EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
1e68daeaacde83276ee1c06fd962cba5.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1e68daeaacde83276ee1c06fd962cba5.dll
Resource
win10v2004-20231222-en
General
-
Target
1e68daeaacde83276ee1c06fd962cba5
-
Size
164KB
-
MD5
1e68daeaacde83276ee1c06fd962cba5
-
SHA1
8c174eb9d3a78790e317740eef3e3b7d93e8b45b
-
SHA256
2d0fd9fe86000f3b3fadc3193f7b2eb533171a7f6942645300fb084ca427fd4c
-
SHA512
bc8da091f9fa5d7eec4319d53eed34a1e16b65060d4cf739920f9b1031d2c7076eb9445e012d21a4737b47f432eb2952fdabc3d4efa988d17dfbaf7449181612
-
SSDEEP
3072:4zrTT1eFJs2aV5jCo0B/fBWovbZ+cL0y//fVIo0pCBtE9lrp9uV:4/TBIJyrwflb4c+l1U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1e68daeaacde83276ee1c06fd962cba5
Files
-
1e68daeaacde83276ee1c06fd962cba5.dll windows:4 windows x86 arch:x86
ebe45b25e58b4afb9a31d0a95651f3e0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
xprt5
_XprtAtomicDecrement@4
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?Open@TFile@XPRT@@QAE_NPBGI_N@Z
?IsOpen@TFile@XPRT@@QBE_NXZ
??1TFile@XPRT@@UAE@XZ
??0TFile@XPRT@@QAE@XZ
_XprtMemRealloc@8
xprt_iswdigit
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?Replace@TBstr@XPRT@@QAEHPBG0@Z
xprt_strlen
_XprtInitialize@8
_XprtUninitialize@0
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
deflateInit2_
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
xprt_memset
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
_XprtMemAlloc@4
?Init@TFileInfo@XPRT@@IAEXPBGI_JABVTTime@2@22@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
_XprtMemFree@4
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
?GetInfo@TFile@XPRT@@SA_NPBGAAVTFileInfo@2@@Z
?SetLastWriteTime@TFile@XPRT@@SA_NPBGABVTTime@2@@Z
?CreatePath@TFile@XPRT@@SA_NPBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?Set@TTime@XPRT@@QAEXHHHHHH@Z
inflateInit2_
unzGoToFilePos
unzClose
unzGetGlobalInfo
unzCloseCurrentFile
unzOpen2
xprt_memmove
xprt_strcmp
_XprtAtomicIncrement@4
?Detach@TBstr@XPRT@@QAEPAGXZ
_XprtFreeString@4
deflate
??0TBstr@XPRT@@QAE@PBDPBG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
kSystemEncoding
?AddTrailingSeparator@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?FileNameFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
??0TFileFinder@XPRT@@QAE@XZ
??1TFileFinder@XPRT@@UAE@XZ
?Find@TFileFinder@XPRT@@QAE_NPBGI@Z
?FindNext@TFileFinder@XPRT@@QAE_NI@Z
?GetFileSpec@TFileFinder@XPRT@@QBE?AVTBstr@2@XZ
?GetYear@TTime@XPRT@@QBEHXZ
?GetMonth@TTime@XPRT@@QBEHXZ
?GetDay@TTime@XPRT@@QBEHXZ
?GetHour@TTime@XPRT@@QBEHXZ
?GetMinute@TTime@XPRT@@QBEHXZ
?GetSecond@TTime@XPRT@@QBEHXZ
?GetTm@TTime@XPRT@@QBE_NPAUtm@@@Z
?GetTickCount@TTime@XPRT@@SA?AV12@XZ
deflateEnd
unzOpenCurrentFile3
unzGoToNextFile
xprt_iswalnum
_XprtHashString@4
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
_XprtCompareString@8
_XprtCreateThread@8
_XprtAllocString@4
unzGetCurrentFileInfo
inflateEnd
unzGetFilePos
inflate
kUtf8Encoding
??0TBstr@XPRT@@QAE@PBG@Z
??0TBstr@XPRT@@QAE@GH@Z
??0TBstr@XPRT@@QAE@XZ
??1TBstr@XPRT@@QAE@XZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?IsEmpty@TBstr@XPRT@@QBE_NXZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
crc32
xprt_memcpy
unzReadCurrentFile
kernel32
ExitProcess
SetLastError
GetLastError
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
InterlockedExchange
CompareStringA
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
FreeLibrary
DisableThreadLibraryCalls
user32
MsgWaitForMultipleObjects
KillTimer
SetTimer
TranslateMessage
msvcrt
_initterm
??2@YAPAXI@Z
free
malloc
strcmp
qsort
_snwprintf
_purecall
memcpy
_except_handler3
strlen
fopen
fread
fwrite
ftell
fseek
fclose
__dllonexit
_adjust_fdiv
??3@YAXPAX@Z
_onexit
ole32
CoCreateInstance
CoUninitialize
CoRegisterMessageFilter
CreateBindCtx
CoInitializeEx
oleaut32
VariantClear
VariantCopy
VariantTimeToSystemTime
SysAllocString
VariantChangeType
VariantInit
SystemTimeToVariantTime
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
SafeArrayDestroy
SafeArrayCopy
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
Exports
Exports
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 63KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE