HEARTB[.]dll 1[.]7z

General

Target
HEARTB.dll 1.7z
Size 2.6MB
Sample240417-qjwsmsha69
SHA256 f12f784ecc9c86111f82c2deed84facffa8761629b9604eabbc7e89aa3157c45
MD5 c1e4c68cac8617153c8ba118ac88999d
SHA1 c12fe1002a1bb5373f11fa72477c8112e5b53be0
SHA512 ec74c21b76df3fc85458628763e594d60466760fc2c340ecdadd7a3aa9e987c79709af1ba2eb5d13a518221379a6b0e23ee773a9a094cb444a7a10bf7f9777d1
SSDEEP 49152:JTzm/Ot3c6WnAgm+vKrcBO0fQc0g4yqvwLhp3U5ulEG0uqHIAIKfXeARix:Fm/OdlWo+4e/0g4yUAv3UhdHIAnK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/HEARTB.dll

File Explorer

HEARTB.dll 1.7z

.7z 2.6MB
HEARTB.dll

.dll 762.9MB

HEARTB.dll 1.7z

SHA256 f12f784ecc9c86111f82c2deed84facffa8761629b9604eabbc7e89aa3157c45
MD5 c1e4c68cac8617153c8ba118ac88999d
SHA1 c12fe1002a1bb5373f11fa72477c8112e5b53be0
SHA512 ec74c21b76df3fc85458628763e594d60466760fc2c340ecdadd7a3aa9e987c79709af1ba2eb5d13a518221379a6b0e23ee773a9a094cb444a7a10bf7f9777d1
SSDEEP 49152:JTzm/Ot3c6WnAgm+vKrcBO0fQc0g4yqvwLhp3U5ulEG0uqHIAIKfXeARix:Fm/OdlWo+4e/0g4yUAv3UhdHIAnK
MD5 SHA1 SHA512 SSDEEP

Password

infected

HEARTB.dll

IMPHASH 7e160f4153291da1ea63960c8e40216d
SHA256 4c10fd9d4054a3454750bcd9a130e3d852644e821fd18396f89deefa9ab3c75a
MD5 29655ea1367ead030a3bf40659327ca0
SHA1 d176cc3048e0727f2b81ea027b039bbde85db3e3
SHA512 b6e79c239097869eac20ee931171ab540f646752f498009c97a19fa4e83a96b8fbc85ae8a9bd5b49105de489ce45adada2b00620c016ae3b0ab81e60faee5144
SSDEEP 98304:oDHQXidDnBW0hcthSDnqDO5rzRQfaxcxVtn:oui9gDmyhrn
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

5

Entry point

3893076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\p4builds\Products\GoToMeeting\v4.5_builds\output\G2M.pdb

