WIPackage[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

WIPackage.dll
Size

584KB
MD5

c30ac6a7f5c3f20fc5eda5eaa330a47d
SHA1

3965b0ab94dadd969e851dc287b48a6666447ffb
SHA256

812403930bac2f641cefb759c935424c36bf15e0254a96f4029dfd05b24ba4f0
SHA512

b49701ec3b0e30bd852ee2833e74826d6eaebd523d1f89e177a60564a9da2c02a101daf864650a029282942a2d2941dbad71893370a131fe02c86ac80574a8d6
SSDEEP

6144:2mRiLvs7YWciVkDDCqB7UiZZr8PCaOX08GZ8xa6JTG7Wgb:gLvs7NcAkDx7UmiCk8aWgb

Score

N/A

Malware Config

Signatures

Files

WIPackage.dll
.dll regsvr32 windows x86

aefc679515023ae5ac589fb5b97ba064

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetSetCookieW
InternetTimeFromSystemTimeW
InternetCrackUrlW
InternetCanonicalizeUrlW

kernel32

GlobalAlloc
GetLastError
DeleteFileW
LocalFree
GetFileSize
WriteFile
GetSystemDefaultLangID
GetCurrentThreadId
GetPrivateProfileIntW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
WideCharToMultiByte
lstrlenW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CloseHandle
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
LoadLibraryExW
VirtualQuery
RaiseException
InterlockedIncrement
Sleep
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrlenA
CreateProcessW
GetTickCount
FindFirstFileW
CreateFileW
FindNextFileW
ReadFile
FileTimeToSystemTime
FindClose
GetSystemTimeAsFileTime
CompareFileTime
IsDBCSLeadByte
IsDBCSLeadByteEx
GlobalReAlloc
SetFilePointer
GlobalFree
GlobalLock
GlobalUnlock
GetCurrentProcessId
QueryPerformanceCounter
GetExitCodeThread
CreateMutexW
WaitForSingleObject
ReleaseMutex
InterlockedDecrement
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
OpenProcess
GetExitCodeProcess
ExitProcess
GetProcessHeap
HeapReAlloc
HeapSize

user32

MapVirtualKeyW
GetWindowLongW
LoadStringW
CopyRect
SystemParametersInfoW
GetWindowPlacement
SetWindowPlacement
PostMessageW
EnumChildWindows
GetClassNameW
MessageBoxW
GetForegroundWindow
SendMessageTimeoutW
ReleaseDC
GetDC
SetCursor
LoadCursorW
GetDlgItemTextW
GetClientRect
GetWindowRect
SetForegroundWindow
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
FindWindowExW
GetWindowTextW
GetWindow
GetAncestor
RegisterWindowMessageW
FindWindowW
IsRectEmpty
GetDoubleClickTime
GetParent
IsWindowEnabled
EnumWindows
GetWindowThreadProcessId
RegisterClipboardFormatW
IsWindow
GetDlgCtrlID
ClientToScreen
EnumThreadWindows

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegQueryValueW
RegCreateKeyExW

ole32

CoUnmarshalInterface
StringFromCLSID
CLSIDFromProgID
CoCreateInstance
WriteClassStm
CoTaskMemFree
CreateStreamOnHGlobal
OleSaveToStream
OleLoadFromStream
CoGetClassObject

oleaut32

SafeArrayCopy
VarDecCmp
SafeArrayRedim
VarCmp
SysReAllocStringLen
LoadTypeLi
LoadRegTypeLi
DispCallFunc
RegisterTypeLi
VarBstrCat
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayPutElement
SafeArrayUnlock
SafeArrayLock
VariantChangeType
VariantClear
VariantInit
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysAllocString
SysAllocStringLen
SysFreeString
GetErrorInfo
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayGetVartype
SafeArrayCreate

atl71

ord18
ord31
ord22
ord32
ord30
ord64
ord55
ord49
ord56
ord23
ord61
ord15
ord58

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?_Nomemory@std@@YAXXZ

msvcr71

wcscmp
wcsstr
wcschr
_vscwprintf
_strdup
vswprintf
memmove
wcslen
wcsncpy
_purecall
realloc
malloc
_wtoi
wcscat
wcsncmp
wcscpy
_resetstkoflw
_except_handler3
_wcsicmp
swprintf
wcsrchr
iswspace
iswdigit
strncpy
strncmp
_wcsrev
_wcslwr
_access
memset
_callnewh
__security_error_handler
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
__CppXcptFilter
gmtime
time
fclose
_wfopen
_setjmp3
sprintf
fwrite
fflush
printf
longjmp
fprintf
_iob
wcstol
calloc
strcpy
strlen
memcpy
??0exception@@QAE@XZ
__CxxFrameHandler
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??3@YAXPAX@Z
??_V@YAXPAX@Z
free
??1exception@@UAE@XZ

