FineNet[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

FineNet.dll
Size

112KB
MD5

954c45b2ac304873252aace472a68a28
SHA1

082bcf3719b83ce0a99133736f849dc73f80178f
SHA256

bd62ef4dc5127e498000858c02745689acc8af33ebca2897bc0016819c6089ab
SHA512

f6924b9ee99a24ce695c80ddad79b9c3cc20a670a9e2bc1200ec8a270b301b885849abec4893ead77690108f08b20d38ac29f339b75f5e2a1cff43e86ebf5b39
SSDEEP

1536:b1t+0Rd8P0NuX97CE8FMn5qfCmPcyguj8r:bvty7QFMwPcyt8r

Score

N/A

Malware Config

Signatures

Files

FineNet.dll
.dll windows x86

a6b21faa5cad8c67fc3280d4809133e7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
GetLastError
InterlockedDecrement
SetLastError
SetEvent
OpenProcess
CloseHandle
Sleep
ResetEvent
CreateThread
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
ExitProcess
TerminateProcess
InterlockedIncrement
DisableThreadLibraryCalls
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
InterlockedExchange
CompareStringA
FreeLibrary
TlsAlloc
GetCurrentThreadId
TlsGetValue
TlsSetValue
GetCurrentProcessId
WaitForMultipleObjects
GetSystemInfo

rpcrt4

RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoW
RpcMgmtInqServerPrincNameW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingInqAuthClientW
NdrServerCall2
NdrClientCall2
RpcMgmtWaitServerListen
RpcServerListen
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcServerRegisterIf
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcMgmtStopServerListening

