dcfr[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dcfr.dll
Size

56KB
MD5

4ae50222097c484c111651d1e8cd0256
SHA1

22f1189711b9ecaf56e45a50add2a9940e19f86f
SHA256

bc592cb6413c3c0eed04f0f9a553434fc07f072e15617aeca3ed14dfb0f1592f
SHA512

75046136324dde3fae8ad1a7f0394709f004753074c720edc774ef6a4ca9b249e1f23fca14abe4cbc2acea536fd1ff73cf74c00af6b11a128bda0a7e5c1c5fac
SSDEEP

768:J7vnhJKp6hXNwFDy2NENOMbJamcTFZWR3NJurYJUnio9SFwb8Ffd:M6UFO2NENpx6FY9Msaiopb8Ffd

Score

N/A

Malware Config

Signatures

Files

dcfr.dll
.dll windows x86

805d39ceb0ac6e8263d73756188145a3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalHandle
GlobalLock
LoadLibraryA
lstrcpyA
GlobalAlloc
GlobalUnlock
FreeLibrary
GetProcAddress
GetCommandLineA
VirtualFree
HeapFree
GetStringTypeW
GetStringTypeA
RtlUnwind
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
IsBadWritePtr
HeapReAlloc
VirtualAlloc
HeapAlloc
WriteFile
DisableThreadLibraryCalls
GetEnvironmentStringsW
GetEnvironmentStrings
GlobalFree
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
WideCharToMultiByte
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW

user32

SetRect
CopyRect
GetActiveWindow

fineocrengine

_FineEngineGetApplication@8
_FineEngineFree@4
_FineEngineInitialize@16
_FineEngineDeinitialize@0

ocrutil

subblock_alloc
block_alloc
OCR_malloc
OCR_free
subblock_free
block_free
mem_get_bank
line_alloc
char_alloc
OCR_AppendOCRONresult
OCR_realloc
set_attribute
get_attribute
set_OCR_error

Exports

Exports

DcfrRecogEngLineRegions
DcfrRecogEngOneRegion
DcfrRecogEngSubBlock
DcfrRecogEngTableBlock
DcfrSegmentEngPage
Despeckle_Image
DisableDcfrPercentCallbackFunc
EnableDcfrPercentCallbackFunc
Flip_Image
Init_FineReader
RegisterDcfrPercentCallbackFunc
Save_To_ImageFile
Scan_To_ImageFile
Select_Source
Term_FineReader
Term_FineReader_Session
_peekRecogFunction@4

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

805d39ceb0ac6e8263d73756188145a3

Headers

File Characteristics

Imports

kernel32

user32

fineocrengine

ocrutil

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 32KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 36KB - Virtual size: 32KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 1KB