kernel32

SetEvent WaitForMultipleObjects CreateEventW InterlockedDecrement InterlockedIncrement SetLastError GlobalFree GetPrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileSectionNamesW DeleteFileW ReadFile GetFileInformationByHandle CreateFileW WriteFile LocalFree FormatMessageW LoadLibraryW GetTimeZoneInformation GetWindowsDirectoryW GetCurrentProcess GetTempPathA CreateDirectoryA GetVersionExW GetCurrentThreadId LocalAlloc InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW GetDiskFreeSpaceExW CreateProcessW CreateMutexW GetShortPathNameW GetSystemDirectoryW GetLocalTime SystemTimeToFileTime GetSystemTime SetWaitableTimer CreateWaitableTimerW WritePrivateProfileStringW ReleaseMutex GetDateFormatW OpenMutexW GetLocaleInfoW VirtualFree VirtualAlloc GlobalLock GlobalUnlock GlobalAlloc lstrlenW FlushInstructionCache lstrcmpW MulDiv GetTimeFormatW FileTimeToSystemTime GetVersionExA GetTempPathW ExpandEnvironmentStringsW MultiByteToWideChar LockResource SizeofResource LoadResource FindResourceW GetTickCount CompareFileTime GetModuleFileNameW QueryPerformanceCounter CreateDirectoryW FindClose FindNextFileW FindFirstFileW GetFileSize GetFileAttributesW GetFileTime Thread32Next Thread32First CreateToolhelp32Snapshot Process32NextW Process32FirstW DisableThreadLibraryCalls LoadLibraryExW lstrcmpiW SetThreadPriority IsBadReadPtr SetUnhandledExceptionFilter ResumeThread GetThreadContext SuspendThread UnmapViewOfFile MapViewOfFile CreateFileMappingW TerminateThread ResetEvent OpenEventW GetSystemWindowsDirectoryW GetComputerNameW GetSystemInfo GlobalMemoryStatusEx lstrlenA SetFilePointer SetEndOfFile FlushFileBuffers CopyFileW GetTempFileNameW MoveFileW TryEnterCriticalSection WideCharToMultiByte RemoveDirectoryW SetCurrentDirectoryW GetSystemTimeAsFileTime ReleaseSemaphore CreateSemaphoreW FindVolumeClose FindNextVolumeW QueryDosDeviceW FindFirstVolumeW HeapCreate HeapDestroy HeapAlloc HeapFree TlsFree GetVolumeInformationW GetLogicalDriveStringsW GetProcessHeap GlobalMemoryStatus GetDiskFreeSpaceW GetDriveTypeW SetErrorMode CreateThread GetTimeFormatA InterlockedExchange GetModuleFileNameA IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetCurrentThread TerminateProcess OpenProcess GetLastError GetCurrentProcessId GetCommandLineW WaitForSingleObject CloseHandle GetProcAddress FreeLibrary Sleep TlsAlloc TlsSetValue TlsGetValue GetExitCodeProcess ExitProcess RaiseException GetDateFormatA GetVersion CreateEventA UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA ExitThread RtlUnwind FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA HeapReAlloc HeapSize SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode GetFullPathNameA PeekNamedPipe CreateFileA GetCurrentDirectoryA InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA FoldStringW QueryPerformanceFrequency

gdi32

SaveDC BitBlt CreateSolidBrush SetBkMode SetBrushOrgEx CreateCompatibleBitmap CreatePatternBrush CreateCompatibleDC SelectObject GetPixel SetPixel DeleteDC DeleteObject GetObjectW GetStockObject CreateFontIndirectW GetDCOrgEx GetClipBox CombineRgn SetRectRgn CreateRectRgn GetTextExtentPoint32W SetTextColor SetBkColor TextOutW GetTextMetricsW RestoreDC CreateDIBSection CreateFontW SetDIBits SetDIBColorTable GetDIBits SetPixelV MoveToEx LineTo SetViewportOrgEx SetWindowOrgEx SetViewportExtEx SetWindowExtEx SetMapMode ExcludeClipRect SelectClipRgn StretchBlt SetStretchBltMode CreateRoundRectRgn CreatePolygonRgn PaintRgn GetSystemPaletteEntries Polyline EqualRgn GetRgnBox OffsetRgn CreateRectRgnIndirect GetRegionData FillRgn SetROP2 CreateBitmap ExtTextOutW FrameRgn Polygon SetPolyFillMode CreatePen GetDIBColorTable GetPaletteEntries CreateDIBitmap CreatePalette GetDeviceCaps

shlwapi

PathRemoveExtensionW PathStripPathW StrFormatByteSizeW

wininet

HttpOpenRequestW InternetReadFileExA HttpQueryInfoW HttpSendRequestExW InternetQueryOptionW HttpEndRequestW InternetErrorDlg InternetConnectW InternetCloseHandle InternetOpenW InternetSetOptionW InternetSetStatusCallbackW

generic

count=1, id=150, version=20413,

count=52, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=132, productName=VS2008 build 21022, version=21022,

count=3, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=69, id=10, version=8447,

count=94, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=13, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=45, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=9, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=20, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=66, id=110, productName=VS2005 build 50727, version=50727,

count=40, id=109, productName=VS2005 build 50727, version=50727,

count=775, id=1, productName=Unmarked objects,

count=33, id=123, productName=VS2005 build 50727, version=50727,

count=1386, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=740, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

Sharing