91207a7eb474139f32b6673fdf8e28e2af11461abd17274b1eef5019ad31f77a

Sharing

Copy URL

Twitter E-mail

General

Target

91207a7eb474139f32b6673fdf8e28e2af11461abd17274b1eef5019ad31f77a
Size

5.4MB
MD5

93f1d6dde649d2950325019311d16fb2
SHA1

8aefa91e9d267e9fbe987b665c47938c15f1856b
SHA256

91207a7eb474139f32b6673fdf8e28e2af11461abd17274b1eef5019ad31f77a
SHA512

0a5a8f1389539d546eee236f820ee9cedfdec87af03e13ec04adbac7886dca83818c9573f6440f3a514e356a5872b3288a9701a7e64d83ea692a942b537d5dcb
SSDEEP

98304:C5G04P+kRmd9a5XK1OtVxA1Ok+niWLgO/hiTjhX+BMmb7vFPlr:C5G04P+kod9PuNHniWLgihihX+BP3P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
91207a7eb474139f32b6673fdf8e28e2af11461abd17274b1eef5019ad31f77a

Files

91207a7eb474139f32b6673fdf8e28e2af11461abd17274b1eef5019ad31f77a
.dll windows:6 windows x86 arch:x86

965c2b10cb87931ea27fa32f478caff7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\dbs\el\dec\target\x86\ship\msodll_20\x-none\Mso20Win32Client.pdb

Imports

kernel32

GetVersionExW
GetModuleHandleA
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
LocalFree
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
FileTimeToDosDateTime
CompareFileTime
K32EnumProcessModulesEx
CreateThread
CreateEventW
WaitForMultipleObjectsEx
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
LoadLibraryExA
GetFileType
CopyFileW
CreateFileW
CopyFileExW
CreateFileMappingW
MapViewOfFileEx
SetEndOfFile
SetFilePointer
SetFilePointerEx
ReadFile
WriteFile
GetOverlappedResult
GetFileAttributesW
UnlockFile
LockFile
CreateFileA
DeleteFileW
MoveFileExW
ReplaceFileW
GetTempFileNameW
GetFileAttributesExW
SetFileAttributesW
SetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileExW
FindNextFileW
FindClose
CreateDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
VirtualProtectEx
GetSystemInfo
GlobalFree
GlobalAlloc
LocalAlloc
GetLocalTime
GetComputerNameW
HeapAlloc
GetProcessHeap
HeapFree
HeapCreate
HeapDestroy
HeapReAlloc
HeapSize
VirtualAlloc
K32GetProcessMemoryInfo
GlobalReAlloc
GlobalSize
GlobalLock
GlobalUnlock
CreateMemoryResourceNotification
GetSystemPowerStatus
GetProcessTimes
IsSystemResumeAutomatic
Sleep
SleepEx
GetTickCount
QueryUnbiasedInterruptTime
TerminateProcess
GetModuleFileNameA
GetModuleHandleExW
K32GetModuleFileNameExW
FindResourceW
SizeofResource
LoadResource
IsWow64Process
OpenProcess
OpenEventW
GetCurrentThread
OpenEventA
CreateEventA
OpenMutexA
CreateMutexA
OpenSemaphoreA
CreateSemaphoreA
OpenFileMappingA
CreateFileMappingA
IsProcessInJob
QueryInformationJobObject
MapViewOfFile
SignalObjectAndWait
GetProcessAffinityMask
GetLogicalProcessorInformationEx
CreateWaitableTimerW
SetWaitableTimerEx
CancelWaitableTimer
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
QueryFullProcessImageNameW
IsProcessorFeaturePresent
CreateIoCompletionPort
PostQueuedCompletionStatus
GetThreadIOPendingFlag
GetQueuedCompletionStatus
IsDebuggerPresent
WaitForMultipleObjects
MulDiv
GetTempPathW
CompareStringOrdinal
GetEnvironmentVariableW
GetLongPathNameW
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetVersionExA
GetFileSize
ReadProcessMemory
OpenThread
SuspendThread
ResumeThread
GetThreadContext
GetPriorityClass
GetThreadPriority
GetThreadTimes
VirtualQueryEx
CreateToolhelp32Snapshot
Module32First
Module32Next
Module32FirstW
Module32NextW
Thread32Next
Thread32First
VirtualQuery
VirtualProtect
K32GetModuleBaseNameW
LCMapStringEx
GetSystemDirectoryW
GetShortPathNameW
RemoveDirectoryW
GetDriveTypeW
LoadLibraryA
GetFileSizeEx
DeviceIoControl
FlushFileBuffers
CancelIoEx
GetDiskFreeSpaceExW
GetWindowsDirectoryW
SetErrorMode
GetSystemFirmwareTable
FormatMessageW
FormatMessageA
GetLogicalProcessorInformation
GetNativeSystemInfo
GetPhysicallyInstalledSystemMemory
GetProductInfo
K32EnumProcessModules
K32GetModuleInformation
GetCurrentProcess
VerifyVersionInfoW
VerSetConditionMask
CompareStringEx
RaiseException
GlobalMemoryStatusEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetStringTypeW
CreateProcessW
GetStartupInfoW
LoadLibraryExW
FreeLibrary
lstrlenW
GetProcAddress
GetModuleHandleW
SetEvent
ResetEvent
FlushViewOfFile
UnmapViewOfFile
DisableThreadLibraryCalls
TlsSetValue
FlsSetValue
TlsGetValue
FlsGetValue
TlsFree
FlsFree
TlsAlloc
FlsAlloc
WaitForSingleObjectEx
OpenMutexW
CreateMutexExW
ReleaseMutex
RtlCaptureStackBackTrace
InterlockedPopEntrySList
InterlockedPushEntrySList
InitializeSListHead
TryEnterCriticalSection
CloseHandle
CreateEventExW
QueryDepthSList
GetCPInfoExW
GetStringTypeExW
FileTimeToSystemTime
SystemTimeToFileTime
DeleteCriticalSection
GetSystemTime
WideCharToMultiByte
IsValidCodePage
GetUserDefaultLocaleName
SetLastError
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetLastError
MultiByteToWideChar
GetCurrentThreadId
GetCurrentProcessId
GetTickCount64
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
GetShortPathNameA

