JKbtgdfd
_AllocateExecutableMemory@4
_AllocateMemory@4
_AllocateReadOnlyMemory@4
_ChangeMemoryProtection@16
_CompareMemory@12
_FindPattern@16
_FreeMemory@4
_GCopyMemory@12
_GFillMemory@12
_GMoveMemory@12
_GZeroMemory@8
_ReadMemory@12
_WriteMemory@12
Static task
static1
1 signatures
General
-
Target
zhwzxmwaqy.dll
-
Size
11KB
-
MD5
6165588ec3553b2fa1f761c423d5fe09
-
SHA1
558f27f32c70441f53a16847437eca0aa37418dc
-
SHA256
ad9c380477cf715de73690f9b332dd77eb13cea4d960381fab6043c1a4eea787
-
SHA512
94cfe4e303a1c45b2e13e43c918f223b1829e755b3cc213fca450fa51d74390e0a59d88fbdfc22430111667f015f1c8f8d3b8f1704f0ad1106254781e4eb498f
-
SSDEEP
192:y5n4z5TxDVI+aRtFDP+qfaSddz0rCt3fc5B1Q1aJo:yV4zmXPDiSddgHi
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource zhwzxmwaqy.dll
Files
-
zhwzxmwaqy.dll.dll windows:6 windows x86 arch:x86
6a2782b4240d903051f23421bea80a1b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
imm32
ImmGetIMEFileNameA
ImmUnlockIMCC
ImmGetRegisterWordStyleW
ImmDestroyIMCC
shlwapi
SHQueryInfoKeyW
StrCmpNIA
PathFindNextComponentA
UrlIsOpaqueA
UrlIsNoHistoryW
StrStrW
StrCmpNIW
PathGetArgsA
kernel32
IsProcessorFeaturePresent
EnumSystemCodePagesA
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualFree
VirtualAlloc
CloseHandle
rtutils
RouterLogEventDataW
TraceDumpExA
TraceRegisterExW
RouterGetErrorStringW
TracePrintfA
TraceDeregisterW
RouterLogDeregisterA
TraceDeregisterA
winspool.drv
ord215
AddFormA
ord202
EnumPrintProcessorDatatypesW
AddPrinterDriverW
resutils
ResUtilFindDwordProperty
ResUtilVerifyResourceService
ResUtilGetSzProperty
ResUtilVerifyPropertyTable
ResUtilGetDwordValue
ResUtilAddUnknownProperties
ResUtilGetPropertiesToParameterBlock
wsnmp32
ord104
ord606
ord905
ord101
ord503
ord603
ord105
ord102
setupapi
SetupDiEnumDeviceInterfaces
SetupAddToDiskSpaceListW
SetupGetLineCountW
SetupDiCreateDeviceInfoList
SetupGetMultiSzFieldA
shell32
WOWShellExecute
SHGetSpecialFolderLocation
SHFileOperation
DragQueryFileAorW
DoEnvironmentSubstW
rtm
MgmGetFirstMfe
MgmDeInitialize
RtmDeregisterClient
MgmGetMfe
RtmGetNetworkCount
Exports
Exports
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 446B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