EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
e1715e895feccbc93958b0f23d8c6dfe05281102df124a007b1c89b28045157b.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e1715e895feccbc93958b0f23d8c6dfe05281102df124a007b1c89b28045157b.dll
Resource
win10v2004-20240226-en
General
-
Target
e1715e895feccbc93958b0f23d8c6dfe05281102df124a007b1c89b28045157b
-
Size
328KB
-
MD5
bcfe0359285c38b75852ef517368ca4e
-
SHA1
b8d034c8829e68ffc7a05236992fe46e64da52f6
-
SHA256
e1715e895feccbc93958b0f23d8c6dfe05281102df124a007b1c89b28045157b
-
SHA512
0bf361680c4cffc09d10fc3f603ac81a9146368f7ae8c194a110a300eab5ff0835f7646b3d153adc06975f9195dc17d26309bec51c89e9e1c6b7d5e80f0a94e0
-
SSDEEP
6144:7MinrvDPS5hhGY2AOxwu3tEI0/9f0iKcLX5pXfiTBqyCI:7MiDbS5hhGYZOGqfE90iL5pX6Tsg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e1715e895feccbc93958b0f23d8c6dfe05281102df124a007b1c89b28045157b
Files
-
e1715e895feccbc93958b0f23d8c6dfe05281102df124a007b1c89b28045157b.dll windows:4 windows x86 arch:x86
ab7224ec2715774b2cf0d3da72b2ed6e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
wininet
InternetCanonicalizeUrlW
InternetOpenA
InternetCanonicalizeUrlA
InternetCrackUrlA
ws2_32
recv
send
connect
bind
htons
socket
gethostbyname
closesocket
msimg32
GradientFill
kernel32
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
GetLastError
CreateThread
FreeLibrary
TlsAlloc
TlsSetValue
TlsGetValue
GetCurrentThreadId
FileTimeToSystemTime
CompareStringA
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
SetLastError
CloseHandle
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
CreateFileA
ReadFile
WriteFile
SetFilePointer
InterlockedExchange
GetVersionExA
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
DisableThreadLibraryCalls
InterlockedCompareExchange
ResetEvent
SetEvent
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
user32
UnionRect
OffsetRect
PtInRect
IntersectRect
GetSystemMetrics
BeginPaint
EndPaint
GetFocus
IsWindow
GetWindowThreadProcessId
AttachThreadInput
SetActiveWindow
InvalidateRect
CreateMenu
ReleaseDC
SetMenuInfo
ClientToScreen
TrackPopupMenu
MapWindowPoints
InvalidateRgn
GetWindowRect
ScreenToClient
FillRect
GetDesktopWindow
GetTopWindow
SetWindowPos
SetFocus
ShowWindow
GetClientRect
GetKeyState
GetParent
DestroyWindow
SetTimer
KillTimer
GetWindowDC
SetCapture
ReleaseCapture
GetDC
GetNextDlgTabItem
TranslateMessage
MsgWaitForMultipleObjects
CreatePopupMenu
gdi32
DeleteObject
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
CreateRectRgn
CombineRgn
GetCurrentObject
DeleteDC
GetStockObject
SetBkMode
SetTextAlign
SetTextColor
GetTextColor
CreateSolidBrush
advapi32
RegCloseKey
ole32
CoCreateGuid
CreateBindCtx
CoInitializeEx
CoRegisterMessageFilter
CoUninitialize
CoCreateInstance
oleaut32
VariantClear
SafeArrayRedim
SafeArrayPutElement
SafeArrayAccessData
SysAllocString
SafeArrayUnaccessData
SafeArrayDestroy
SysFreeString
VariantCopy
VariantChangeType
SafeArrayGetElement
SafeArrayCopy
SafeArrayUnlock
SafeArrayCreate
SafeArrayLock
VariantInit
SafeArrayCreateVector
xprt4
xprt_iswdigit
_XprtInitialize@8
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
_XprtUninitialize@0