ole32

IIDFromString
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
CoRevokeInitializeSpy
CoRegisterInitializeSpy
CoRevertToSelf
CoImpersonateClient
CoTaskMemFree
StringFromCLSID
CoGetMalloc
WriteClassStm
StgCreateStorageEx
WriteClassStg
CoGetObjectContext
CLSIDFromProgID
CoSetProxyBlanket
WriteFmtUserTypeStg
CoUninitialize
CoInitializeEx
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateStreamOnHGlobal
CLSIDFromString
StringFromGUID2
CoCreateGuid
StgOpenStorage
StgOpenStorageEx
StgCreateDocfile

advapi32

CryptHashData
AllocateAndInitializeSid
AddAccessAllowedAce
InitializeAcl
CopySid
GetLengthSid
OpenProcessToken
OpenThreadToken
RegQueryValueExW
RegGetValueW
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid
GetTokenInformation
SetFileSecurityW
GetFileSecurityW
EventUnregister
EventRegister
CryptDeriveKey
CryptSetHashParam
CryptCreateHash
CryptGetHashParam
CryptContextAddRef
CryptDestroyHash
CryptVerifySignatureW
CryptSignHashW
CryptGetUserKey
CryptDestroyKey
CryptAcquireContextW
CryptReleaseContext
RegCloseKey
RegQueryValueW
RegOpenKeyExW
EventWriteTransfer
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
ConvertSidToStringSidW
CheckTokenMembership
CreateWellKnownSid
EqualSid
AddAccessAllowedAceEx
AddAce
SetSecurityInfo
RegNotifyChangeKeyValue
RevertToSelf
RegEnumValueW
RegCreateKeyExW
RegOpenKeyExA
RegQueryValueExA
EventWrite
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteTreeW
RegDeleteKeyW
RegSetValueExW
RegDeleteValueW
FreeSid

oleaut32

VariantClear
VariantInit
VariantChangeType
VariantCopy
VarCmp
SysFreeString
SysAllocString
SysAllocStringLen
SysStringLen
SysStringByteLen

