XMLPackage[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

XMLPackage.dll
Size

548KB
MD5

bd104cdefbb6c146ec0bcb9c4403d1c2
SHA1

8939a7463985b1ba0ea4399c749a7845e1b3f873
SHA256

584ec13c6d300659baf33e0449b6a9ed43508f7839d022e5b3926c2cf2ba301d
SHA512

9ab862c3b84f31fe39d6483c03f586247f042904317c3d14538b11f193699fbc035af95cc0b0470650b049f3d4a49e514deb704cfd0a54fdc49d2f87b2d8e91c
SSDEEP

12288:T1dGnsyF4nstIcanVt2cYeUOJ3cUBQAk:AenstYVrJ3zBQ

Score

N/A

Malware Config

Signatures

Files

XMLPackage.dll
.dll regsvr32 windows x86

e4127ba7e40da02811f33c7dbb6454f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathIsRelativeW

kernel32

lstrlenW
InterlockedDecrement
InterlockedIncrement
Sleep
GetCurrentThreadId
DisableThreadLibraryCalls
ExitProcess
GetProcessHeap
RaiseException
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GlobalReAlloc
ReadFile
LockResource
SizeofResource
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleW
GlobalUnlock
GlobalLock
GlobalFree
lstrlenA
LocalFree
CreateFileW
CloseHandle
DeleteFileW
GetLastError
GetUserDefaultLCID
SetLastError
GlobalAlloc
GetTickCount
MultiByteToWideChar
LoadLibraryExW
FindResourceW
LoadResource
HeapSize
lstrcpyW
FormatMessageW
FreeLibrary
LoadLibraryW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
WriteFile
QueryPerformanceCounter
SetFilePointer
GetFileSize
WideCharToMultiByte
FindResourceExW
OpenProcess
GlobalSize
CreateProcessW
GetPrivateProfileIntW

user32

MessageBoxW
CharLowerW
FindWindowW
GetTopWindow
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
SendMessageW
GetWindowThreadProcessId
GetWindowLongW
GetParent
GetForegroundWindow
RegisterWindowMessageW
SendMessageTimeoutW
SetForegroundWindow
SystemParametersInfoW
RegisterClassW
CreateWindowExW
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
KillTimer
RegisterClipboardFormatW
UnregisterClassW
LoadStringW
GetDoubleClickTime
IsRectEmpty
SetTimer
PostThreadMessageW
GetWindowRect
GetClientRect
ClientToScreen
LoadCursorW
SetCursor
wsprintfW
GetDC
GetSystemMetrics
ReleaseDC
UnregisterClassA

advapi32

RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW

ole32

CoTaskMemFree
OleSaveToStream
CoMarshalInterface
CreateStreamOnHGlobal
OleLoadFromStream
ReleaseStgMedium
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StringFromCLSID
CoUnmarshalInterface
CLSIDFromProgID
CoCreateInstance
CoGetClassObject
WriteClassStm

oleaut32

SysAllocString
SafeArrayCreate
SysStringLen
SysFreeString
VarDecCmp
SafeArrayPutElement
CreateErrorInfo
SafeArrayGetVartype
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayUnaccessData
SysReAllocStringLen
SafeArrayCreateVector
SafeArrayDestroy
VarBstrCat
GetErrorInfo
SysAllocStringByteLen
SysStringByteLen
VarBstrCmp
VariantInit
VariantClear
SysAllocStringLen
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
VariantCopy
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
VarCmp
VariantChangeType
SafeArrayRedim
SetErrorInfo

atl71

ord23
ord56
ord49
ord55
ord61
ord22
ord18
ord65
ord66
ord31
ord15
ord32
ord30
ord58
ord64

msvcr71

__CppXcptFilter
_adjust_fdiv
_strdup
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
__security_error_handler
memset
strncmp
strncpy
_wtol
wcsstr
wcschr
_resetstkoflw
malloc
iswspace
memmove
wcsncpy
realloc
wcslen
wcscmp
??_U@YAPAXI@Z
??2@YAPAXI@Z
wcscat
_purecall
_except_handler3
??0exception@@QAE@XZ
??1exception@@UAE@XZ
wcscpy
_waccess
wcsrchr
__CxxFrameHandler
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??_V@YAXPAX@Z
??3@YAXPAX@Z
free
_wcsicmp
gmtime
time
fclose
_wfopen
_setjmp3
vswprintf
sprintf
fwrite
fflush
printf
longjmp
fprintf
_iob
iswdigit
_wtoi
wcstol
calloc
_access
swprintf

