RecordManager[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

RecordManager.dll
Size

260KB
MD5

7ea5fb60ce014719fddeb8d919fd7095
SHA1

0b772b68bf4889b0a96720451688b09c0497d7e5
SHA256

1872e62e2c31f180f8dafb75bba417e7925b7f73fb38dfff98eff09aaf61e1ed
SHA512

42c4b49489a878e7c44c91e01b413dac26babff65a1b9af39a71b8540570c296bc0f396dd1a032082f76a92bf4f2495099bb413d5b69592c1c5e8a1dffea11df
SSDEEP

6144:PXIP4sKIbELDXp95d+JZpFnHz7U7QxxVKw:PX97IbELDXz/+ZFnHz7/V

Score

N/A

Malware Config

Signatures

Files

RecordManager.dll
.dll regsvr32 windows x86

e4873e702da2bf4d04970b744f184068

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
HeapAlloc
HeapDestroy
GetVersionExA
HeapReAlloc
HeapSize
LocalFree
ExitProcess
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
CreateFileW
CloseHandle
GlobalAlloc
LoadLibraryW
GetProcAddress
Sleep
GetSystemTimeAsFileTime
GlobalUnlock
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
HeapFree
GlobalLock
MultiByteToWideChar
FreeLibrary
lstrcatW
lstrcpynW
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
lstrcmpiW
GetModuleFileNameW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrcpyW
lstrlenW
GetTickCount
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
GetProcessHeap
InterlockedExchange
WideCharToMultiByte
GetFileSize
ReadFile
GlobalReAlloc
SetFilePointer
WriteFile
GlobalFree

user32

GetWindowRect
GetClientRect
ClientToScreen
LoadCursorW
SetCursor
GetDoubleClickTime
IsRectEmpty
RegisterClipboardFormatW
CharNextW
RedrawWindow
WindowFromPoint
GetDC
ReleaseDC
GetParent

advapi32

RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW

ole32

StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CLSIDFromProgID
CoCreateInstance
OleSaveToStream
OleLoadFromStream
WriteClassStm

oleaut32

SafeArrayGetUBound
SafeArrayGetVartype
SafeArrayCreate
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayUnaccessData
VarDecCmp
SysAllocStringLen
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
SysStringLen
LoadRegTypeLi
VarUI4FromStr
SysReAllocStringLen
SysFreeString
VariantInit
SafeArrayCopy
SysAllocString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
VariantClear
VariantCopy
VariantChangeType
SafeArrayUnlock
SafeArrayAllocData
SafeArrayAllocDescriptor
VarCmp
SafeArrayLock
SafeArrayRedim
SafeArrayGetElement
SafeArrayPutElement
LoadTypeLi
DispCallFunc
UnRegisterTypeLi
RegisterTypeLi

shlwapi

PathFindExtensionW

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Nomemory@std@@YAXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

msvcr71

gmtime
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
_CxxThrowException
wcsncpy
??_V@YAXPAX@Z
malloc
free
_except_handler3
swprintf
wcscpy
wcsrchr
realloc
_purecall
_resetstkoflw
wcscat
wcscmp
wcslen
strncpy
strncmp
wcschr
wcsstr
memset
_callnewh
__security_error_handler
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
__CppXcptFilter
time
fclose
_wfopen
_setjmp3
vswprintf
sprintf
fwrite
fflush
printf
longjmp
fprintf
_iob
wcstol
iswdigit
_wtoi
calloc
_access
_strdup

atl71

ord30

micpackvariant

?PackVariant@@YAJUtagVARIANT@@PAPAXPAK@Z
?UnpackVariant@@YAJPBXPAUtagVARIANT@@PAK@Z

zlibu

ord10
ord3
ord6
ord4
ord7

gdi32

SelectPalette
StretchBlt
CreatePalette
CreateCompatibleDC
RealizePalette
GetObjectW
GetSystemPaletteEntries
CreateDCW
SetStretchBltMode
SetDIBitsToDevice
StretchDIBits
GetDIBits
GetDeviceCaps
CreateCompatibleBitmap
BitBlt
DeleteDC
SelectObject
GetStockObject
CreateDIBitmap
DeleteObject

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
png_IDAT
png_IEND
png_IHDR
png_PLTE
png_bKGD
png_cHRM
png_check_sig
png_chunk_error
png_chunk_warning
png_convert_from_struct_tm
png_convert_from_time_t
png_convert_to_rfc1123
png_create_info_struct
png_create_write_struct
png_destroy_info_struct
png_destroy_write_struct
png_error
png_free
png_free_data
png_gAMA
png_get_copyright
png_get_error_ptr
png_get_header_ver
png_get_header_version
png_get_io_ptr
png_get_libpng_ver
png_get_user_transform_ptr
png_hIST
png_iCCP
png_iTXt
png_init_io
png_malloc
png_memcpy_check
png_memset_check
png_oFFs
png_pCAL
png_pHYs
png_permit_empty_plte
png_sBIT
png_sCAL
png_sPLT
png_sRGB
png_set_IHDR
png_set_PLTE
png_set_bKGD
png_set_bgr
png_set_cHRM
png_set_cHRM_fixed
png_set_compression_level
png_set_compression_mem_level
png_set_compression_method
png_set_compression_strategy
png_set_compression_window_bits
png_set_error_fn
png_set_filler
png_set_filter
png_set_filter_heuristics
png_set_flush
png_set_gAMA
png_set_gAMA_fixed
png_set_hIST
png_set_iCCP
png_set_interlace_handling
png_set_invert_alpha
png_set_invert_mono
png_set_keep_unknown_chunks
png_set_oFFs
png_set_pCAL
png_set_pHYs
png_set_packing
png_set_packswap
png_set_read_user_chunk_fn
png_set_rows
png_set_sBIT
png_set_sCAL
png_set_sPLT
png_set_sRGB
png_set_sRGB_gAMA_and_cHRM
png_set_shift
png_set_sig_bytes
png_set_swap
png_set_swap_alpha
png_set_tIME
png_set_tRNS
png_set_text
png_set_unknown_chunks
png_set_user_transform_info
png_set_write_fn
png_set_write_status_fn
png_set_write_user_transform_fn
png_sig_bytes
png_sig_cmp
png_tEXt
png_tIME
png_tRNS
png_warning
png_write_chunk
png_write_chunk_data
png_write_chunk_end
png_write_chunk_start
png_write_end
png_write_flush
png_write_image
png_write_info
png_write_info_before_PLTE
png_write_png
png_write_row
png_write_rows
png_zTXt

Sections

.text
Size: 144KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4873e702da2bf4d04970b744f184068

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

msvcp71

msvcr71

atl71

micpackvariant

zlibu

gdi32

Exports

Exports

Sections

.text Size: 144KB - Virtual size: 141KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 44KB - Virtual size: 42KB

.reloc Size: 28KB - Virtual size: 26KB

.text
Size: 144KB - Virtual size: 141KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 44KB - Virtual size: 42KB

.reloc
Size: 28KB - Virtual size: 26KB