NSISPromotionEx[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

NSISPromotionEx.dll
Size

1.8MB
MD5

f64d6c038403367a03396e3438fcdb37
SHA1

3382664d84d896182a9f70fdfcbba47925d3ef3a
SHA256

e9538796a9a9d05814c29166e546b56f5fa5213db8d9ec92b35f3f5abeec05a5
SHA512

e1950d27512b1e29fe9caf2361449cdad585cba1ec3fb31d6ed543f31b2d7abae94bb15f8b536ce1a3566d4e7f5ff17426f6d41687ccdfc09fe332bc71a57f9b
SSDEEP

24576:V88x/AhKA/qyFpB4KeS7JwWSUfOpVk2XAPqljAFWltiU:y8xYgHezBJVfOpVk2xljAoltiU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NSISPromotionEx.dll

Files

NSISPromotionEx.dll
.dll windows:6 windows x86 arch:x86

0db9dd9a56d31ef44a12af0bf9884dec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
GetFileSizeEx
ReadFile
MulDiv
GetSystemTimeAsFileTime
lstrcmpW
LoadLibraryW
GetModuleFileNameW
CreateProcessW
CreateFileW
GetACP
DecodePointer
GetSystemDefaultUILanguage
GetPrivateProfileIntW
GetPrivateProfileStringW
FreeResource
LockResource
LoadResource
SizeofResource
WriteFile
lstrcpyW
lstrcatW
FindResourceW
GetTempPathW
GetTempFileNameW
GetFileSize
GetTickCount
GetPrivateProfileStringA
WritePrivateProfileStringW
GetVersionExW
GetCurrentThread
SetThreadPriority
InitializeCriticalSection
SetFilePointer
HeapReAlloc
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
HeapDestroy
HeapSize
LocalAlloc
GetFullPathNameW
GetFullPathNameA
CreateMutexW
HeapCompact
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
SystemTimeToFileTime
QueryPerformanceCounter
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
UnlockFileEx
FormatMessageA
GetFileAttributesA
HeapCreate
HeapValidate
SetLastError
RaiseException
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
IsDebuggerPresent
SetEnvironmentVariableA
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
ReadConsoleW
GetFileType
GetStdHandle
GetConsoleMode
GetConsoleCP
GetOEMCP
IsValidCodePage
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetCommandLineA
ResumeThread
LoadLibraryExW
ExitThread
CreateThread
RtlUnwind
GetStringTypeW
EncodePointer
FlushFileBuffers
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
GlobalMemoryStatusEx
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetVersion
FreeLibrary
GetVersionExA
IsBadStringPtrW
IsBadWritePtr
IsBadReadPtr
GetModuleHandleW
GetProcAddress
lstrlenA
FormatMessageW
GetFileAttributesW
CreateDirectoryW
GetDriveTypeW
WideCharToMultiByte
MultiByteToWideChar
OutputDebugStringW
OutputDebugStringA
DeleteFileW
CloseHandle
Sleep
GetLastError
InterlockedDecrement
InterlockedIncrement
VerifyVersionInfoW
lstrlenW
LocalFree
LockFileEx
VerSetConditionMask

user32

RegisterWindowMessageW
wsprintfW
SendMessageW
OffsetRect
GetWindowRect
GetSystemMetrics
DefWindowProcW
CallWindowProcW
RemovePropW
GetPropW
SetPropW
EnableWindow
GetMonitorInfoW
MonitorFromRect
SystemParametersInfoW
LoadStringW
CopyRect
PeekMessageW
DispatchMessageW
EndDialog
LoadCursorW
GetWindow
GetClassNameW
EnumChildWindows
GetParent
GetDesktopWindow
SetWindowLongW
GetWindowLongW
FillRect
GetSysColor
CreateAcceleratorTableW
DestroyAcceleratorTable
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
InvalidateRgn
RedrawWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetFocus
SetFocus
CharNextW
GetDlgItem
DialogBoxParamW
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
UnregisterClassW
RegisterClassExW
GetClassInfoExW
ScreenToClient
ClientToScreen
IsWindow
PostMessageW
FindWindowW
MessageBoxW
CreateWindowExW
IsChild

advapi32

RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegCreateKeyW
RegCloseKey

ole32

CoGetClassObject
CoCreateInstance
CoUninitialize
CoInitialize
OleSetContainedObject
OleCreate
CreateStreamOnHGlobal
OleLockRunning
OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
CLSIDFromString

shell32

ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFolderPathW

oleaut32

SysAllocStringLen
SysFreeString
SysStringLen
OleLoadPicture
SysAllocString
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit

shlwapi

PathFileExistsW

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
DeleteDC
AddFontResourceW
GetDeviceCaps
GetStockObject
SelectObject
GetObjectW
CreateFontIndirectW
CreatePen
Rectangle
SetBkColor
SetTextColor
CreateDIBSection
DeleteObject

crypt32

CryptUnprotectData

wininet

InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
InternetAttemptConnect
HttpOpenRequestA
InternetConnectA
HttpSendRequestExA
InternetQueryDataAvailable
InternetOpenUrlW
InternetCanonicalizeUrlW
HttpQueryInfoW
HttpEndRequestW
InternetSetOptionW
InternetWriteFile
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetCrackUrlW
InternetSetCookieExW

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

wintrust

WinVerifyTrust

ws2_32

WSAStartup
gethostname
gethostbyname
WSACleanup

Exports

Exports

AddCustomFont
AddMultiSz
Base64Encode
CMCookieAction
CMGetDefaultBrowserType
CallJavaScript
Check11stExtentionInstall
Check11stShockExtentionInstall
CheckDHP
CheckGSearch
CheckGSearch2
CheckMultiSz
CheckNetCafe
CheckNetCodec_KOR
CheckPromotionInstall
CheckSupportSSE2
CheckYandexInstall
CreateStaticControl
CreateWebControl
CustomEnterKeyDown
CustomInvalidate
CustomMoveWindow
CustomShowWindow
GetCurrentTimeNsis
GetHashString
GetMultiSz
GetPCGuidText
GetPlayaNextData
GetRegQWORD
GetSectionPromotionPath
GetSystemMemoryEx
GetSystemTimeString
GetUKey
GetURLDecodeText
InstGSearch
InstGSearch2
InstGomMix
InstYandex
Install11StExtention
Install11StShockExtention
InstallSectionOffer
KillWebControl
RequestPromotionInstall
SetupNetCodec_KOR
Show6432Dialog
Show6432EncoderDialog
Show6432PlayerDialog
Show6432VCDialog
ShowDotNetDialog
ShowMsgDialog
ShowPopupTestDlg
ShowSelectLanguageDialog
Verify
Verify2

Sections

.text
Size: 873KB - Virtual size: 873KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 767KB - Virtual size: 767KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0db9dd9a56d31ef44a12af0bf9884dec

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

crypt32

wininet

rpcrt4

wintrust

ws2_32

Exports

Exports

Sections

.text Size: 873KB - Virtual size: 873KB

.rdata Size: 116KB - Virtual size: 115KB

.data Size: 14KB - Virtual size: 93KB

.rsrc Size: 767KB - Virtual size: 767KB

.reloc Size: 33KB - Virtual size: 33KB

.text
Size: 873KB - Virtual size: 873KB

.rdata
Size: 116KB - Virtual size: 115KB

.data
Size: 14KB - Virtual size: 93KB

.rsrc
Size: 767KB - Virtual size: 767KB

.reloc
Size: 33KB - Virtual size: 33KB