647fab34ad681[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

647fab34ad681.dll
Size

313KB
MD5

be278775008a27bc991a461302080d98
SHA1

741c09198b5544330a9f31bc83c2d7b4bb3059ce
SHA256

06b3f14f359d4286bf5323824f637e082e876b9c1de0002109ff23e336ff9062
SHA512

58e1bbd748e9bff670b35647617fcc58014f1389ea4a21d70ba976cfb1e00f607ab4a2870166eb3b8fcc99ca8dca2c39f82ed54440219ed52501f25547b84575
SSDEEP

6144:xEqBRfInTf6orO1sypgkYKZqhoDCFV8u:xEqBRf6fyp5XZqhYCFV8u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
647fab34ad681.dll

Files

647fab34ad681.dll
.dll regsvr32 windows x86

8ab7e55c59f2d55cd0d51132c305b100

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHAutoComplete
PathCombineA
StrFormatByteSize64A
PathRemoveFileSpecA
PathRenameExtensionA

kernel32

GetCurrentDirectoryA
lstrcpyA
MulDiv
lstrcpynA
FileTimeToSystemTime
FileTimeToLocalFileTime
FlushInstructionCache
GetCurrentProcess
lstrcmpA
FindFirstFileExA
FindClose
FindNextFileA
FindFirstFileA
Sleep
lstrcatA
GetProcAddress
FindResourceExA
LockResource
GetFileAttributesA
GetVersionExA
ExpandEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedExchange
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
IsDBCSLeadByte
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
FreeLibrary
LoadLibraryA
GetCurrentThreadId
DeleteCriticalSection
RaiseException
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InterlockedIncrement
VirtualFree
InterlockedDecrement
lstrlenW
GetModuleHandleA
MultiByteToWideChar
lstrlenA
GetModuleFileNameA
GetLastError
WideCharToMultiByte
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA

user32

FillRect
DefWindowProcA
MessageBoxA
DestroyWindow
CharNextA
GetActiveWindow
GetDialogBaseUnits
GetWindow
MonitorFromWindow
GetMonitorInfoA
GetDlgCtrlID
SetDlgItemTextA
GetWindowRect
SetWindowPos
SetFocus
GetWindowTextA
LoadCursorA
GetWindowLongA
SetWindowLongA
GetSysColorBrush
UnregisterClassA
GetSysColor
LoadImageA
GetDesktopWindow
CallWindowProcA
InvalidateRect
EnableWindow
SetCursor
GetClientRect
MapWindowPoints
RegisterWindowMessageA
ReleaseDC
GetWindowTextLengthA
GetParent
PostMessageA
SetWindowTextA
GetDlgItem
GetDC
SendMessageA

gdi32

GetObjectA
CreatePen
Polygon
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
CreateFontIndirectA
SelectObject
GetTextMetricsA
DeleteObject
DeleteDC

comdlg32

GetOpenFileNameA
GetSaveFileNameA

advapi32

RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegSetValueExA
RegDeleteValueA

shell32

SHGetPathFromIDListA
SHBrowseForFolderA

ole32

OleInitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
OleUninitialize

oleaut32

VarDecCmp
VarDecFromStr
VarR8FromStr
VarI4FromStr
VarDateFromStr
VarUI4FromStr

comctl32

CreatePropertySheetPageA
PropertySheetA
DestroyPropertySheetPage
InitCommonControlsEx

msvcr90

_purecall
_mbscmp
_mbsinc
_ismbcspace
?terminate@@YAXXZ
_CxxThrowException
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_malloc_crt
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
memset
memcpy_s
free
??2@YAPAXI@Z
_stricmp
_atoi64
_vscprintf
vsprintf_s
memmove_s
strnlen
strlen
_recalloc
__CxxFrameHandler3
??_V@YAXPAX@Z
??3@YAXPAX@Z
malloc
_resetstkoflw
??_U@YAPAXI@Z
_mbsnbcpy_s
_encoded_null
_mbsstr

Exports

Exports

DllRegisterServer

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ab7e55c59f2d55cd0d51132c305b100

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

msvcr90

Exports

Exports

Sections

.text Size: 103KB - Virtual size: 103KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 55KB - Virtual size: 56KB

.rsrc Size: 131KB - Virtual size: 130KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 103KB - Virtual size: 103KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 55KB - Virtual size: 56KB

.rsrc
Size: 131KB - Virtual size: 130KB

.reloc
Size: 6KB - Virtual size: 6KB