ObjectManager[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ObjectManager.dll
Size

604KB
MD5

7f33cf8af7ee959ef13a0f6699461d81
SHA1

3a87d6f41e0908c00754f168d4eef7b91bc11343
SHA256

7139f1de5b45d9f2b0257004dcb3c51bdcd3c0dc93d44ab6a1e77a7a61f454aa
SHA512

fb647014df93502fe470fd6619e80ca03753e9d67aac9d3b07d11d03e83e3a176637b5765d864adb537d2b37a3503f7ea6b666f8342267b272371aae712ec3e7
SSDEEP

12288:yhgota6JX5GBbhcNpqK+eS4cb7MuLOhQG2:4H/p77S6uLOhQG2

Score

N/A

Malware Config

Signatures

Files

ObjectManager.dll
.dll regsvr32 windows x86

07154bdacab68cbcb3d8c307c2d39097

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

vbscripttreeu

?Create@CVBScriptParser@VBScript@@SAPAV12@XZ
?ParseExpression@CVBScriptParser@VBScript@@QAEPAVCExpression@2@PBG@Z
?Delete@CVBScriptParser@VBScript@@QAEXXZ
?GetObjectW@CExpressionObject@VBScript@@QBEAAVCObject@2@XZ
?GetLexeme@CLexeme@VBScript@@QBEPBGXZ
?GetNumberOfArguments@CRetVal@VBScript@@QBEIXZ
?GetArgument@CRetVal@VBScript@@QBEPAVCExpression@2@I@Z
?GetConstantType@CExpressionConstant@VBScript@@QBE?AW4E_ConstantType@12@XZ
?GetConstant@CExpressionConstant@VBScript@@QBEAAVCLexeme@2@XZ
?GetName@CIdentifier@VBScript@@QBEAAVCLexeme@2@XZ
?GetFactory@CRetVal@VBScript@@QBEAAVCObject@2@XZ
?GetProvider@CIdentifier@VBScript@@QBEPAVCObject@2@XZ

kernel32

LoadLibraryExW
GetModuleHandleW
Sleep
GetProcAddress
LoadLibraryW
LockResource
FindResourceExW
lstrlenA
GetUserDefaultLCID
WideCharToMultiByte
GetCurrentThreadId
GetTickCount
CloseHandle
GlobalAlloc
CreateFileW
HeapAlloc
HeapDestroy
GetVersionExA
HeapReAlloc
HeapSize
GetProcessHeap
ExitProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GlobalUnlock
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
lstrcatW
lstrcpynW
DisableThreadLibraryCalls
GetModuleFileNameW
lstrcmpiW
GetLastError
RaiseException
lstrcpyW
InterlockedDecrement
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LocalFree
lstrlenW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GlobalLock
GlobalFree
WriteFile
HeapFree
SetFilePointer
GlobalReAlloc
ReadFile
GetFileSize
FoldStringW

user32

ReleaseDC
GetDC
SetCursor
LoadCursorW
ClientToScreen
GetClientRect
GetWindowRect
IsRectEmpty
GetDoubleClickTime
LoadStringW
CharNextW
CharLowerBuffW

advapi32

RegQueryInfoKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegDeleteKeyW

ole32

CoTaskMemAlloc
CLSIDFromProgID
CoTaskMemFree
CoTaskMemRealloc
StringFromCLSID
StringFromGUID2
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CLSIDFromString
CoCreateGuid
CoCreateInstance
OleLoadFromStream
WriteClassStm
OleSaveToStream

oleaut32

SafeArrayAccessData
SafeArrayGetVartype
SafeArrayDestroy
VarDecCmp
VarCmp
SysReAllocStringLen
SafeArrayCreateVectorEx
SafeArrayRedim
SafeArrayGetDim
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCreate
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayGetElement
SafeArrayUnlock
SafeArrayLock
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreateVector
SafeArrayPutElement
VarUI4FromStr
VarBstrCmp
DispCallFunc
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
DispGetIDsOfNames
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
VariantChangeType
VariantCopy
VariantClear
VariantInit
SysAllocStringLen
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysAllocString
SysFreeString
GetErrorInfo
SafeArrayUnaccessData
SafeArrayGetElemsize

xerces-c_1_6_0

??1SAXParser@@UAE@XZ
?parse@SAXParser@@UAEXABVInputSource@@_N@Z
?Initialize@XMLPlatformUtils@@SAXXZ
?Terminate@XMLPlatformUtils@@SAXXZ
??_7DocumentHandler@@6B@
??_7DTDHandler@@6B@
??_7EntityResolver@@6B@
??1HandlerBase@@UAE@XZ
?setEncoding@InputSource@@QAEXQBG@Z
?fgUTF16LEncodingString2@XMLUni@@2QBGB
??0MemBufInputSource@@QAE@QBEIQBG_N@Z
?setExitOnFirstFatalError@SAXParser@@QAEX_N@Z
?setErrorHandler@SAXParser@@UAEXQAVErrorHandler@@@Z
?setDocumentHandler@SAXParser@@UAEXQAVDocumentHandler@@@Z
?setValidationSchemaFullChecking@SAXParser@@QAEX_N@Z
?setDoSchema@SAXParser@@QAEX_N@Z
?setDoNamespaces@SAXParser@@QAEX_N@Z
??_7ErrorHandler@@6B@
?makeStream@MemBufInputSource@@UBEPAVBinInputStream@@XZ
?setValidationScheme@SAXParser@@QAEXW4ValSchemes@1@@Z
??0SAXParser@@QAE@QAVXMLValidator@@@Z
??1MemBufInputSource@@UAE@XZ
?resetErrors@HandlerBase@@UAEXXZ
?fatalError@HandlerBase@@UAEXABVSAXParseException@@@Z
?error@HandlerBase@@UAEXABVSAXParseException@@@Z
?warning@HandlerBase@@UAEXABVSAXParseException@@@Z
?startDocument@HandlerBase@@UAEXXZ
?setDocumentLocator@HandlerBase@@UAEXQBVLocator@@@Z
?resetDocument@HandlerBase@@UAEXXZ
?processingInstruction@HandlerBase@@UAEXQBG0@Z
?ignorableWhitespace@HandlerBase@@UAEXQBGI@Z
?endDocument@HandlerBase@@UAEXXZ
?resetDocType@HandlerBase@@UAEXXZ
?unparsedEntityDecl@HandlerBase@@UAEXQBG000@Z
?notationDecl@HandlerBase@@UAEXQBG00@Z
?resolveEntity@HandlerBase@@UAEPAVInputSource@@QBG0@Z