msvcp71

?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IG@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?is@?$ctype@G@std@@QBE_NFG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1locale@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?clear@ios_base@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
?_Register@facet@locale@std@@QAEXXZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Id_cnt@id@locale@std@@0HA
??1_Lockit@std@@QAE@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@@Z
?id@?$ctype@G@std@@2V0locale@2@A
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

micpackvariant

?PackVariant@@YAJUtagVARIANT@@PAPAXPAK@Z
?UnpackVariant@@YAJPBXPAUtagVARIANT@@PAK@Z

zlibu

ord3
ord6
ord10
ord4
ord7

gdi32

Rectangle
GetStockObject
SelectObject
CreatePen
SetROP2
DeleteDC
BitBlt
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
CreateDCW
StretchDIBits
SetDIBitsToDevice
SetStretchBltMode
RealizePalette
SelectPalette
StretchBlt
CreatePalette
CreateDIBitmap
GetDIBits
GetObjectW
GetSystemPaletteEntries
DeleteObject

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
png_IDAT
png_IEND
png_IHDR
png_PLTE
png_bKGD
png_cHRM
png_check_sig
png_chunk_error
png_chunk_warning
png_convert_from_struct_tm
png_convert_from_time_t
png_convert_to_rfc1123
png_create_info_struct
png_create_write_struct
png_destroy_info_struct
png_destroy_write_struct
png_error
png_free
png_free_data
png_gAMA
png_get_copyright
png_get_error_ptr
png_get_header_ver
png_get_header_version
png_get_io_ptr
png_get_libpng_ver
png_get_user_transform_ptr
png_hIST
png_iCCP
png_iTXt
png_init_io
png_malloc
png_memcpy_check
png_memset_check
png_oFFs
png_pCAL
png_pHYs
png_permit_empty_plte
png_sBIT
png_sCAL
png_sPLT
png_sRGB
png_set_IHDR
png_set_PLTE
png_set_bKGD
png_set_bgr
png_set_cHRM
png_set_cHRM_fixed
png_set_compression_level
png_set_compression_mem_level
png_set_compression_method
png_set_compression_strategy
png_set_compression_window_bits
png_set_error_fn
png_set_filler
png_set_filter
png_set_filter_heuristics
png_set_flush
png_set_gAMA
png_set_gAMA_fixed
png_set_hIST
png_set_iCCP
png_set_interlace_handling
png_set_invert_alpha
png_set_invert_mono
png_set_keep_unknown_chunks
png_set_oFFs
png_set_pCAL
png_set_pHYs
png_set_packing
png_set_packswap
png_set_read_user_chunk_fn
png_set_rows
png_set_sBIT
png_set_sCAL
png_set_sPLT
png_set_sRGB
png_set_sRGB_gAMA_and_cHRM
png_set_shift
png_set_sig_bytes
png_set_swap
png_set_swap_alpha
png_set_tIME
png_set_tRNS
png_set_text
png_set_unknown_chunks
png_set_user_transform_info
png_set_write_fn
png_set_write_status_fn
png_set_write_user_transform_fn
png_sig_bytes
png_sig_cmp
png_tEXt
png_tIME
png_tRNS
png_warning
png_write_chunk
png_write_chunk_data
png_write_chunk_end
png_write_chunk_start
png_write_end
png_write_flush
png_write_image
png_write_info
png_write_info_before_PLTE
png_write_png
png_write_row
png_write_rows
png_zTXt

Sections

.text
Size: 416KB - Virtual size: 412KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4127ba7e40da02811f33c7dbb6454f8

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

ole32

oleaut32

atl71

msvcr71

msvcp71

micpackvariant

zlibu

gdi32

Exports

Exports

Sections

.text Size: 416KB - Virtual size: 412KB

.rdata Size: 80KB - Virtual size: 77KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 16KB - Virtual size: 13KB

.reloc Size: 28KB - Virtual size: 26KB

.text
Size: 416KB - Virtual size: 412KB

.rdata
Size: 80KB - Virtual size: 77KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 16KB - Virtual size: 13KB

.reloc
Size: 28KB - Virtual size: 26KB