fineobj

?ErrorCode@CInternalError@FObj@@QBEKXZ
?GetFineObjectsVersion@FObj@@YAHXZ
?RemoveResourceModule@FObj@@YAXPAUHINSTANCE__@@@Z
?AddResourceModule@FObj@@YAXPAUHINSTANCE__@@@Z
?RegisterModule@FObj@@YAXPAUHINSTANCE__@@P6AXXZ1@Z
?EndStaticPart@FObj@@YAXXZ
?GetErrorFlag@FObj@@YA_NXZ
?BeginStaticPart@FObj@@YAXXZ
?UnregisterModule@FObj@@YAXPAUHINSTANCE__@@@Z
?Warning@FObj@@YAXPAVCException@1@@Z
?Read@CArchive@FObj@@QAEXPAXH@Z
?Write@CArchive@FObj@@QAEXPBXH@Z
?SubstParam@CMessage@FObj@@QBE?AVCUnicodeString@2@ABV32@0@Z
?HashKey@@YAHPB_W@Z
?GetLength@CMemoryFile@FObj@@UBEHXZ
??_U@YAPAXI@Z
?GetBufferPtr@CMemoryFile@FObj@@QBEPBEXZ
?SeekToBegin@CBaseFile@FObj@@QAEXXZ
??0CMemoryManagerSwitcher@FObj@@QAE@PAVIMemoryManager@1@@Z
??1CMemoryManagerSwitcher@FObj@@QAE@XZ
?Unlock@CCriticalSection@FObj@@QAEXXZ
?Lock@CCriticalSection@FObj@@QAEXXZ
??1CMessage@FObj@@QAE@XZ
??0CMessage@FObj@@QAE@PB_WH@Z
??4CUnicodeString@FObj@@QAEAAV01@PB_W@Z
?Unlock@CCriticalSectionLock@FObj@@QAEXXZ
?ReplaceAll@CUnicodeString@FObj@@QAEXPB_W0@Z
??0CLastErrorException@FObj@@QAE@K@Z
?IsEmpty@CUnicodeString@FObj@@QBE_NXZ
?UnicodeStr@CMessage@FObj@@QBE?AVCUnicodeString@2@XZ
?SubstParam@CMessage@FObj@@QBE?AVCUnicodeString@2@ABV32@@Z
?MessageText@CLastErrorException@FObj@@UBE?AVCUnicodeString@2@XZ
?MessageBoxW@FObj@@YAHPB_WH@Z
??1CLastErrorException@FObj@@UAE@XZ
?Compare@CUnicodeString@FObj@@QBEHPB_W@Z
?safeStrLen@CUnicodeString@FObj@@CAHPB_W@Z
?safeStr@CUnicodeString@FObj@@CAPB_WPB_W@Z
?Length@CUnicodeString@FObj@@QBEHXZ
?concatStr@CUnicodeString@FObj@@CAPAVCUnicodeStringBody@2@PB_WH0H@Z
??0CUnicodeString@FObj@@AAE@PAVCUnicodeStringBody@1@@Z
??1CError@FObj@@QAE@XZ
??0CError@FObj@@QAE@PB_WH@Z
??1CException@FObj@@UAE@XZ
??0CException@FObj@@QAE@XZ
?Warning@CException@FObj@@UBEXXZ
?IsStoring@CArchive@FObj@@QBE_NXZ
??3@YAXPAX@Z
??_V@YAXPAX@Z
??0CUnicodeString@FObj@@QAE@ABV01@@Z
??1CUnicodeString@FObj@@QAE@XZ
??0CUnicodeString@FObj@@QAE@XZ
?getWritePtr@CArchive@FObj@@AAEPAXH@Z
?getReadPtr@CArchive@FObj@@AAEPBXH@Z
??0CUnicodeString@FObj@@QAE@PB_W@Z
?GenerateInternalError@FObj@@YA_NW4TInternalErrorType@1@PB_W11JK@Z
??2@YAPAXI@Z
?GenerateCheck@FObj@@YAXAAVCError@1@PB_W11@Z
?GenerateCheckLastError@FObj@@YAXK@Z
??1CCriticalSectionLock@FObj@@QAE@XZ
??0CCriticalSectionLock@FObj@@QAE@PAVCCriticalSection@1@_N@Z
?Delete@CException@FObj@@QAEXXZ
??1CArchive@FObj@@UAE@XZ
??0CArchive@FObj@@QAE@PAVCBaseFile@1@W4TDirection@01@H@Z
??1CMemoryFile@FObj@@UAE@XZ
?SetLength@CMemoryFile@FObj@@UAEXH@Z
?Attach@CMemoryFile@FObj@@QAEXPAEHH@Z
??0CMemoryFile@FObj@@QAE@H@Z
?ERR_BAD_ARCHIVE@FObj@@3VCError@1@A
??BCUnicodeString@FObj@@QBEPB_WXZ
?UnicodeName@CArchive@FObj@@QBE?AVCUnicodeString@2@XZ
?IsLoading@CArchive@FObj@@QBE_NXZ
?UpperPrimeNumber@FObj@@YAHH@Z
??1CCriticalSection@FObj@@QAE@XZ
??0CCriticalSection@FObj@@QAE@XZ
?Ptr@CUnicodeString@FObj@@QBEPB_WXZ
?ReleaseBuffer@CUnicodeString@FObj@@QAEXXZ
?GetBuffer@CUnicodeString@FObj@@QAEPA_WH@Z
?Detach@CMemoryFile@FObj@@QAEPAEXZ
?Flush@CArchive@FObj@@QAEXXZ
??4CUnicodeString@FObj@@QAEAAV01@ABV01@@Z
??6FObj@@YAAAVCArchive@0@AAV10@ABVCUnicodeString@0@@Z
?ThrowMemoryException@FObj@@YAXXZ
?ThrowUserException@FObj@@YAXXZ
?WriteSmallValue@CArchive@FObj@@QAEXH@Z
?ReadSmallValue@CArchive@FObj@@QAEHXZ
?ErrorType@CInternalError@FObj@@QBE?AW4TInternalErrorType@2@XZ
?ErrorCode@CLastErrorException@FObj@@QBEKXZ
?GetHRESULT@CCOMException@FObj@@QBEJXZ
?FileName@CFileException@FObj@@QBE?AVCUnicodeString@2@XZ
?ErrorCode@CFileException@FObj@@QBEKXZ
?Warning@CInternalError@FObj@@UBEXXZ
?MessageText@CInternalError@FObj@@UBE?AVCUnicodeString@2@XZ
??3?$CAllocatedOn@VRuntimeHeap@FObj@@@FObj@@SAXPAX@Z
??0CInternalError@FObj@@QAE@W4TInternalErrorType@1@PB_WJK@Z
??2?$CAllocatedOn@VRuntimeHeap@FObj@@@FObj@@SAPAXI@Z
??5FObj@@YAAAVCArchive@0@AAV10@AAVCUnicodeString@0@@Z
??1CInternalError@FObj@@UAE@XZ
?ThrowCOMException@FObj@@YAXJPAUIErrorInfo@@@Z
?ThrowFileException@FObj@@YAXKABVCUnicodeString@1@@Z
??YCUnicodeString@FObj@@QAEAAV01@ABV01@@Z

