SecuriteInfo[.]com[.]Win32[.]Application[.]CNSHelper[.]A[.]21578[.]15500[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Win32.Application.CNSHelper.A.21578.15500.dll
Size

77KB
MD5

f55527108daa507c46ea57d5727f5b61
SHA1

14dbb91efb91e9e8b8fd26086d60698fdb0ced00
SHA256

7b84fb02c2c75d9cd1c7de8fc0c1cd9e3658cc1f3bac1e47638d314483a944c7
SHA512

2ec6c50a63ee216ff65904f5418c24a6f2cb3d25c4ebba237f669fc3b644eb52e368ff86203d9f84bd7aa8f67626a309578cf38d833e9aa35a599220d4c37415
SSDEEP

1536:+RmJhso9kEYYl0MvS1yaj2plNJ+jaFYdemZ0ToQ/q0YrvXnNw9TPkXnNw9TPCVrN:ymJhso9ky0Mqxj0NJ+22QU0fWXnNw9Tu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Win32.Application.CNSHelper.A.21578.15500.dll

Files

SecuriteInfo.com.Win32.Application.CNSHelper.A.21578.15500.dll
.dll regsvr32 windows:4 windows x86 arch:x86

d3067b03601d4f73eaf15c5396d977c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathMatchSpecA
SHDeleteValueA
SHDeleteEmptyKeyA
SHSetValueA
SHDeleteKeyA
SHGetValueA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

wininet

InternetCrackUrlA
InternetGetConnectedState

kernel32

FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
GetShortPathNameA
CloseHandle
GetLastError
CreateMutexA
GetPrivateProfileStringA
GetPrivateProfileSectionA
WaitForSingleObject
DeleteFileA
GetTickCount
lstrcatA
lstrcpyA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
GetTempFileNameA
EnterCriticalSection
lstrlenW
GetModuleHandleA
GetModuleFileNameA
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
IsDBCSLeadByte
GetCommandLineA
DisableThreadLibraryCalls
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
Sleep
InterlockedIncrement
GetSystemDefaultLangID
WriteFile
CreateFileA
GetWindowsDirectoryA
GetVersionExA
MoveFileExA
CopyFileA
CreateDirectoryA
SetErrorMode
ReadFile
GetFileSize
DebugBreak
OutputDebugStringA
LeaveCriticalSection
lstrlenA
InterlockedDecrement
lstrcpynA
LocalFree
GetTempPathA

user32

CreateWindowExA
DestroyMenu
GetSubMenu
DefWindowProcA
DestroyWindow
IsWindow
SendMessageA
TrackPopupMenu
CheckMenuItem
MapWindowPoints
SetWindowPos
GetDesktopWindow
CharUpperA
wvsprintfA
SetForegroundWindow
EnumWindows
GetClassNameA
PostMessageA
FindWindowExA
GetDlgItem
GetClientRect
ShowWindow
GetForegroundWindow
MessageBoxA
LoadImageA
LoadBitmapA
CharNextA
CharLowerA
CallWindowProcA
GetWindowLongA
SetWindowLongA
LoadMenuA
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
LoadStringA
AppendMenuA
RedrawWindow

gdi32

DeleteObject

advapi32

RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegQueryValueExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CLSIDFromString

oleaut32

LoadRegTypeLi
LoadTypeLi
SysAllocString
RegisterTypeLi
VarUI4FromStr
VariantClear
VariantInit
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysAllocStringLen

comctl32

ImageList_Create
ImageList_Destroy
ImageList_AddMasked

urlmon

URLDownloadToFileA

msvcrt

_CxxThrowException
memmove
_ismbcdigit
strcat
rewind
fgets
_strnicmp
_mbspbrk
_mbsstr
isalnum
_strlwr
_purecall
memcmp
realloc
strchr
strcspn
isspace
_strnset
wcslen
wcsncpy
strlen
fopen
fseek
fprintf
fclose
time
sprintf
_except_handler3
sscanf
_snprintf
free
_beginthreadex
malloc
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
atoi
strcmp
strcpy
strncpy
strstr
??2@YAPAXI@Z
_stricmp
_itoa
mbstowcs
memset
memcpy
strrchr
__CxxFrameHandler

setupapi

SetupIterateCabinetA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Exec

Sections

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ehelper
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3067b03601d4f73eaf15c5396d977c7

Headers

File Characteristics

Imports

shlwapi

version

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

urlmon

msvcrt

setupapi

Exports

Exports

Sections

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 49KB - Virtual size: 53KB

.ehelper Size: 512B - Virtual size: 24B

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 5KB - Virtual size: 4KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 49KB - Virtual size: 53KB

.ehelper
Size: 512B - Virtual size: 24B

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 5KB - Virtual size: 4KB