GetCurrencyFormatW
GetCurrentActCtx
GetCurrentConsoleFont
GetCurrentConsoleFontEx
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentPackageFamilyName
GetCurrentPackageFullName
GetCurrentPackageId
GetCurrentPackagePath
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentProcessorNumberEx
GetCurrentThread
GetCurrentThreadId
GetCurrentThreadStackLimits
GetDateFormatA
GetDateFormatEx
GetDateFormatW
GetDeviceDriverBaseNameA
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameA
GetDeviceDriverFileNameW
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetDynamicTimeZoneInformation
GetDynamicTimeZoneInformationEffectiveYears
GetEnabledXStateFeatures
GetEnvironmentStrings
GetEnvironmentStringsA
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetEraNameCountedString
GetErrorMode
GetExitCodeProcess
GetExitCodeThread
GetFallbackDisplayName
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileMUIInfo
GetFileMUIPath
GetFileSecurityW
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFileVersionInfoA
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
GetFinalPathNameByHandleA
GetFinalPathNameByHandleW
GetFullPathNameA
GetFullPathNameW
GetGeoInfoEx
GetGeoInfoW
GetHandleInformation
GetKernelObjectSecurity
GetLargePageMinimum
GetLargestConsoleWindowSize
GetLastError
GetLengthSid
GetLocalTime
GetLocaleInfoA
GetLocaleInfoEx
GetLocaleInfoHelper
GetLocaleInfoW
GetLogicalDriveStringsW
GetLogicalDrives
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLongPathNameA
GetLongPathNameW
GetMappedFileNameA
GetMappedFileNameW
GetModuleBaseNameA
GetModuleBaseNameW
GetModuleFileNameA
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetModuleInformation
GetNLSVersion
GetNLSVersionEx
GetNamedLocaleHashNode
GetNamedPipeAttribute
GetNamedPipeClientComputerNameW
GetNamedPipeHandleStateW
GetNamedPipeInfo
GetNativeSystemInfo
GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx
GetNumaProximityNodeEx
GetNumberFormatEx
GetNumberFormatW
GetNumberOfConsoleInputEvents
GetNumberOfConsoleMouseButtons
GetOEMCP
GetOverlappedResult
GetOverlappedResultEx
GetPackageFamilyName
GetPackageFullName
GetPackagePathByFullName
GetPackagesByPackageFamily
GetPerformanceInfo
GetPhysicallyInstalledSystemMemory
GetPriorityClass
GetPrivateObjectSecurity
GetProcAddress
GetProcessGroupAffinity
GetProcessHandleCount
GetProcessHeap
GetProcessHeaps
GetProcessId
GetProcessIdOfThread
GetProcessImageFileNameA
GetProcessImageFileNameW
GetProcessMemoryInfo
GetProcessMitigationPolicy

Sections

.text
Size: 516KB - Virtual size: 513KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0ad0f7f2dd450b16fef7bf81e28f435

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

Exports

Exports

Sections

.text Size: 516KB - Virtual size: 513KB

.data Size: 8KB - Virtual size: 7KB

.rodata Size: 8KB - Virtual size: 7KB

.rdata Size: 84KB - Virtual size: 81KB

/4 Size: 36KB - Virtual size: 35KB

.bss Size: - Virtual size: 7KB

.edata Size: 44KB - Virtual size: 42KB

.idata Size: 16KB - Virtual size: 14KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 516KB - Virtual size: 513KB

.data
Size: 8KB - Virtual size: 7KB

.rodata
Size: 8KB - Virtual size: 7KB

.rdata
Size: 84KB - Virtual size: 81KB

/4
Size: 36KB - Virtual size: 35KB

.bss
Size: - Virtual size: 7KB

.edata
Size: 44KB - Virtual size: 42KB

.idata
Size: 16KB - Virtual size: 14KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 24KB - Virtual size: 23KB