General

Malware Config

Signatures

Files

• f39944ecd04770457c54f04a1af6bec78538dedd9bb3c27ff4cd4d27e2b60624

  .dll windows:4 windows x86 arch:x86

  fd66a6e0820072277a8b1cae1f84f73c

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  t:\sps\x86\ship\0\portalconnectcore.pdb

  Imports

  shlwapi

  PathRemoveFileSpecW

  wnsprintfA

  shell32

  SHGetDesktopFolder

  SHGetSpecialFolderPathW

  kernel32

  EnumSystemLocalesW

  EnumUILanguagesW

  IsProcessorFeaturePresent

  ReleaseSemaphore

  GlobalMemoryStatus

  GetCurrentThread

  lstrcmpiW

  GetLastError

  DeleteCriticalSection

  InitializeCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  RaiseException

  lstrlenW

  VirtualProtect

  QueryPerformanceCounter

  GetTempFileNameA

  GetTempPathA

  InterlockedCompareExchange

  GetModuleFileNameW

  DisableThreadLibraryCalls

  FreeLibrary

  MultiByteToWideChar

  SizeofResource

  LoadResource

  FindResourceW

  LoadLibraryExW

  GetModuleHandleW

  CompareStringW

  LoadLibraryW

  GetLocaleInfoW

  InterlockedExchange

  GetACP

  GetLocaleInfoA

  GetThreadLocale

  GetVersionExA

  CreateDirectoryW

  IsValidCodePage

  GetStringTypeExW

  IsDBCSLeadByte

  GlobalAlloc

  GetCurrentThreadId

  GetCurrentProcessId

  TerminateProcess

  Sleep

  CreateProcessA

  GlobalFree

  LocalAlloc

  LocalFree

  GetUserDefaultLangID

  GetUserDefaultLCID

  GetSystemInfo

  GetDiskFreeSpaceExW

  GetTimeZoneInformation

  GetVersionExW

  GetSystemDirectoryW

  GetModuleFileNameA

  GetShortPathNameA

  CreateSemaphoreA

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  GetModuleHandleA

  GetProcAddress

  GetFileAttributesW

  GetVersion

  WideCharToMultiByte

  SetLastError

  OutputDebugStringA

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  GetSystemDefaultLCID

  TlsSetValue

  VirtualFree

  TlsGetValue

  TlsFree

  WaitForSingleObject

  ReleaseMutex

  CloseHandle

  GetSystemTimeAsFileTime

  GetTickCount

  WriteFile

  SetFileAttributesW

  OpenMutexA

  FlushFileBuffers

  DeleteFileW

  GetSystemDefaultLangID

  IsValidLocale

  GetProcessHeap

  HeapFree

  HeapSize

  HeapValidate

  HeapAlloc

  HeapReAlloc

  VirtualAlloc

  GetFileType

  CreateFileW

  ExpandEnvironmentStringsW

  GetProcessTimes

  GetCurrentProcess

  CreateMutexA

  user32

  ReleaseDC

  GetDC

  GetSystemMetrics

  SystemParametersInfoA

  GetMenuCheckMarkDimensions

  GetKeyboardLayout

  GetMonitorInfoA

  EnumDisplayMonitors

  GetSysColor

  CharNextW

  MessageBoxW

  LoadStringW

  UnregisterClassA

  advapi32

  OpenThreadToken

  RegEnumValueA

  RegEnumKeyW

  RegEnumValueW

  RegQueryInfoKeyA

  RegOpenKeyExA

  GetLengthSid

  AddAccessAllowedAce

  AddAccessDeniedAce

  InitializeAcl

  AllocateAndInitializeSid

  CopySid

  GetTokenInformation

  OpenProcessToken

  FreeSid

  SetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  GetSecurityDescriptorDacl

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ConvertSidToStringSidA

  CheckTokenMembership

  IsValidSid

  RegQueryValueExA

  RegDeleteKeyW

  RegDeleteValueW

  RegCloseKey

  RegCreateKeyExW

  RegOpenKeyExW

  RegSetValueExW

  RegQueryInfoKeyW

  RegEnumKeyExW

  RegQueryValueExW

  RegDeleteValueA

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  secur32

  GetUserNameExW

  ole32

  CoCreateFreeThreadedMarshaler

  CreateBindCtx

  CoTaskMemAlloc

  CoCreateInstance

  CoTaskMemRealloc

  CoTaskMemFree

  oleaut32

  SysStringByteLen

  SysAllocStringByteLen

  SafeArrayCreate

  SafeArrayAccessData

  SafeArrayUnaccessData

  VarBstrCmp

  LoadRegTypeLi

  VarUI4FromStr

  LoadTypeLi

  SysAllocString

  VariantClear

  VariantInit

  SysFreeString

  SysStringLen

  wininet

  InternetCrackUrlW

  activeds

  ord9

  rpcrt4

  UuidCreate

  gdi32

  CreateSolidBrush

  CreateDCA

  DeleteDC

  GetDeviceCaps

  DeleteObject

  msvcr80

  fgetws

  ?_type_info_dtor_internal_method@type_info@@QAEXXZ

  __clean_type_info_names_internal

  _crt_debugger_hook

  _onexit

  _lock

  __dllonexit

  _unlock

  ?terminate@@YAXXZ

  _except_handler4_common

  __CppXcptFilter

  _adjust_fdiv

  _amsg_exit

  _initterm_e

  _initterm

  _decode_pointer

  _encoded_null

  _encode_pointer

  fopen_s

  fwprintf_s

  vsprintf_s

  vswprintf_s

  wcsrchr

  _wcsicmp

  _vsnprintf

  _CIsqrt

  memmove

  _wfopen

  _malloc_crt

  fclose

  memcpy

  _vsnwprintf

  memset

  _recalloc

  __CxxFrameHandler3

  wcsncpy_s

  wcscpy_s

  _CxxThrowException

  memcpy_s

  free

  malloc

  Exports

  Exports

  DllCanUnloadNow

  DllGetClassObject

  Sections

  .text

  Size: 249KB - Virtual size: 248KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 198KB - Virtual size: 223KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 277KB - Virtual size: 280KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