HiddenToolbarReminder[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

HiddenToolbarReminder.dll
Size

124KB
MD5

e680efc3ca441b2c227adce530a3b544
SHA1

bb67c91d78ae88fd00e14e3e2b3ec268316d5cb0
SHA256

b399c087db8295b040a7a067aca65f72031eb05fce381896121bfe971bc9a48c
SHA512

bcc065e9bc2568229033cb56dabf7718dc540da8aea9baa9d3e0098bb1d92ccd160f31161f22cd3a602c27922ed7c7a7489ff4e170329d74119f105b55007ed2
SSDEEP

3072:d5RYq2WRYkDz5FWTI2YJ5k/708yZfKvYLfcJRXPI4:d5RB2WRCKy7GbLORA4

Score

1^/10

Malware Config

Signatures

Files

HiddenToolbarReminder.dll
.zip

Password: S@ndb0x!2023@@
Device/HarddiskVolume2/Program Files (x86)/ProductivityBoss_e5/bar/1.bin/HiddenToolbarReminder.dll
.dll regsvr32 windows x86

Password: S@ndb0x!2023@@

59dbd3249aa06dddbd71fa8a7ff5af24

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:8d:42:91:e4:3c:2d:ff:ee:aa:ae:e5:b6:c0:70:b5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2015, 00:00

Not After

18/06/2018, 23:59

Subject

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8a:1d:62:11:82:d3:b1:f5:2f:ff:cf:fe:5d:7a:1d:cb:37:b4:80:6a
Signer

Actual PE Digest

8a:1d:62:11:82:d3:b1:f5:2f:ff:cf:fe:5d:7a:1d:cb:37:b4:80:6a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetCrackUrlW

kernel32

LoadLibraryExW
GetModuleFileNameW
lstrcpyW
FreeLibrary
lstrcmpiW
RaiseException
MultiByteToWideChar
SizeofResource
WaitForSingleObject
GetCurrentThreadId
FlushInstructionCache
SetLastError
GetConsoleMode
GetConsoleCP
FindResourceW
LoadResource
LockResource
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetWaitableTimer
CreateWaitableTimerW
CancelWaitableTimer
LoadLibraryW
GetSystemTimeAsFileTime
LocalFree
GetEnvironmentVariableW
SetEvent
WaitForMultipleObjects
CreateEventW
lstrlenW
VerSetConditionMask
VerifyVersionInfoW
GetLastError
GetCurrentProcess
CloseHandle
InitializeSListHead
GetThreadTimes
LoadLibraryA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
LocalAlloc
GetUserDefaultLCID
GetEnvironmentStringsW
GetModuleHandleW
GetProcAddress
SetStdHandle
OutputDebugStringA
ResetEvent
OpenEventA
FlushFileBuffers
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
Sleep
FreeEnvironmentStringsW
QueryPerformanceCounter
lstrlenA
OutputDebugStringW
SwitchToThread
GetFileAttributesW
CreateDirectoryW
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentProcessId
CreateProcessW
GetTickCount
WaitForMultipleObjectsEx
GetPrivateProfileSectionW
CreateFileW
WriteFile
GetModuleHandleExW
SetFilePointer
GetModuleFileNameA
CreateEventA
VirtualProtect
GetSystemInfo
VirtualQuery
ExitThread
CreateThread
GetCommandLineA
RtlUnwind
LCMapStringW
GetCPInfo
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetOEMCP
IsValidCodePage
TlsFree
GetCurrentThread
ExitProcess
GetStdHandle
HeapCreate
GetLocaleInfoW
SetHandleCount
GetFileType
GetStartupInfoW
WriteConsoleW

user32

GetClassNameW
LoadCursorW
DefWindowProcW
DestroyWindow
SetWindowLongW
UnregisterClassA
MsgWaitForMultipleObjectsEx
PeekMessageW
PostQuitMessage
CallMsgFilterW
TranslateMessage
DispatchMessageW
EnumChildWindows
EnumWindows
GetWindowLongW
CreateWindowExW
CallWindowProcW
RegisterClassExW
CharNextW
GetClassInfoExW
SetWinEventHook
UnhookWinEvent
IsIconic
IsWindowVisible
SetForegroundWindow

advapi32

GetSidSubAuthority
RegQueryInfoKeyW
RegNotifyChangeKeyValue
RegEnumKeyExW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
AllocateAndInitializeSid
RegCreateKeyExW
ConvertSidToStringSidA
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetSidSubAuthorityCount

ole32

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoGetCurrentLogicalThreadId
CLSIDFromString

oleaut32

VarUI4FromStr

userenv

UnloadUserProfile

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathIsRootW
PathAppendW
PathFileExistsW

Exports

Exports

DllRegisterServer
DllUnregisterServer
ProcessesToInject
SetupForAppIntegrator
Shutdown

Sections

.text
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: S@ndb0x!2023@@

Password: S@ndb0x!2023@@

59dbd3249aa06dddbd71fa8a7ff5af24

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

43:8d:42:91:e4:3c:2d:ff:ee:aa:ae:e5:b6:c0:70:b5Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

8a:1d:62:11:82:d3:b1:f5:2f:ff:cf:fe:5d:7a:1d:cb:37:b4:80:6aSigner

Headers

DLL Characteristics

File Characteristics

Imports

wininet

kernel32

user32

advapi32

ole32

oleaut32

userenv

version

shlwapi

Exports

Exports

Sections

.text Size: 155KB - Virtual size: 154KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 9KB - Virtual size: 21KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 26KB - Virtual size: 26KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

43:8d:42:91:e4:3c:2d:ff:ee:aa:ae:e5:b6:c0:70:b5
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

8a:1d:62:11:82:d3:b1:f5:2f:ff:cf:fe:5d:7a:1d:cb:37:b4:80:6a
Signer

.text
Size: 155KB - Virtual size: 154KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 9KB - Virtual size: 21KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 26KB - Virtual size: 26KB