vcruntime140

__std_terminate
__CxxFrameHandler3
_purecall
wcschr
_set_purecall_handler
__std_exception_destroy
__std_exception_copy
__std_type_info_compare
wcsrchr
strchr
wcsstr
strrchr
__std_type_info_name
_except_handler4_common
memmove
memcpy
memcmp
memchr
_CxxThrowException
__std_type_info_destroy_list
memset

msvcp140

?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
_Thrd_start
_Mtx_destroy
_Cnd_destroy
_Cnd_do_broadcast_at_thread_exit
_Mtx_init
_Cnd_init
_Mtx_current_owns
_Cnd_timedwait
?toupper@?$ctype@_W@std@@QBE_W_W@Z
?setf@ios_base@std@@QAEHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE_W_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
_Cnd_register_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_wait
_Cnd_broadcast
_Cnd_signal
_Cnd_destroy_in_situ
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
_Cnd_init_in_situ
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?is@?$ctype@D@std@@QBE_NFD@Z
_Strcoll
_Strxfrm
?id@?$collate@D@std@@2V0locale@2@A
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
?uncaught_exceptions@std@@YAHXZ
?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
?is@?$ctype@_W@std@@QBE_NF_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setf@ios_base@std@@QAEHHH@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
_Thrd_join
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
_Thrd_id
?_Xout_of_range@std@@YAXPBD@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z
_Thrd_sleep
_Xtime_get_ticks
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?width@ios_base@std@@QAE_J_J@Z
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
_Query_perf_counter
_Query_perf_frequency
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?flags@ios_base@std@@QAEHH@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?classic@locale@std@@SAABV12@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Locinfo@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0_Locinfo@std@@QAE@PBD@Z
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Syserror_map@std@@YAPBDH@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?exceptions@ios_base@std@@QBEHXZ
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
??0id@locale@std@@QAE@I@Z
?_Getcat@facet@locale@std@@SAIPAPBV123@PBV23@@Z
?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z
?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??Bios_base@std@@QBE_NXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
_Cnd_unregister_at_thread_exit

api-ms-win-crt-heap-l1-1-0

free
calloc
realloc
malloc

api-ms-win-crt-runtime-l1-1-0

_set_invalid_parameter_handler
terminate
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_initterm
_invalid_parameter_noinfo
_errno
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_configure_narrow_argv
signal
_clearfp
_initialize_narrow_environment
strerror_s
_initialize_onexit_table
_initterm_e

api-ms-win-crt-string-l1-1-0

strcmp
strcpy_s
iswspace
isalpha
tolower
isspace
ispunct
isdigit
isxdigit
strnlen
wcscspn
strcat_s
wcsncat_s
wmemcpy_s
wcsncmp
wcscpy_s
towlower
towupper
_stricmp
wcsnlen
wcscat_s
iswalpha
wcscmp
wcsncpy_s
_wcsicmp
strncpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vswscanf
_read
_close
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
_write
_lseeki64
__stdio_common_vsprintf_s
_sopen_s
fclose
_wsopen_s
fwrite
_wfopen_s
setvbuf

api-ms-win-crt-convert-l1-1-0

strtol
mbstowcs_s
_ui64toa_s
strtod
atoll
_i64tow_s
_wtoi
_itow_s
wcstod
_wcstoui64
_wcstoi64
wcstol
wcstoul

api-ms-win-crt-time-l1-1-0

wcsftime
_difftime64
_mktime64
_gmtime64
_localtime64_s
_time64

api-ms-win-crt-math-l1-1-0

_libm_sse2_log_precise
_libm_sse2_pow_precise
_fdopen
round
_libm_sse2_exp_precise
_dsign
_except1

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

Exports

Exports

_MsoFPuncWch@4
_MsoFSpaceWch@4
_MsoWchToLowerLid@12
_MsoWchToUpperLid@12

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 115KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

965c2b10cb87931ea27fa32f478caff7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ole32

advapi32

oleaut32

vcruntime140

msvcp140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 115KB - Virtual size: 131KB

.rsrc Size: 78KB - Virtual size: 77KB

.reloc Size: 1.3MB - Virtual size: 1.3MB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 115KB - Virtual size: 131KB

.rsrc
Size: 78KB - Virtual size: 77KB

.reloc
Size: 1.3MB - Virtual size: 1.3MB