sQuUUDbggx[.]WTM[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
sQuUUDbggx.WTM.dll
Size 667KB
Sample220512-wj5nfaabgm
SHA256 90b9b520a8a83ba27bf9fe7d6b666c5cbfd3b67a6c362988f4a78a89d54faea8
MD5 8dd91e4c98613caf4034f6135c42409b
SHA1 b62b3d24ca220e2d03b71cecd20ca446a178e857
SHA512 ce9cc554c62745f0d0361ea7ef6f0206a82d5b5fe85bff67fd6637e2bf3e7895a7e60249c12fd35f1ad5bca1297df6767a012c76a2e0722be8011608fff9d42a
SSDEEP 6144:mkajLyaPIvW1TFpvzYNB1MCB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN836nnKg6vxaEHubqLjpq
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

sQuUUDbggx.WTM.dll

.dll 667KB

sQuUUDbggx.WTM.dll

IMPHASH e8d4871e5b3e8b61e21cf4b7ceafb1f5
SHA256 90b9b520a8a83ba27bf9fe7d6b666c5cbfd3b67a6c362988f4a78a89d54faea8
MD5 8dd91e4c98613caf4034f6135c42409b
SHA1 b62b3d24ca220e2d03b71cecd20ca446a178e857
SHA512 ce9cc554c62745f0d0361ea7ef6f0206a82d5b5fe85bff67fd6637e2bf3e7895a7e60249c12fd35f1ad5bca1297df6767a012c76a2e0722be8011608fff9d42a
SSDEEP 6144:mkajLyaPIvW1TFpvzYNB1MCB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN836nnKg6vxaEHubqLjpq
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

Minor OS version

Major OS version

Entry point

84684

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d2d1

ord3 ord1 ord2

propsys

PropVariantToUInt32 PropVariantToUInt32WithDefault

comctl32

ImageList_LoadImageW ord344 ImageList_Destroy

kernel32

GetCommandLineW CreateDirectoryW GetLastError CopyFileW GetModuleHandleW GetModuleFileNameW SetFilePointerEx GetConsoleMode VirtualAlloc WriteFile FlushFileBuffers SetStdHandle HeapSize GetStringTypeW GetFileType GetConsoleOutputCP CreateFileW WriteConsoleW GetStdHandle GetProcessHeap LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc EncodePointer GetTempPathW DeleteFileW CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW

user32

SetCapture GetSystemMetrics LoadImageW SendMessageW PostQuitMessage SetFocus LoadStringW ReleaseCapture LoadCursorW SetCursor GetClientRect LoadIconW GetCapture GetMessageW SetWindowTextW UpdateWindow CloseWindow SetWindowPos TranslateMessage DispatchMessageW BeginPaint EndPaint TrackMouseEvent GetGestureInfo CloseGestureInfoHandle SendNotifyMessageW GetParent GetCursorPos WindowFromPoint IsChild RegisterClassExW CreateWindowExW SetWindowLongPtrW GetWindowLongPtrW DefWindowProcW ShowWindow GetWindowRect InvalidateRect

gdi32

DeleteObject

advapi32

RegCloseKey RegOpenKeyW

shell32

SHCreateItemWithParent SHCreateItemFromParsingName CommandLineToArgvW ShellExecuteExW SHGetKnownFolderItem SHCreateItemInKnownFolder SetCurrentProcessExplicitAppUserModelID SHAddToRecentDocs ord155

ole32

CoUninitialize CoCreateInstance CoTaskMemAlloc CoInitialize CoTaskMemFree

dwrite

DWriteCreateFactory

Name

.text

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

428KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