xprt_memset
_XprtMemRealloc@8
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?Copy@TBstr@XPRT@@QBEPAGXZ
_XprtCreateThread@8
_XprtGetMilliseconds@0
xprt_memmove
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?SetSize@TPtrArray@XPRT@@QAEXHH@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
xprt_strcmp
_XprtAtomicDecrement@4
_XprtAtomicIncrement@4
?GetFileTime@TTime@XPRT@@QBEXAAU_FILETIME@@@Z
?IsOpen@TFile@XPRT@@QBE_NXZ
?GetLength@TFile@XPRT@@QBE_JXZ
?Read@TFile@XPRT@@QAEHPAXH@Z
?Set@TTime@XPRT@@QAEXHHHHHH@Z
?Replace@TBstr@XPRT@@QAEHPBG0@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Format@TBstr@XPRT@@QAAXPBGZZ
?IsEmpty@TBstr@XPRT@@QBE_NXZ
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
_XprtRequestMessageId@0
_XprtRegisterMessageCallback@8
_XprtPostMessage@16
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
_XprtUnregisterMessageCallback@4
_XprtReleaseMessageId@4
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
?Unlock@TCritSec@XPRT@@QAEXXZ
?Lock@TCritSec@XPRT@@QAEXXZ
?Term@TCritSec@XPRT@@QAEXXZ
?Init@TCritSec@XPRT@@QAEXXZ
?GetTickCount@TTime@XPRT@@SA?AV12@XZ
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
?RemoveTrailingSeparator@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?GetFileSpec@TFileFinder@XPRT@@QBE?AVTBstr@2@XZ
?FindNext@TFileFinder@XPRT@@QAE_NI@Z
?Close@TFileFinder@XPRT@@QAEXXZ
??0TFile@XPRT@@QAE@XZ
?Open@TFile@XPRT@@QAE_NPBGI_N@Z
?Write@TFile@XPRT@@QAEHPBXH@Z
?Close@TFile@XPRT@@QAE_NXZ
??1TFile@XPRT@@UAE@XZ
?GetInfo@TFile@XPRT@@SA_NPBGAAVTFileInfo@2@@Z
?CreatePath@TFile@XPRT@@SA_NPBG@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
??0TFileFinder@XPRT@@QAE@XZ
?Find@TFileFinder@XPRT@@QAE_NPBGI@Z
?SetAttributes@TFile@XPRT@@SA_NPBGI@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?Remove@TFile@XPRT@@SA_NPBG@Z
??1TFileFinder@XPRT@@UAE@XZ
?Init@TFileInfo@XPRT@@IAEXPBGI_JABVTTime@2@22@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??0TBstr@XPRT@@QAE@ABV01@@Z
?Detach@TBstr@XPRT@@QAEPAGXZ
??0TBstr@XPRT@@QAE@XZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
??0TBstr@XPRT@@QAE@PBG@Z
??1TPtrArray@XPRT@@QAE@XZ
??0TPtrArray@XPRT@@QAE@XZ
?GetTime64@TTime@XPRT@@QBE_JXZ
??1TBstr@XPRT@@QAE@XZ
kSystemEncoding
_XprtMemFree@4
_XprtMemAlloc@4
??0TBstr@XPRT@@QAE@PBDPBG@Z
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?RemoveAt@TPtrArray@XPRT@@QAEXHH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Set@TTime@XPRT@@QAEXN@Z
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
_XprtGetMessageQueue@0
msvcr71
_itow
_vsnwprintf
fclose
fwrite
fopen
strncat
malloc
strcat
fread
ftell
fseek
__security_error_handler
__dllonexit
_onexit
toupper
_adjust_fdiv
__CppXcptFilter
memmove
wcscmp
wcslen
towlower
towupper
localtime
strftime
_itoa
wcscpy
wcsncpy
iswdigit
iswspace
_wtol
sprintf
_initterm
__CxxFrameHandler
swscanf
sscanf
memcpy
strlen
_strnicmp
strncpy
_wcsicmp
_purecall
_stricmp
??2@YAPAXI@Z
??3@YAXPAX@Z
free
_except_handler3
abs
memset
urlmon
CoInternetGetSession
HlinkSimpleNavigateToString
comctl32
InitCommonControlsEx
Exports
Exports
Sections
.text Size: 188KB - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