shlwapi

PathFindExtensionW

msvcr71

iswdigit
strncpy
strncmp
_wcsicmp
memset
__security_error_handler
?terminate@@YAXXZ
??1type_info@@UAE@XZ
wcslen
memmove
_wtoi
__dllonexit
_onexit
_initterm
_adjust_fdiv
__CppXcptFilter
_strdup
_wcsnicmp
gmtime
time
fclose
_wfopen
_setjmp3
sprintf
fwrite
fflush
printf
longjmp
fprintf
_iob
iswalnum
iswalpha
calloc
_access
vswprintf
_vscwprintf
iswspace
??3@YAXPAX@Z
??_V@YAXPAX@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
_CxxThrowException
free
realloc
??2@YAPAXI@Z
wcscmp
??0exception@@QAE@ABV0@@Z
wcsncpy
wcsstr
malloc
_except_handler3
swprintf
wcscpy
wcsrchr
_purecall
??_U@YAPAXI@Z
_resetstkoflw
wcscat
wcschr
wcstol

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

micpackvariant

?PackVariant@@YAJUtagVARIANT@@PAPAXPAK@Z
?UnpackVariant@@YAJPBXPAUtagVARIANT@@PAK@Z

atl71

ord30

zlibu

ord3
ord10
ord7
ord6
ord4

gdi32

DeleteObject
GetStockObject
SelectObject
DeleteDC
BitBlt
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
CreateDCW
StretchDIBits
SetDIBitsToDevice
SetStretchBltMode
RealizePalette
SelectPalette
StretchBlt
CreatePalette
CreateDIBitmap
GetDIBits
GetObjectW
GetSystemPaletteEntries

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
png_IDAT
png_IEND
png_IHDR
png_PLTE
png_bKGD
png_cHRM
png_check_sig
png_chunk_error
png_chunk_warning
png_convert_from_struct_tm
png_convert_from_time_t
png_convert_to_rfc1123
png_create_info_struct
png_create_write_struct
png_destroy_info_struct
png_destroy_write_struct
png_error
png_free
png_free_data
png_gAMA
png_get_copyright
png_get_error_ptr
png_get_header_ver
png_get_header_version
png_get_io_ptr
png_get_libpng_ver
png_get_user_transform_ptr
png_hIST
png_iCCP
png_iTXt
png_init_io
png_malloc
png_memcpy_check
png_memset_check
png_oFFs
png_pCAL
png_pHYs
png_permit_empty_plte
png_sBIT
png_sCAL
png_sPLT
png_sRGB
png_set_IHDR
png_set_PLTE
png_set_bKGD
png_set_bgr
png_set_cHRM
png_set_cHRM_fixed
png_set_compression_level
png_set_compression_mem_level
png_set_compression_method
png_set_compression_strategy
png_set_compression_window_bits
png_set_error_fn
png_set_filler
png_set_filter
png_set_filter_heuristics
png_set_flush
png_set_gAMA
png_set_gAMA_fixed
png_set_hIST
png_set_iCCP
png_set_interlace_handling
png_set_invert_alpha
png_set_invert_mono
png_set_keep_unknown_chunks
png_set_oFFs
png_set_pCAL
png_set_pHYs
png_set_packing
png_set_packswap
png_set_read_user_chunk_fn
png_set_rows
png_set_sBIT
png_set_sCAL
png_set_sPLT
png_set_sRGB
png_set_sRGB_gAMA_and_cHRM
png_set_shift
png_set_sig_bytes
png_set_swap
png_set_swap_alpha
png_set_tIME
png_set_tRNS
png_set_text
png_set_unknown_chunks
png_set_user_transform_info
png_set_write_fn
png_set_write_status_fn
png_set_write_user_transform_fn
png_sig_bytes
png_sig_cmp
png_tEXt
png_tIME
png_tRNS
png_warning
png_write_chunk
png_write_chunk_data
png_write_chunk_end
png_write_chunk_start
png_write_end
png_write_flush
png_write_image
png_write_info
png_write_info_before_PLTE
png_write_png
png_write_row
png_write_rows
png_zTXt

Sections

.text
Size: 388KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07154bdacab68cbcb3d8c307c2d39097

Headers

File Characteristics

Imports

vbscripttreeu

kernel32

user32

advapi32

ole32

oleaut32

xerces-c_1_6_0

shlwapi

msvcr71

msvcp71

micpackvariant

atl71

zlibu

gdi32

Exports

Exports

Sections

.text Size: 388KB - Virtual size: 384KB

.rdata Size: 72KB - Virtual size: 68KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 92KB - Virtual size: 88KB

.reloc Size: 44KB - Virtual size: 42KB

.text
Size: 388KB - Virtual size: 384KB

.rdata
Size: 72KB - Virtual size: 68KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 92KB - Virtual size: 88KB

.reloc
Size: 44KB - Virtual size: 42KB