7576236573e148f151dd5c90f0ff94c0_dll32_JC[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

7576236573e148f151dd5c90f0ff94c0_dll32_JC.dll
Size

1.4MB
MD5

7576236573e148f151dd5c90f0ff94c0
SHA1

dc78a933ea4e655843bce86934ea7ba2654ee33c
SHA256

eeaeed8cd56950c2b3c5f908fa73ee928f3246313454d9001a22edf51d30e9ae
SHA512

a067a59c6e32f58833163ccae68a18ce6da581571f6dc2be92416faa8cc8b5628739d5a4309466a8655bb3d16bd8c6b1892a2e9a746166808429b222112af63a
SSDEEP

24576:tm0rYw2gu1OKrgfECZwWmI0sTv9QCpEuV/qVY8i/MXquathjhAx+G64+ydLEV:tm0rYwyu7Bmnomi1S28i/btNfGoyNQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7576236573e148f151dd5c90f0ff94c0_dll32_JC.dll

Files

7576236573e148f151dd5c90f0ff94c0_dll32_JC.dll
.dll regsvr32 windows:6 windows x86

dfa08234c17a791d19fae7c7b01ec5bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_onexit
_except_handler4_common
??1type_info@@UAE@XZ
_vsnwprintf
towlower
_CIsqrt
_CIlog
_CIpow
_ftol2_sse
_ftol2
rand
srand
time
_CIexp
_CIatan2
_CIsin
_CIcos
??8type_info@@QBEHABV0@@Z
__CxxFrameHandler3
_CIlog10
memcpy_s
memmove_s
memset
fflush
fputws
_lock
__dllonexit
_unlock
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
_callnewh
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
_CxxThrowException
memcpy
memmove
wcsncmp
_wcsicmp
_vsnprintf
_wfopen
fclose
malloc
free
_purecall

atl

ord32
ord48
ord47
ord42
ord31
ord15
ord23
ord57
ord18
ord21
ord16
ord30
ord58

ntdll

NtPowerInformation
NtQueryInformationToken
NtClose
NtOpenProcessToken
NtOpenThreadToken

kernel32

DisableThreadLibraryCalls
GetCurrentProcess
GetCurrentProcessId
LoadLibraryExW
DecodeSystemPointer
WriteFile
SetFilePointer
CompareStringW
FindClose
FindNextFileW
MoveFileExW
FindFirstFileW
OutputDebugStringA
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
MultiByteToWideChar
lstrlenA
GetGeoInfoW
GetUserGeoID
SetSystemPowerState
OpenProcess
OpenThread
GetCurrentThreadId
GetVolumeInformationW
DosDateTimeToFileTime
ExpandEnvironmentStringsW
DeviceIoControl
GetTimeFormatW
FileTimeToSystemTime
LocalAlloc
WideCharToMultiByte
SetEvent
CreateEventW
WaitForSingleObject
SystemTimeToTzSpecificLocalTime
InterlockedCompareExchange
LoadLibraryA
HeapCreate
ReadFile
GetSystemFirmwareTable
InterlockedExchange
QueryPerformanceCounter
GetTickCount
HeapDestroy
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceW
MulDiv
QueryPerformanceFrequency
OutputDebugStringW
GetModuleHandleA
GetModuleHandleW
GetVersionExA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetDiskFreeSpaceA
GlobalMemoryStatus
GetLocalTime
ProcessIdToSessionId
WaitForMultipleObjects
GetOverlappedResult
CreateThread
ResetEvent
InitializeCriticalSectionAndSpinCount
DelayLoadFailureHook
Sleep
GetProcessHeap
GetLastError
CopyFileExW
GetTempFileNameW
GetTempPathW
GetSystemTimeAsFileTime
SetFileAttributesW
GetFileAttributesW
DeleteFileW
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
lstrcmpiW
lstrlenW
SetCurrentDirectoryW
LeaveCriticalSection
EnterCriticalSection
CloseHandle
CreateFileW
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryW
LocalFree
EncodeSystemPointer
HeapAlloc
HeapFree

user32

SetWindowLongW
GetRawInputDeviceInfoW
UnionRect
AllowSetForegroundWindow
LockWorkStation
ExitWindowsEx
GetDesktopWindow
SetPropW
MoveWindow
EnumWindows
IsWindowEnabled
SetActiveWindow
GetParent
MapWindowPoints
GetClassNameW
GetPropW
SetFocus
LoadStringW
CreateDialogParamW
GetRawInputData
GetMessageW
TranslateMessage
DispatchMessageW
GetClassInfoW
LoadCursorW
RegisterClassW
GetSystemMetrics
LoadImageW
EnumDisplayMonitors
CreateWindowExW
SetWindowRgn
GetWindow
ShowWindow
UpdateWindow
DestroyWindow
DefWindowProcW
GetWindowLongW
GetClientRect
IsWindowVisible
GetWindowThreadProcessId
FindWindowW
PostQuitMessage
SendInput
SetForegroundWindow
SetWindowPos
RegisterWindowMessageW
PostMessageW
PtInRect
InflateRect
IntersectRect

gdi32

BitBlt
CreateDIBSection
GetStockObject
SelectObject
DeleteDC
GetCurrentObject
DeleteObject
CombineRgn
ExtCreateRegion
CreateRectRgn
GetObjectW
CreateCompatibleDC