msvcr71

__CppXcptFilter
_adjust_fdiv
malloc
_purecall
__CxxFrameHandler
memmove
_CxxThrowException
__RTDynamicCast
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
__dllonexit
_onexit
__security_error_handler
free
_initterm

user32

MessageBoxA

Exports

Exports

??0CFineNetClient@FineNet@@QAE@ABV01@@Z
??0CFineNetClient@FineNet@@QAE@XZ
??0CFineNetServer@FineNet@@QAE@ABV01@@Z
??0CFineNetServer@FineNet@@QAE@XZ
??1CFineNetClient@FineNet@@UAE@XZ
??1CFineNetServer@FineNet@@UAE@XZ
??4CFineNetClient@FineNet@@QAEAAV01@ABV01@@Z
??4CFineNetServer@FineNet@@QAEAAV01@ABV01@@Z
??4CLocalServerManager@FineNet@@QAEAAV01@ABV01@@Z
??5FineNet@@YAAAVCArchive@FObj@@AAV12@AAVCMemoryFile@2@@Z
??6FineNet@@YAAAVCArchive@FObj@@AAV12@ABVCMemoryFile@2@@Z
??_7CFineNetClient@FineNet@@6B@
??_7CFineNetServer@FineNet@@6B@
?AddProtocol@CFineNetServer@FineNet@@QAEXABUCConnectionProtocol@2@@Z
?ClientOptions@CFineNetClient@FineNet@@QAEPAUIClientOptions@2@XZ
?CreateConnection@CFineNetClient@FineNet@@QAE?AV?$CPtr@UIConnectionClient@FineNet@@@FObj@@ABVCUnicodeString@4@ABUCConnectionProtocol@2@W4TSecurityLevel@2@@Z
?GetAllConnections@CFineNetClient@FineNet@@QAEXAAV?$CObjectArray@UIConnectionClient@FineNet@@VCurrentMemoryManager@FObj@@@FObj@@@Z
?GetClientObject@CFineNetClient@FineNet@@SAPAV12@XZ
?GetCurrentCallConnection@CFineNetServer@FineNet@@QAEPAUIConnection@2@XZ
?GetDefaultConnection@CFineNetClient@FineNet@@QAEPAUIConnectionClient@2@XZ
?GetServerObject@CFineNetServer@FineNet@@SAPAV12@XZ
?IsStarted@CFineNetServer@FineNet@@QAE_NXZ
?OnConnectionCreated@CFineNetClient@FineNet@@UAEXPAUIConnection@2@@Z
?OnConnectionCreated@CFineNetServer@FineNet@@UAEXPAUIConnection@2@@Z
?OnConnectionRundown@CFineNetClient@FineNet@@UAEXPAUIConnectionClient@2@@Z
?OnConnectionRundown@CFineNetServer@FineNet@@UAEXPAUIConnection@2@@Z
?OnServerShutDown@CFineNetServer@FineNet@@UAEXXZ
?OnThreadInitialize@CFineNetServer@FineNet@@UAEXXZ
?RegisterClassDispatcher@IConnectionServer@FineNet@@SAXABVCUnicodeString@FObj@@PAUICallDispatcher@2@@Z
?ServerOptions@CFineNetServer@FineNet@@QAEPAUIServerOptions@2@XZ
?SetDefaultConnection@CFineNetClient@FineNet@@QAEXPAUIConnectionClient@2@@Z
?ShutDownServer@CLocalServerManager@FineNet@@SAKPAUIConnection@2@H@Z
?StartServer@CFineNetServer@FineNet@@QAEX_NW4TSecurityLevel@2@@Z
?StartServer@CLocalServerManager@FineNet@@SA?AV?$CPtr@UIConnectionClient@FineNet@@@FObj@@ABVCUnicodeString@4@ABUCConnectionProtocol@2@W4TSecurityLevel@2@H@Z
?StopServer@CFineNetServer@FineNet@@QAEXXZ
?UnregisterClassDispatcher@IConnectionServer@FineNet@@SAXABVCUnicodeString@FObj@@@Z
GetMessageName
GetMessageSystemVersion
GetResourceID
NumberOfMessages
__FineObjUsed

Sections

.text
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6b21faa5cad8c67fc3280d4809133e7

Headers

File Characteristics

Imports

kernel32

rpcrt4

fineobj

msvcr71

user32

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 57KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 12KB - Virtual size: 9KB

.text
Size: 60KB - Virtual size: 57KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 12KB - Virtual size: 9KB