0FC343C0[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

0FC343C0.dll
Size

117KB
MD5

a6f09e5669d9a19035f6d942caa15882
SHA1

ed1a583fd2753e57b4328136865648f841f32936
SHA256

68c8af0cc1923e3a7245392f2480ee665d265df300a609d2540bf7c6d9c1a1be
SHA512

e155170958c08ba33fbeb6b562a18afc016c2069bb0d9c04156fcf515b23d1a9d8516dac98394980dd67fdc682c4fe0235ee4ae76fdf6d82014133bf6a11836f
SSDEEP

3072:rpz7bH3v34CjydTam0AvGzc5LNEOd19HeYmh2m5sH:lbH3vICekm0eGzwLvHmh2m5sH

Score

N/A

Malware Config

Signatures

Files

0FC343C0.dll
.dll windows x86

2d60c5f51ec949750065eaca21281d82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetCursorPos
ScreenToClient
SetCapture
MessageBeep
GetSystemMetrics
GetWindowRect
DrawTextExW
GetWindowLongW
SetWindowLongW
GetClientRect
GetDC
ReleaseDC
LoadBitmapW
SetCursor
CharUpperW
User32InitializeImmEntryTable
LoadKeyboardLayoutW
GetFocus
GetActiveWindow
GetClassInfoW
GetWindowThreadProcessId
GetKeyboardLayoutList
SendMessageA
PostMessageW
PostMessageA
WCSToMBEx
GetKeyboardLayout
IsWindow
LoadCursorW
keybd_event
GetWindow
SetWindowPos
ReleaseCapture
DefWindowProcW
InvalidateRect
EndPaint
BeginPaint
DrawEdge
GetCapture
GetParent
RegisterClassExW
LoadIconW
GetClassInfoExW
SystemParametersInfoW
GetMonitorInfoW
MonitorFromWindow
UpdateWindow
ShowWindow
CreateWindowExW
SendMessageW
MapVirtualKeyW
DestroyWindow
ToAsciiEx
ToUnicode
GetKeyboardState
ClientToScreen
GetForegroundWindow
MapWindowPoints
CharNextA
CharNextW
IsWindowUnicode
GetDesktopWindow
SendMessageTimeoutW
UnloadKeyboardLayout

api-ms-win-core-localregistry-l1-1-0

RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyExW
RegEnumKeyExW

api-ms-win-security-base-l1-1-0

CheckTokenMembership
FreeSid
AllocateAndInitializeSid

kernelbase

IsDBCSLeadByte
IsDBCSLeadByteEx

kernel32

Sleep
TlsGetValue
TlsSetValue
TlsAlloc
OpenFileMappingW
GetCurrentProcessId
CreateThread
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetLastError
TlsFree
GetProfileIntW
lstrcmpW
GlobalSize
SetLastError
GlobalAlloc
GlobalLock
GlobalFree
HeapAlloc
GetLocaleInfoW
LocalSize
LocalReAlloc
LocalFlags
GetFullPathNameW
lstrlenW
OpenFile
_lclose
GetThreadLocale
GetSystemDirectoryW
LocalAlloc
GetACP
FreeLibrary
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrlenA
CreateFileMappingW
GlobalUnlock
BaseCheckAppcompatCache
GetModuleHandleW
LoadLibraryW
InterlockedIncrement
HeapFree
LocalUnlock
LocalLock
InterlockedDecrement
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetSystemDefaultLCID
LocalFree
GetProcAddress

gdi32

CreateCompatibleDC
DeleteDC
DeleteObject
BitBlt
GetStockObject
SelectObject
Rectangle
PatBlt
TranslateCharsetInfo
CreateDIBitmap
GetDIBits
ExtTextOutW
GetTextMetricsW
GetTextExtentPoint32W
CreateDCW
GetObjectW
CreateFontIndirectW
SetBkColor
CreateCompatibleBitmap

ntdll

RtlSetLastWin32Error
RtlIsThreadWithinLoaderCallout
RtlDllShutdownInProgress
RtlUnicodeToMultiByteSize
wcstol
_wcsicmp
RtlUnicodeStringToInteger
RtlIntegerToUnicodeString
RtlDeleteCriticalSection
NtQuerySystemInformation
_vsnwprintf
RtlEnterCriticalSection
RtlLeaveCriticalSection
memset
memcpy
RtlInitializeCriticalSection
RtlUnwind

msctf

CtfImeConversionList
CtfImeRegisterWord
CtfImeUnregisterWord
CtfImeGetRegisterWordStyle
CtfImeEnumRegisterWord
CtfImeConfigure
CtfImeDestroy
CtfImeEscape
CtfImeProcessKey
CtfImeSelect
CtfImeSetActiveContext
CtfImeToAsciiEx
CtfNotifyIME
CtfImeSetCompositionString
TF_GetAppCompatFlags
CtfImeSetFocus
CtfImeSelectEx
CtfImeAssociateFocus
CtfImeInquireExW
CtfImeEscapeEx
TF_MapCompatibleKeyboardTip
CtfImeProcessCicHotkey
CtfImeDestroyInputContext
TF_CreateLangBarMgr
CtfImeGetGuidAtom
CtfImeIsGuidMapEnable
CtfImeCreateInputContext
TF_Notify
TF_SetDefaultRemoteKeyboardLayout
TF_GetCompatibleKeyboardLayout
CtfImeCreateThreadMgr
CtfImeDestroyThreadMgr
CtfImeDispatchDefImeMessage
TF_CleanUpPrivateMessages
TF_CanUninitialize
CtfImeInquire

