RFDZPMAPI[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

RFDZPMAPI.dll
Size

216KB
MD5

bb909e0f6c78a63a679920eb8cb4c646
SHA1

2b7d17032b7562e9d00c3abb32ec8dcca5fcf389
SHA256

ccbdad2bb3a8f5de0f28159ca4c7697bb9715dd7c6ad1e47226ceca18a3510da
SHA512

73385dfd09f931f421fb621c02b673b6ca6e8e0a3d9ca04b2dd486601c006457836359893369a77fa4c33e913660e92f06d57c68f08b60a3a45db90eb75471ab
SSDEEP

6144:TmOlcWYgSLV2kg6Fpm7SJQ5dSGIFCFdMVId:iOlcWlSIkg6LmLSfCbMVId

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RFDZPMAPI.dll

Files

RFDZPMAPI.dll
.dll windows:4 windows x86 arch:x86

c1d73942c992f8bbfc67710fa7a16184

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
FreeLibrary
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapAlloc
HeapFree
GetLastError
GetFileAttributesA
DeleteFileA
MoveFileA
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
ReadFile
CloseHandle
InitializeCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
SetFilePointer
WriteFile
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetStdHandle
FlushFileBuffers
CreateFileA
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

E4AcrCup
E4AcrIt
E4AtribCP
E4Aut
E4AutEsp
E4AvancaPapel
E4CanCup
E4CanCupEsp
E4CanIt
E4CancelaCCD
E4CancelaCCDEsp
E4Close
E4ConImp
E4Cons
E4CorteImp
E4DesCup
E4DesIt
E4ExpDoc
E4FimCP
E4FimCup
E4FimDoc
E4GenRFD
E4GenRFD_COO
E4GetError
E4ImpChq
E4ImpCodB
E4ImpItem
E4ImpVinc
E4InfCup
E4InfECF
E4InfEspECF
E4IniCP
E4IniCup
E4IteCF
E4IteCFEsp
E4IteCFEsp2
E4LMF
E4LMFSerial
E4LeCMC7
E4LeMFD
E4LeMFDEsp
E4OpeCNF
E4Open
E4OpenGv
E4Print
E4ProgOp
E4RPCria
E4RPLe
E4RPPrim
E4RPProx
E4RdData
E4RegMemFisc
E4RegPag
E4RegPagEsp
E4StaECF
E4StatGv
E4Status
E4TermAcrCup
E4TermAcrIt
E4TermAtribCP
E4TermAut
E4TermAutEsp
E4TermAvancaPapel
E4TermCanCup
E4TermCanCupEsp
E4TermCanIt
E4TermCancelaCCD
E4TermCancelaCCDEsp
E4TermClose
E4TermConImp
E4TermCons
E4TermCorteImp
E4TermDesCup
E4TermDesIt
E4TermExpDoc
E4TermFimCP
E4TermFimCup
E4TermFimDoc
E4TermGenRFD
E4TermGenRFD_COO
E4TermGetError
E4TermImpChq
E4TermImpCodB
E4TermImpItem
E4TermImpVinc
E4TermInfCup
E4TermInfECF
E4TermInfEspECF
E4TermIniCP
E4TermIniCup
E4TermIteCF
E4TermIteCFEsp
E4TermIteCFEsp2
E4TermLMF
E4TermLMFSerial
E4TermLeCMC7
E4TermLeMFD
E4TermLeMFDEsp
E4TermOpeCNF
E4TermOpen
E4TermOpenGv
E4TermPrint
E4TermProgOp
E4TermRPCria
E4TermRPLe
E4TermRPPrim
E4TermRPProx
E4TermRdData
E4TermRegMemFisc
E4TermRegPag
E4TermRegPagEsp
E4TermStaECF
E4TermStatGv
E4TermStatus
E4TermValAtu
E4TermValImp
E4TermValRed
E4TermVerRP
E4TermVerao
E4ValAtu
E4ValImp
E4ValRed
E4VerRP
E4Verao
Itautec_ECF_DadosdaUltimaReducao
Itautec_ECF_DataHoraGravacaoSWBa
Itautec_ECF_DataHoraGravacaoSWBasicoMFAdicional
Itautec_ECF_DataHoraUltimaReduca
Itautec_ECF_DataHoraUltimaReducaoZ
Itautec_ECF_DataHoraUltimoDocumento
Itautec_ECF_DataUltimoMovimento
Itautec_ECF_InformaMeiosPagamento
Itautec_ECF_SintegraGeraRegistro60A
Itautec_ECF_SintegraGeraRegistro60D
Itautec_ECF_SintegraGeraRegistro60I
Itautec_ECF_SintegraGeraRegistro60M
Itautec_ECF_SintegraGeraRegistro60R
Itautec_ECF_TotalizadorParcial

Sections

.text
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c1d73942c992f8bbfc67710fa7a16184

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 159KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 28KB - Virtual size: 35KB

.rsrc Size: 4KB - Virtual size: 952B

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 160KB - Virtual size: 159KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 28KB - Virtual size: 35KB

.rsrc
Size: 4KB - Virtual size: 952B

.reloc
Size: 12KB - Virtual size: 10KB