TulipOptions[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

TulipOptions.dll
Size

108KB
MD5

3e26bc1f1feaf1ddb197e2e339a7d8b5
SHA1

fb50c98dd46c8dca6c9b1564851ff01d0a5dab86
SHA256

ea46fdda9579016926b97f350bc70cb20a1cdb12e41b2af66f63cd461f4da7c5
SHA512

6698ead33df77ec8ea64126f1b58dd7da61408ce17572488e53f33c5243b794ac009d4894f9faf412c9f9c22b5ede7ca8f85f087ca2aa37376582ac0d4412ea2
SSDEEP

3072:hod5dM+FU/kJs7dm1jj5Kv3Tw3Zi1WLC+ZecW8B4p6bkB:BnXSrN4p6b

Score

N/A

Malware Config

Signatures

Files

TulipOptions.dll
.dll regsvr32 windows x86

c22000def46a16aa736a33c7c9fb1d08

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr71

__security_error_handler
wcscat
??1exception@@UAE@XZ
_purecall
swprintf
wcscpy
wcscmp
wcsrchr
wcschr
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
_wcsicmp
memset
wcsstr
_wtoi
iswdigit
iswspace
realloc
?terminate@@YAXXZ
__CppXcptFilter
__dllonexit
wcslen
memmove
vswprintf
_vscwprintf
_except_handler3
??_U@YAPAXI@Z
??_V@YAXPAX@Z
wcsncpy
free
??2@YAPAXI@Z
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??3@YAXPAX@Z
__CxxFrameHandler
??0exception@@QAE@XZ
_onexit

kernel32

HeapReAlloc
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
GetTickCount
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
lstrlenW
InitializeCriticalSection
DeleteCriticalSection
FindClose
FindNextFileW
FindFirstFileW
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
LoadLibraryW
FreeLibrary
InterlockedIncrement
InterlockedDecrement
DisableThreadLibraryCalls
Sleep
ExitProcess
QueryPerformanceCounter
HeapSize
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
lstrlenA
CreateEventW
CloseHandle
SetEvent
WaitForSingleObject
GetProcessHeap

user32

UnregisterClassA
LoadStringW
UnregisterClassW

advapi32

RegSetValueExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegSetValueW
RegEnumValueW
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyW

ole32

CLSIDFromString
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CLSIDFromProgID

oleaut32

SysReAllocStringLen
VarBstrCat
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayPutElement
VariantChangeType
VariantCopy
VarCmp
SysAllocStringLen
SysStringLen
OleCreatePropertyFrame
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayGetElement
VariantClear
SafeArrayUnlock
SafeArrayLock
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysAllocString

atl71

ord61
ord15
ord23
ord31
ord56
ord49
ord32
ord55
ord64
ord22
ord18
ord65
ord30
ord58
ord66

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c22000def46a16aa736a33c7c9fb1d08

Headers

File Characteristics

Imports

msvcr71

kernel32

user32

advapi32

ole32

oleaut32

atl71

msvcp71

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 920B

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 920B

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 8KB - Virtual size: 4KB