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateShutdownW
RegGetValueW
OpenProcessToken
SetNamedSecurityInfoW
GetSecurityInfo
RegQueryInfoKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorDacl
SetSecurityInfo
SetEntriesInAclW
CreateWellKnownSid
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegEnumValueW
EventRegister
EventUnregister
EventWrite
OpenThreadToken
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
CheckTokenMembership

ole32

PropVariantClear
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
GetRunningObjectTable
CreateClassMoniker
StringFromGUID2
CreateStreamOnHGlobal
StgCreateDocfile
StgOpenStorage

oleaut32

LoadRegTypeLi
VariantInit
VariantTimeToDosDateTime
VariantChangeType
VariantClear
SysAllocStringLen
SysFreeString
SysStringLen
SysAllocString

shell32

ShellExecuteW
SHChangeNotify
SHGetMalloc
ord92
SHGetFileInfoW
SHGetFolderLocation
ord155
SHBindToParent
SHGetDesktopFolder
ord241
ord645
ord2
SHParseDisplayName
ShellExecuteExW
ord16
ord17
ord18
ord190
ord4
ord644
SHFileOperationW
SHGetFolderPathW
ord54

shlwapi

ord212
ord184
StrCmpIW
PathFindFileNameW
PathFileExistsW
PathRemoveFileSpecW
StrToIntW
StrRChrA
StrStrA
ord437
ord191
StrRetToBufW
ord354
StrDupW
PathCombineW
ord494
ord515
StrFormatByteSizeW
PathFindExtensionW
PathAddBackslashW
ord174

slc

SLOpen
SLClose
SLConsumeWindowsRight
SLGetWindowsInformationDWORD
SLUninstallProofOfPurchase

comctl32

ord323
ord320
ord324
ord326
ord327
ord321

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSVirtualChannelOpen
WTSVirtualChannelWrite
WTSVirtualChannelRead
WTSVirtualChannelClose
WTSVirtualChannelQuery

gdiplus

GdipDrawImageRectI
GdipGetImageThumbnail
GdipCloneImage
GdipGetImageGraphicsContext
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipSetPropertyItem
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageRotateFlip
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
GdipDeleteGraphics
GdipFree
GdipAlloc

setupapi

SetupDiGetDeviceInstanceIdW
SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInterfaceW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDevicePropertyW

winsta

WinStationRegisterNotificationEvent
WinStationUnRegisterNotificationEvent

winspool.drv

OpenPrinterW
GetPrinterDriverW
ClosePrinter

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust

crypt32

CertVerifyCertificateChainPolicy

Exports

Exports

AbortGetVideoThumbnail
ActivateOwnedWindow
AddBlobToFolderBrowserCache
AddImageToFolderBrowserCache
AxHostActivate
AxHostCreateControl
AxHostCreateHost
AxHostDelete
AxHostDestroy
AxHostMove
AxHostSetClippingRgn
AxHostSetSite
AxHostSetUIHandler
AxHostSetUserAgent
AxHostShow
AxHostTranslateAccelerator
AxHwndFromClass
AxSetFocus
AxSubClass
BeginGetVideoThumbnail
BootMediaCenterW
CloseFolderBrowserCache
CloseMedia
CloseRawInputHandling
CreateDRMReader
CreateMediaCenterDump
CreateShellLink
CreateSystemVolume
CreateWpfHostSupportObject
DeleteEntryFromFolderBrowserCache
DestroySystemVolume
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EHEndSession
EHEnsureTrayApplet
EHGetBitmapForFolder
EHGetUserName
EHIsDriveNTFS
EHIsOnBatteryPower
EHIsUserAGuest
EHIsUserAnAdmin
EHLogoffWindowsDialog
EHLogoffWindowsNow
EHMessageBoxCheck
EHPostTrayRestartMsg
EHShouldOfferFastUserSwitching
EHSwitchUsersNow
EhAddMockDRMInfo
EhBeginChangeNotifyEvent
EhBeginShellFolderUse
EhCanRotatePhoto
EhCanRotatePhotoLosslessly
EhCleanupImageDataHandle
EhCloseAttentions
EhCrackChangeNotifyEvent
EhCrackRenameChangeNotifyEvent
EhCreateBitmapFromImageData
EhCreateImageDataHandle
EhDrawImageData
EhEndChangeNotifyEvent
EhEndShellFolderUse
EhExtractAttentions
EhFaceDetection
EhFixPhoto
EhGetAttentionAreas
EhGetAttentionView
EhGetCDBurnDRMInfo
EhGetDisplayNameOf
EhGetImageDataSize
EhGetPlaybackDRMInfo
EhIndividualize
EhIsMultiPage
EhLogDVDPlayback
EhLogOtherMediaPlayback
EhLogTVPlayback
EhRegisterForChangeNotify
EhRegisterForChangeNotifyOnFilename
EhRegisterForWpcLogging
EhRegisterForWpcNotifications
EhRotatePhoto
EhSendToRecycleBin
EhShellFolder_GetDetailsOf
EhUnRegisterForChangeNotify
EhUnregisterForWpc
EhUseMockDRMReader
EhWriteURL
EnableMCEBoot
EnableMCEBootAfterSetupW
EndGetVideoThumbnail
EstablishRasConnection
FreeDRMReader
GetBinaryFolderPath
GetBlobFromFolderBrowserCache
GetCDInfo
GetDVDID
GetDefaultRasConnection
GetEntryFromFolderBrowserCache
GetGeoISO2
GetImageFromFolderBrowserCache
GetIndivStatus
GetIntelProcessorInfo
GetLicenseData
GetLicenseHr
GetMCSkuPolicyFromLicense
GetMetadata
GetMute
GetNetworkElements
GetProdActivationStatus
GetRemoteDeviceCapabilityInteger
GetRemoteDeviceCapabilityString
GetRenewalURL
GetRotationFromExif
GetSpecialFolderName
GetSpecialFolderPath
GetTVThumbnailFromCache
GetUrl
GetUrlDataSize
GetUrlSize
GetVideoThumbnail
GetVolume
GetWritableCDInfo
GrantProcessSynchonizeAccessToNetworkService
GroupGetVideoThumbnailBegin
GroupGetVideoThumbnailEnd
HandleRawInputOnAppThread
HangUpRasConnection
HwndFromClass
IndividualizeDRMReader
InitOcurProdKey
InitRawInputHandling
InitializeRemoteDeviceCapabilities
IsAnotherTenFootShellSetToRunAtBoot
IsDriveMediaBlankDVD
IsElevationRequired
IsEntryInFolderBrowserCache
IsFUSBackgroundSession
IsFileMicrosoftTrusted
IsHostCtrlContentEnabled
IsLimitedAdmin
IsMCEBootEnabled
IsPrinterViable
MySetForegroundWindow
NLM_IsConnectedToInternet
OnMCEBootComplete
OpenFolderBrowserCache
OpenMediaForLicenseAcquisition
QueryWTSSessionName
ReadCapabilitiesChannel
RegisterAutoPlaySuppress
ReleaseOcurProdKey
RunMediaCenterDisassembleW
SetCheckPointMark
SetMute
SetOCURProductKey
SetVolume
SetVolumeChangeCallback
SetWindowsLargeFonts
TerminateRemoteDeviceCapabilities
UninstallProductKey
UnregisterAutoPlaySuppress
UrlCommitCacheEntry
UrlCreateCacheEntry
UrlExistsInCache
UrlGetCacheEntry
UrlUnlockCacheEntry
VideoIndividualize
VolumePathFromDevInterface
WMM_Cleanup
WMM_GetCurrentAudioConfig
WMM_GetCurrentNumberOfSpeaker
WMM_GetNumAudioOutputDevices
WMM_IsCurrentDeviceDigital
WMM_IsCurrentDeviceHeadphone
WMM_IsSpeakerSupported
WMM_RevertSpeakerConfig
WMM_SetDefaultDevice
WMM_SetNumberOfSpeaker
Wlan_CloseHandle
Wlan_FreeInterfacesEnum
Wlan_FreeVisibleNetworksEnum
Wlan_GetNextInterface
Wlan_GetNextNetwork
Wlan_InitInterfacesEnum
Wlan_InitVisibleNetworksEnum
Wlan_JoinWirelessNetwork
Wlan_JoinWirelessNetworkEx
Wlan_OpenHandle
Wlan_RegisterNotifications
Wlan_UnRegisterNotifications
WmdmCreateHelper
WmdmGetDeviceCount
WmdmRegisterCallback
WmdmReleaseHelper
WzPathTargetFromWzPath

Sections

.text
Size: 277KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dfa08234c17a791d19fae7c7b01ec5bd

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

atl

ntdll

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shell32

shlwapi

slc

comctl32

wtsapi32

gdiplus

setupapi

winsta

winspool.drv

wintrust

crypt32

Exports

Exports

Sections

.text Size: 277KB - Virtual size: 276KB

.data Size: 10KB - Virtual size: 11KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 277KB - Virtual size: 276KB

.data
Size: 10KB - Virtual size: 11KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 8KB - Virtual size: 7KB