MergeModule[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MergeModule.dll
Size

172KB
MD5

3656db36d4bb73e66a74fa75bc52b44b
SHA1

14c89574a0dd0ddeed4020b68a86390a9a6e5c42
SHA256

510da7882984f9db22fa56594b935188e1661b50ab7bdde3edd38a60c55af70e
SHA512

cf1cf268a6ab7bee4271ddd3ca83798b85faf8e24eab601a437ffe25a4d24536c5a2a378459b2085264197b950a359af6cd43f4b2ed890375408bc7bd23ffa24
SSDEEP

3072:NgDUZeWnuy1ztLOhrBAOZ90+baRixbt+ynnv2/pKyh0FcX8E:NNZeG/OhrBA2XDxYynnv2BXaFj

Score

N/A

Malware Config

Signatures

Files

MergeModule.dll
.dll regsvr32 windows x86

a5fd47f0099f0f5ab25ff3d41e0f8544

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

xerces-c_1_6_0

??_7DTDHandler@@6B@
??_7EntityResolver@@6B@
??1HandlerBase@@UAE@XZ
?resolveEntity@HandlerBase@@UAEPAVInputSource@@QBG0@Z
?notationDecl@HandlerBase@@UAEXQBG00@Z
?unparsedEntityDecl@HandlerBase@@UAEXQBG000@Z
?resetDocType@HandlerBase@@UAEXXZ
?endDocument@HandlerBase@@UAEXXZ
?ignorableWhitespace@HandlerBase@@UAEXQBGI@Z
?processingInstruction@HandlerBase@@UAEXQBG0@Z
?resetDocument@HandlerBase@@UAEXXZ
?setDocumentLocator@HandlerBase@@UAEXQBVLocator@@@Z
?startDocument@HandlerBase@@UAEXXZ
?warning@HandlerBase@@UAEXABVSAXParseException@@@Z
?error@HandlerBase@@UAEXABVSAXParseException@@@Z
?fatalError@HandlerBase@@UAEXABVSAXParseException@@@Z
?resetErrors@HandlerBase@@UAEXXZ
??1MemBufInputSource@@UAE@XZ
??0SAXParser@@QAE@QAVXMLValidator@@@Z
?setValidationScheme@SAXParser@@QAEXW4ValSchemes@1@@Z
?setDoNamespaces@SAXParser@@QAEX_N@Z
?setDoSchema@SAXParser@@QAEX_N@Z
?setValidationSchemaFullChecking@SAXParser@@QAEX_N@Z
?setDocumentHandler@SAXParser@@UAEXQAVDocumentHandler@@@Z
?setErrorHandler@SAXParser@@UAEXQAVErrorHandler@@@Z
?setExitOnFirstFatalError@SAXParser@@QAEX_N@Z
??0MemBufInputSource@@QAE@QBEIQBG_N@Z
??_7DocumentHandler@@6B@
?Terminate@XMLPlatformUtils@@SAXXZ
?Initialize@XMLPlatformUtils@@SAXXZ
?fgUTF16LEncodingString2@XMLUni@@2QBGB
?setEncoding@InputSource@@QAEXQBG@Z
?parse@SAXParser@@UAEXABVInputSource@@_N@Z
??1SAXParser@@UAE@XZ
?makeStream@MemBufInputSource@@UBEPAVBinInputStream@@XZ
??_7ErrorHandler@@6B@

mfc71u

ord5226
ord5209
ord5562
ord2531
ord2725
ord2829
ord4301
ord2708
ord2832
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4475
ord4255
ord3327
ord757
ord3824
ord2239
ord1043
ord314
ord1021
ord628
ord4320
ord2009
ord1007
ord5096
ord566
ord378
ord315
ord1033
ord1197
ord1199
ord4562
ord1093
ord371
ord1115
ord1192
ord1168
ord1170
ord1200
ord1079
ord1087
ord1162
ord581
ord1182
ord1178
ord764
ord266
ord1908
ord762
ord265
ord3677
ord4032
ord765
ord4008
ord6272
ord3795
ord6274
ord2054
ord5579
ord3800
ord6215
ord5378
ord3826
ord1911
ord3942
ord5222
ord5220
ord2925

msvcr71

_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__security_error_handler
memset
_wcsicmp
wcscmp
wcsstr
_wtoi
iswdigit
vswprintf
wcslen
iswspace
_resetstkoflw
_initterm
iswalpha
iswalnum
memmove
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??0exception@@QAE@XZ
??1exception@@UAE@XZ
wcscat
realloc
wcsncpy
free
malloc
__CxxFrameHandler
_except_handler3
wcsrchr
wcscpy
swprintf
_adjust_fdiv
__CppXcptFilter
_vscwprintf
_purecall

kernel32

HeapAlloc
HeapDestroy
GetVersionExA
HeapSize
GetProcessHeap
FoldStringW
HeapReAlloc
HeapFree
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
LocalAlloc
LocalFree
LockResource
FindResourceExW
lstrlenA
CopyFileW
ResetEvent
SetEvent
WaitForSingleObject
ResumeThread
Sleep
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
lstrcatW
lstrcpynW
lstrcmpiW
GetLastError
RaiseException
lstrcpyW
lstrlenW
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetModuleFileNameW
LeaveCriticalSection

user32

PostThreadMessageW
DispatchMessageA
DispatchMessageW
TranslateMessage
GetMessageA
GetMessageW
CharNextW
PeekMessageW
MsgWaitForMultipleObjects
IsWindowUnicode

advapi32

RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW

shlwapi

PathFindExtensionW

ole32

CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
CoCreateGuid
CoInitializeEx
CoUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgIsStorageFile
StgOpenStorageEx
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
OleSaveToStream
OleLoadFromStream
WriteClassStm
CLSIDFromProgID

oleaut32

VariantInit
VariantClear
SafeArrayPutElement
VarBstrCat
SysStringByteLen
SafeArrayCreateVector
VarBstrCmp
SysAllocStringLen
VariantCopy
VariantChangeType
SysReAllocStringLen
SysAllocStringByteLen
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
SysStringLen
LoadTypeLi
LoadRegTypeLi
SysFreeString

msvcp71

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

micpackvariant

?UnpackVariant@@YAJPBXPAUtagVARIANT@@PAK@Z
?PackVariant@@YAJUtagVARIANT@@PAPAXPAK@Z

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5fd47f0099f0f5ab25ff3d41e0f8544

Headers

File Characteristics

Imports

xerces-c_1_6_0

mfc71u

msvcr71

kernel32

user32

advapi32

shlwapi

ole32

oleaut32

msvcp71

micpackvariant

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 111KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 16KB - Virtual size: 13KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 112KB - Virtual size: 111KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 16KB - Virtual size: 13KB

.reloc
Size: 12KB - Virtual size: 8KB