Exports

Exports

CtfImmAppCompatEnableIMEonProtectedCode
CtfImmCoUninitialize
CtfImmDispatchDefImeMessage
CtfImmEnterCoInitCountSkipMode
CtfImmGenerateMessage
CtfImmGetCompatibleKeyboardLayout
CtfImmGetGuidAtom
CtfImmGetIMEFileName
CtfImmGetTMAEFlags
CtfImmHideToolbarWnd
CtfImmIsCiceroEnabled
CtfImmIsCiceroStartedInThread
CtfImmIsGuidMapEnable
CtfImmIsTextFrameServiceDisabled
CtfImmLastEnabledWndDestroy
CtfImmLeaveCoInitCountSkipMode
CtfImmNotify
CtfImmRestoreToolbarWnd
CtfImmSetAppCompatFlags
CtfImmSetCiceroStartInThread
CtfImmSetDefaultRemoteKeyboardLayout
CtfImmTIMActivate
GetKeyboardLayoutCP
ImmActivateLayout
ImmAssociateContext
ImmAssociateContextEx
ImmCallImeConsoleIME
ImmConfigureIMEA
ImmConfigureIMEW
ImmCreateContext
ImmCreateIMCC
ImmCreateSoftKeyboard
ImmDestroyContext
ImmDestroyIMCC
ImmDestroySoftKeyboard
ImmDisableIME
ImmDisableIme
ImmDisableTextFrameService
ImmEnumInputContext
ImmEnumRegisterWordA
ImmEnumRegisterWordW
ImmEscapeA
ImmEscapeW
ImmFreeLayout
ImmGenerateMessage
ImmGetAppCompatFlags
ImmGetCandidateListA
ImmGetCandidateListCountA
ImmGetCandidateListCountW
ImmGetCandidateListW
ImmGetCandidateWindow
ImmGetCompositionFontA
ImmGetCompositionFontW
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmGetCompositionWindow
ImmGetContext
ImmGetConversionListA
ImmGetConversionListW
ImmGetConversionStatus
ImmGetDefaultIMEWnd
ImmGetDescriptionA
ImmGetDescriptionW
ImmGetGuideLineA
ImmGetGuideLineW
ImmGetHotKey
ImmGetIMCCLockCount
ImmGetIMCCSize
ImmGetIMCLockCount
ImmGetIMEFileNameA
ImmGetIMEFileNameW
ImmGetImeInfoEx
ImmGetImeMenuItemsA
ImmGetImeMenuItemsW
ImmGetOpenStatus
ImmGetProperty
ImmGetRegisterWordStyleA
ImmGetRegisterWordStyleW
ImmGetStatusWindowPos
ImmGetVirtualKey
ImmIMPGetIMEA
ImmIMPGetIMEW
ImmIMPQueryIMEA
ImmIMPQueryIMEW
ImmIMPSetIMEA
ImmIMPSetIMEW
ImmInstallIMEA
ImmInstallIMEW
ImmIsIME
ImmIsUIMessageA
ImmIsUIMessageW
ImmLoadIME
ImmLoadLayout
ImmLockClientImc
ImmLockIMC
ImmLockIMCC
ImmLockImeDpi
ImmNotifyIME
ImmProcessKey
ImmPutImeMenuItemsIntoMappedFile
ImmReSizeIMCC
ImmRegisterClient
ImmRegisterWordA
ImmRegisterWordW
ImmReleaseContext
ImmRequestMessageA
ImmRequestMessageW
ImmSendIMEMessageExA
ImmSendIMEMessageExW
ImmSetActiveContext
ImmSetActiveContextConsoleIME
ImmSetCandidateWindow
ImmSetCompositionFontA
ImmSetCompositionFontW
ImmSetCompositionStringA
ImmSetCompositionStringW
ImmSetCompositionWindow
ImmSetConversionStatus
ImmSetHotKey
ImmSetOpenStatus
ImmSetStatusWindowPos
ImmShowSoftKeyboard
ImmSimulateHotKey
ImmSystemHandler
ImmTranslateMessage
ImmUnlockClientImc
ImmUnlockIMC
ImmUnlockIMCC
ImmUnlockImeDpi
ImmUnregisterWordA
ImmUnregisterWordW
ImmWINNLSEnableIME
ImmWINNLSGetEnableStatus
ImmWINNLSGetIMEHotkey

Sections

.text
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d60c5f51ec949750065eaca21281d82

Headers

DLL Characteristics

File Characteristics

Imports

user32

api-ms-win-core-localregistry-l1-1-0

api-ms-win-security-base-l1-1-0

kernelbase

kernel32

gdi32

ntdll

msctf

Exports

Exports

Sections

.text Size: 91KB - Virtual size: 91KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 91KB - Virtual size: 91KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 3KB - Virtual size: 3KB