micpackvariant

?UnpackVariant@@YAJPBXPAUtagVARIANT@@PAK@Z
?PackVariant@@YAJUtagVARIANT@@PAPAXPAK@Z

zlibu

ord6
ord10
ord7
ord3
ord4

gdi32

DeleteObject
GetStockObject
SelectObject
DeleteDC
BitBlt
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
CreateDCW
StretchDIBits
SetDIBitsToDevice
SetStretchBltMode
RealizePalette
SelectPalette
StretchBlt
CreatePalette
CreateDIBitmap
GetDIBits
GetObjectW
GetSystemPaletteEntries

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
png_IDAT
png_IEND
png_IHDR
png_PLTE
png_bKGD
png_cHRM
png_check_sig
png_chunk_error
png_chunk_warning
png_convert_from_struct_tm
png_convert_from_time_t
png_convert_to_rfc1123
png_create_info_struct
png_create_write_struct
png_destroy_info_struct
png_destroy_write_struct
png_error
png_free
png_free_data
png_gAMA
png_get_copyright
png_get_error_ptr
png_get_header_ver
png_get_header_version
png_get_io_ptr
png_get_libpng_ver
png_get_user_transform_ptr
png_hIST
png_iCCP
png_iTXt
png_init_io
png_malloc
png_memcpy_check
png_memset_check
png_oFFs
png_pCAL
png_pHYs
png_permit_empty_plte
png_sBIT
png_sCAL
png_sPLT
png_sRGB
png_set_IHDR
png_set_PLTE
png_set_bKGD
png_set_bgr
png_set_cHRM
png_set_cHRM_fixed
png_set_compression_level
png_set_compression_mem_level
png_set_compression_method
png_set_compression_strategy
png_set_compression_window_bits
png_set_error_fn
png_set_filler
png_set_filter
png_set_filter_heuristics
png_set_flush
png_set_gAMA
png_set_gAMA_fixed
png_set_hIST
png_set_iCCP
png_set_interlace_handling
png_set_invert_alpha
png_set_invert_mono
png_set_keep_unknown_chunks
png_set_oFFs
png_set_pCAL
png_set_pHYs
png_set_packing
png_set_packswap
png_set_read_user_chunk_fn
png_set_rows
png_set_sBIT
png_set_sCAL
png_set_sPLT
png_set_sRGB
png_set_sRGB_gAMA_and_cHRM
png_set_shift
png_set_sig_bytes
png_set_swap
png_set_swap_alpha
png_set_tIME
png_set_tRNS
png_set_text
png_set_unknown_chunks
png_set_user_transform_info
png_set_write_fn
png_set_write_status_fn
png_set_write_user_transform_fn
png_sig_bytes
png_sig_cmp
png_tEXt
png_tIME
png_tRNS
png_warning
png_write_chunk
png_write_chunk_data
png_write_chunk_end
png_write_chunk_start
png_write_end
png_write_flush
png_write_image
png_write_info
png_write_info_before_PLTE
png_write_png
png_write_row
png_write_rows
png_zTXt

Sections

.text
Size: 340KB - Virtual size: 337KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aefc679515023ae5ac589fb5b97ba064

Headers

File Characteristics

Imports

wininet

kernel32

user32

advapi32

ole32

oleaut32

atl71

msvcp71

msvcr71

micpackvariant

zlibu

gdi32

Exports

Exports

Sections

.text Size: 340KB - Virtual size: 337KB

.rdata Size: 84KB - Virtual size: 80KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 100KB - Virtual size: 96KB

.reloc Size: 52KB - Virtual size: 49KB

.text
Size: 340KB - Virtual size: 337KB

.rdata
Size: 84KB - Virtual size: 80KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 100KB - Virtual size: 96KB

.reloc
Size: 52KB - Virtual size: 49KB