General

Malware Config

Signatures

Files

• 33715abdf13302b4e38bb97539f308e5

  .dll regsvr32 windows:5 windows x86 arch:x86

  c0311540a18bc59a778556eadc5edbd2

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  advapi32

  RegQueryValueExA

  RegDeleteValueA

  RegDeleteKeyA

  GetUserNameA

  QueryServiceStatus

  FreeSid

  AddAccessAllowedAce

  OpenSCManagerA

  RegSetValueExA

  RegCloseKey

  CreateProcessAsUserA

  GetLengthSid

  InitializeAcl

  RegEnumKeyExA

  RegCreateKeyExA

  RegOpenKeyExA

  OpenServiceA

  InitializeSecurityDescriptor

  OpenThreadToken

  RevertToSelf

  SetThreadToken

  AllocateAndInitializeSid

  CloseServiceHandle

  SetSecurityDescriptorDacl

  cdosys

  DllRegisterServer

  cnvfat

  IsConversionAvailable

  gdi32

  GetDCOrgEx

  CreateDCA

  GetClipBox

  DeleteDC

  ExtEscape

  htui

  HTUI_ColorAdjustmentA

  imgutil

  DitherTo8

  kbdaze

  KbdLayerDescriptor

  kbdhela2

  KbdLayerDescriptor

  kbdro

  KbdLayerDescriptor

  kbdtuf

  KbdLayerDescriptor

  kernel32

  SetFilePointer

  SetCurrentDirectoryA

  TerminateProcess

  VirtualFree

  GetCurrentProcess

  MultiByteToWideChar

  GetEnvironmentStringsW

  lstrcpyA

  GetCurrentThreadId

  IsBadWritePtr

  GetExitCodeProcess

  ReleaseMutex

  WaitForMultipleObjects

  GetLastError

  TerminateThread

  OutputDebugStringA

  GetStartupInfoA

  GetModuleHandleA

  CreateProcessA

  SetUnhandledExceptionFilter

  CallNamedPipeA

  ResetEvent

  CreateThread

  Sleep

  HeapDestroy

  CreateMutexA

  GetStringTypeW

  GetSystemInfo

  SetConsoleCtrlHandler

  QueryPerformanceCounter

  GetFileType

  GetStringTypeA

  GetVersionExA

  HeapCreate

  GetOEMCP

  LCMapStringA

  GetACP

  GetCPInfo

  WriteFile

  CreateEventA

  FreeEnvironmentStringsA

  InterlockedExchange

  ExitProcess

  RtlUnwind

  GetModuleFileNameA

  RaiseException

  SetEvent

  GetStdHandle

  HeapReAlloc

  UnhandledExceptionFilter

  FlushFileBuffers

  LoadLibraryW

  GetCommandLineA

  VirtualProtect

  HeapAlloc

  VirtualAlloc

  SetHandleCount

  FreeEnvironmentStringsW

  SetStdHandle

  IsBadCodePtr

  LoadLibraryA

  VirtualProtectEx

  GetProcAddress

  CloseHandle

  GetTickCount

  ReadFile

  HeapFree

  GetProcessHeap

  GetEnvironmentStrings

  LCMapStringW

  FreeLibrary

  GetLocaleInfoA

  GetCurrentThread

  WideCharToMultiByte

  GetCurrentProcessId

  WaitForSingleObject

  OpenEventA

  IsBadReadPtr

  VirtualQuery

  ole32

  StringFromGUID2

  CoCreateInstance

  CoInitializeEx

  CoUninitialize

  setupapi

  SetupDiGetDeviceRegistryPropertyA

  CM_Get_Parent

  SetupDiSetClassInstallParamsA

  CM_Reenumerate_DevNode

  SetupDiEnumDeviceInfo

  CM_Get_Device_ID_ExA

  SetupDiOpenDevRegKey

  SetupDiGetClassDevsA

  CM_Get_DevNode_Registry_PropertyA

  SetupDiGetDeviceInstanceIdA

  SetupDiCallClassInstaller

  SetupDiDestroyDeviceInfoList

  tapisrv

  ServiceMain

  untfs

  Recover

  user32

  SystemParametersInfoA

  CallNextHookEx

  SetWindowsHookExA

  EnumDisplaySettingsA

  IsIconic

  GetWindowPlacement

  EnumDisplayDevicesA

  GetSystemMetrics

  GetWindowRect

  EnumDisplaySettingsExA

  OffsetRect

  RegisterDeviceNotificationA

  UnhookWindowsHookEx

  IntersectRect

  ChangeDisplaySettingsExA

  UnregisterDeviceNotification

  wdigest

  CredentialUpdateFree

  Exports

  Exports

  Subconjunctival

  Ungladden

  Narcissine

  DllRegisterServer

  Striga

  Fatefully

  Microphthalmia

  Galinsoga

  Mulattress

  Superinnocent

  Tearlessness

  Leperdom

  Plurinominal

  Hearthstone

  Ipil

  Mudir

  Disafforest

  Coexclusive

  Jovianly

  Labelloid

  Scenical

  Xeres

  Unsurnamed

  Taxite

  Betulites

  Lamellule

  Patrimonially

  Hyperanarchy

  Araliophyllum

  Morganite

  Struthioid

  Nucellar

  Mozambican

  DllUnregisterServer

  Nondegreased

  Vesania

  Montanist

  Hexangularly

  Inflexed

  Nonfarm

  Unsurrendered

  Myalism

  Sunweed

  Fennelflower

  Palmospasmus

  Poultryist

  Steelification

  Vulgarish

  Porchless

  Sections

  CODE

  Size: 134KB - Virtual size: 176KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 185KB - Virtual size: 227KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