freeofice[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
freeofice.dll
Size 336KB
Sample220413-kz463aebc6
SHA256 29e8bf78ac6bfd95c21e2cbb06a0a9d8088fe9e759673c81eeadd96d681b73ed
MD5 5e3bf7458c6d8e6e880db72fcdf61f3a
SHA1 dbe5b4db4b61702f523b86be1d73b742b8d120eb
SHA512 e752eb1afda0d507b3239eb159fd4d515b73193266f494047262cb0df73ea4ccf83a597efd0d3fefea0c992e0210a48123f0b520a0802ec8fe627872336e53d8
SSDEEP 6144:3VYe1K4PEIBn308Yw0PY6xLBhN4b8H/I9TS4a+KqKwnhVyCTs:ies4c0E8f09Dm4QB1KdwhVyCTs
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

freeofice.dll

.dll 336KB

freeofice.dll

IMPHASH 37987333ff274c9bd7aa5aebc79b81a2
SHA256 29e8bf78ac6bfd95c21e2cbb06a0a9d8088fe9e759673c81eeadd96d681b73ed
MD5 5e3bf7458c6d8e6e880db72fcdf61f3a
SHA1 dbe5b4db4b61702f523b86be1d73b742b8d120eb
SHA512 e752eb1afda0d507b3239eb159fd4d515b73193266f494047262cb0df73ea4ccf83a597efd0d3fefea0c992e0210a48123f0b520a0802ec8fe627872336e53d8
SSDEEP 6144:3VYe1K4PEIBn308Yw0PY6xLBhN4b8H/I9TS4a+KqKwnhVyCTs:ies4c0E8f09Dm4QB1KdwhVyCTs
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

8896

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

setupapi

SetupDiSetSelectedDriverW CM_Get_Device_Interface_List_ExW CM_Get_Resource_Conflict_DetailsW

user32

ShowWindowAsync RegisterClassExA CloseClipboard wsprintfW WindowFromPoint DefFrameProcW GetKeyboardState GetClipCursor ChildWindowFromPoint WaitMessage ExcludeUpdateRgn GetMenuItemID GetScrollBarInfo DestroyWindow EqualRect

shlwapi

StrFormatByteSizeW PathGetCharTypeW PathGetCharTypeA

lz32

GetExpandedNameW

mscms

InstallColorProfileW

advapi32

LookupAccountNameA BackupEventLogA CryptContextAddRef ChangeServiceConfigW EqualDomainSid ImpersonateAnonymousToken CryptDestroyKey FreeEncryptionCertificateHashList

crypt32

CryptMsgDuplicate CryptGetOIDFunctionValue CertAddSerializedElementToStore

gdi32

GetTextExtentPoint32W SetStretchBltMode CreatePalette CreateEllipticRgn GetWorldTransform

winmm

PlaySoundW midiOutClose waveOutGetID

rpcrt4

RpcAsyncAbortCall IUnknown_QueryInterface_Proxy

wintrust

CryptCATGetCatAttrInfo

oleaut32

VariantTimeToSystemTime SafeArrayCreateVectorEx

ntdsapi

DsListSitesW

iphlpapi

GetIpAddrTable

wininet

InternetCloseHandle

kernel32

GetProfileIntA WaitForSingleObjectEx HeapAlloc GetCommModemStatus GetCurrentThreadId VerifyVersionInfoA FatalAppExitA CloseHandle GetModuleHandleW OutputDebugStringA SetHandleInformation GetCurrentProcessorNumber LocalUnlock SetErrorMode SetEndOfFile GetConsoleWindow FlushConsoleInputBuffer FreeEnvironmentStringsA

msvcrt

bsearch memset

rasapi32

RasGetCredentialsW

ole32

OleDoAutoConvert CoFreeLibrary

powrprof

ReadPwrScheme