Wiflgodjvo[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Wiflgodjvo.dll
Size

731KB
MD5

3f7068a385405afa46ef29bbe3ce9a21
SHA1

e76cb90e4617b27fbc9751d0c119d722a04856b7
SHA256

d2de7c172246a6b32f00388c18a4b1ca2f44291a73d1115e85b3c1e37be48e6d
SHA512

42f4c86c67882fa90a648b8a5391afcba2bf8136e25556453b806d20795b15490e4e7d296667d7d758b45c462f482c1036645f2fd517e17e69d8e78e58c9bdbd
SSDEEP

12288:L88tpQmNwfp6/dNE2uIigUp+CQ/EAr06DggYmpEj7N904+G5ciTHMgxiQt1cb:Q8PQGwB6/IRgTEoDg6pEj7N94G5BTHx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Wiflgodjvo.dll

Files

Wiflgodjvo.dll
.dll windows:5 windows x86 arch:x86

8bc1f5f3dbdd153468f5cedc47cda5fb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

CopySid
RegisterEventSourceW
ReportEventW
DeregisterEventSource
DuplicateTokenEx
CreateProcessAsUserW
SetEntriesInAclW
GetSecurityDescriptorLength
LsaRetrievePrivateData
LsaStorePrivateData
LsaRemoveAccountRights
LsaEnumerateAccountRights
LsaAddAccountRights
LogonUserW
IsValidSecurityDescriptor
ImpersonateSelf
CreatePrivateObjectSecurityEx
DestroyPrivateObjectSecurity
LsaLookupNames
GetSidLengthRequired
BuildTrusteeWithSidW
GetSecurityDescriptorDacl
GetAclInformation
RegCreateKeyW
SetThreadToken
RegQueryValueExW
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
OpenThreadToken
GetTokenInformation
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
LockServiceDatabase
UnlockServiceDatabase
SaferGetPolicyInformation
SaferCreateLevel
SaferGetLevelInformation
SaferCloseLevel
QueryServiceStatus
DeleteService
CreateServiceW
ChangeServiceConfigW
QueryServiceConfigW
ControlService
OpenSCManagerW
OpenServiceW
StartServiceW
CloseServiceHandle
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
SetSecurityDescriptorControl
LookupAccountNameW
AddAce
GetAce
AddAccessAllowedAceEx
RevertToSelf
CheckTokenMembership
GetSidSubAuthorityCount
GetSidSubAuthority
LookupAccountSidW
LsaFreeMemory
LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy
ConvertStringSidToSidW
BuildSecurityDescriptorW
BuildTrusteeWithNameW
IsWellKnownSid
ConvertSidToStringSidW

kernel32

CreateFileMappingA
GetLongPathNameW
InitializeCriticalSectionAndSpinCount
ReadFile
GetFileType
FindResourceExW
GetSystemDefaultUILanguage
LocalFree
GetExitCodeProcess
CreateFileMappingW
FormatMessageW
LockResource
CreateProcessW
GetLocalTime
DebugBreak
GetThreadContext
IsDebuggerPresent
CreateSemaphoreA
CreateEventA
ReleaseSemaphore
LocalAlloc
LocalSize
LocalReAlloc
CompareStringW
ReleaseMutex
OpenMutexW
CreateMutexW
OpenFileMappingW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LoadLibraryA
GetCurrentThread
FindFirstFileW
RemoveDirectoryW
FindNextFileW
FindClose
MoveFileW
GetComputerNameW
CreateFileW
SetFilePointer
WriteFile
MoveFileExW
DeleteFileW
GetTempPathW
CopyFileW
WaitForSingleObject
OutputDebugStringW
SetThreadLocale
IsValidLocale
GetThreadLocale
GetSystemDirectoryW
SetEvent
InterlockedCompareExchange
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
lstrlenA
lstrcatW
DisableThreadLibraryCalls
CreateEventW
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
lstrcpynW
HeapDestroy
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
lstrcpyW
lstrlenW
MultiByteToWideChar
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetVersionExW
SetFileAttributesW
ResetEvent
Sleep
ExpandEnvironmentStringsW
GetFileAttributesW
OpenFileMappingA
MapViewOfFile
CreateDirectoryW
UnmapViewOfFile
GetFileSizeEx
DelayLoadFailureHook

msvcrt

_onexit
_except_handler3
malloc
free
realloc
_purecall
wcscpy
wcslen
wcscmp
wcscat
_snwprintf
_local_unwind2
_beginthreadex
_wcsicmp
wcstombs
wcsncpy
_errno
_wrename
wcstok
wcstol
_i64tow
__CxxFrameHandler
swscanf
_vsnwprintf
wcsrchr
_waccess
_wstrtime
_wstrdate
_wcsnicmp
_initterm
_adjust_fdiv
__dllonexit

ntdll

DbgUserBreakPoint

ole32

StringFromCLSID
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
CoGetObjectContext
CoRevertToSelf
CoImpersonateClient
StringFromGUID2
CLSIDFromString
CoGetCallContext

oleaut32

LoadRegTypeLi
VarUI4FromStr
SysStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString

user32

CharNextW
LoadStringW
CharPrevW
wsprintfW
CloseDesktop
GetThreadDesktop
SetThreadDesktop
OpenDesktopW
SetWindowPos
MapWindowPoints
GetClientRect
GetWindowRect
GetDesktopWindow
SetProcessWindowStation
OpenWindowStationW
wsprintfA
CharLowerW
DialogBoxParamW
EndDialog
SetDlgItemTextW
CloseWindowStation
GetProcessWindowStation

version

VerQueryValueW

Exports

Exports

?CancelWriteICR@@YGJPAPAUIComponentRecords@@@Z
?GetReadICR@@YGJHPAPAUIComponentRecords@@@Z
?GetWriteICR@@YGJPAPAUIComponentRecords@@@Z
?ReleaseReadICR@@YGXPAPAUIComponentRecords@@@Z
?SaveWriteICR@@YGJPAPAUIComponentRecords@@@Z
CreateComponentLibraryTS
DllCanUnload123
DllGetClassObj123
DllRegisterSer123
Enter
GetCatalogCRMClerk
OpenComponentLibrarySharedTS
OpenComponentLibraryTS

Sections

.text
Size: 229KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 489KB - Virtual size: 489KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8bc1f5f3dbdd153468f5cedc47cda5fb

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

ole32

oleaut32

user32

version

Exports

Exports

Sections

.text Size: 229KB - Virtual size: 232KB

.data Size: 2KB - Virtual size: 20KB

.rsrc Size: 489KB - Virtual size: 489KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 229KB - Virtual size: 232KB

.data
Size: 2KB - Virtual size: 20KB

.rsrc
Size: 489KB - Virtual size: 489KB

.reloc
Size: 9KB - Virtual size: 8KB