SSUtils[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SSUtils.dll
Size

244KB
MD5

fb58eeb5f4ad1adcfeb0a9c75cd1456a
SHA1

bf0166ef5fed1c1ebc85cd7e877fb6868d136a41
SHA256

f4c94389e196c312163214bb260ae34c57b7c368a18cae8262db6bf2f421f582
SHA512

36e0a33ce6c103b78adf4887ee11364ca5414648d4df2e8c5f6a0d0037f729b3e02cd7d9cbb7206fb48b9f8d7a0377be01b83211f16ff57756c86bdd86d251b5
SSDEEP

3072:6k2Ir773lzP2LozTAYiFphnW18nJfSDi3BrZSMjVcPQVrhJW/gxQi:P227oLoz+FTjnJysmMJcPOrTQ

Score

N/A

Malware Config

Signatures

Files

SSUtils.dll
.dll regsvr32 windows x86

f8d637512a8d3c4aa1b84a24e428f334

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathGetCharTypeW
PathCombineW

kernel32

GlobalAlloc
GlobalReAlloc
QueryPerformanceCounter
ExitProcess
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetSystemTimeAsFileTime
GetVersionExW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
Sleep
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
SetThreadPriority
GetCurrentThread
CreateThread
GlobalFree
GetTickCount
lstrlenA
WideCharToMultiByte
RaiseException
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
GlobalUnlock
GetModuleFileNameW
GetLastError
MultiByteToWideChar
CopyFileW
lstrlenW
GlobalLock
GetCurrentProcessId

user32

GetSystemMetrics
EqualRect
IntersectRect
GetActiveWindow
GetDC
ReleaseDC
IsRectEmpty
GetWindowRect
GetClientRect
ClientToScreen
MessageBoxW

gdi32

BitBlt
StretchDIBits
CreateDCW
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
SetStretchBltMode
RealizePalette
SelectPalette
StretchBlt
CreatePalette
CreateDIBitmap
GetDIBits
GetStockObject
GetObjectW
GetSystemPaletteEntries
SetDIBitsToDevice

advapi32

RegCloseKey
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW

ole32

CoCreateInstance
CLSIDFromProgID
CoUninitialize
CoInitialize
CoTaskMemFree
StringFromCLSID

oleaut32

SafeArrayGetElement
VariantInit
VariantClear
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysReAllocStringLen
SysAllocStringLen
VariantChangeType
RegisterTypeLi
SafeArrayUnlock
SafeArrayLock
SysFreeString
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayCopy
VarBstrCmp
VarBstrCat
SysStringLen

atl71

ord55
ord15
ord64
ord49
ord61
ord23
ord30
ord18
ord22
ord32
ord56

msvcp71

?_Nomemory@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

zlibu

ord6
ord3
ord10
ord7
ord4

msvcr71

_strdup
fclose
_wfopen
_waccess
sprintf
strpbrk
free
strlen
_vscwprintf
vswprintf
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
malloc
_vscprintf
vsprintf
memmove
swprintf
wcsrchr
wcscat
memcmp
memset
_except_handler3
_purecall
??_V@YAXPAX@Z
strcpy
wcscmp
iswdigit
_wtoi
longjmp
fprintf
_iob
gmtime
time
_setjmp3
fwrite
fflush
printf
sscanf
getenv
strncpy
_callnewh
__security_error_handler
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_initterm
_adjust_fdiv
__CppXcptFilter
wcscpy
wcslen
_CxxThrowException
??3@YAXPAX@Z
memcpy
__CxxFrameHandler

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
png_IDAT
png_IEND
png_IHDR
png_PLTE
png_bKGD
png_cHRM
png_check_sig
png_chunk_error
png_chunk_warning
png_convert_from_struct_tm
png_convert_from_time_t
png_convert_to_rfc1123
png_create_info_struct
png_create_write_struct
png_destroy_info_struct
png_destroy_write_struct
png_error
png_free
png_free_data
png_gAMA
png_get_copyright
png_get_error_ptr
png_get_header_ver
png_get_header_version
png_get_io_ptr
png_get_libpng_ver
png_get_user_transform_ptr
png_hIST
png_iCCP
png_iTXt
png_init_io
png_malloc
png_memcpy_check
png_memset_check
png_oFFs
png_pCAL
png_pHYs
png_permit_empty_plte
png_sBIT
png_sCAL
png_sPLT
png_sRGB
png_set_IHDR
png_set_PLTE
png_set_bKGD
png_set_bgr
png_set_cHRM
png_set_cHRM_fixed
png_set_compression_level
png_set_compression_mem_level
png_set_compression_method
png_set_compression_strategy
png_set_compression_window_bits
png_set_error_fn
png_set_filler
png_set_filter
png_set_filter_heuristics
png_set_flush
png_set_gAMA
png_set_gAMA_fixed
png_set_hIST
png_set_iCCP
png_set_interlace_handling
png_set_invert_alpha
png_set_invert_mono
png_set_keep_unknown_chunks
png_set_oFFs
png_set_pCAL
png_set_pHYs
png_set_packing
png_set_packswap
png_set_read_user_chunk_fn
png_set_rows
png_set_sBIT
png_set_sCAL
png_set_sPLT
png_set_sRGB
png_set_sRGB_gAMA_and_cHRM
png_set_shift
png_set_sig_bytes
png_set_swap
png_set_swap_alpha
png_set_tIME
png_set_tRNS
png_set_text
png_set_unknown_chunks
png_set_user_transform_info
png_set_write_fn
png_set_write_status_fn
png_set_write_user_transform_fn
png_sig_bytes
png_sig_cmp
png_tEXt
png_tIME
png_tRNS
png_warning
png_write_chunk
png_write_chunk_data
png_write_chunk_end
png_write_chunk_start
png_write_end
png_write_flush
png_write_image
png_write_info
png_write_info_before_PLTE
png_write_png
png_write_row
png_write_rows
png_zTXt

Sections

.text
Size: 160KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f8d637512a8d3c4aa1b84a24e428f334

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

advapi32

ole32

oleaut32

atl71

msvcp71

zlibu

msvcr71

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 157KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 28KB - Virtual size: 26KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 160KB - Virtual size: 157KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 28KB - Virtual size: 26KB

.reloc
Size: 12KB - Virtual size: 8KB