XMLTools[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

XMLTools.dll
Size

3.1MB
MD5

96cbc9316f970423405313ce59d39125
SHA1

2a04883eecc8a91560c1554472b8f589a4d81736
SHA256

1329ecf5572250c22f47476630810612aa7adb644156fb955d16e6199806acfb
SHA512

5f1f308ea533cc69c41f8d3dabf02d64924b60545186e8b50f3952f4cccdf2168a644956ed0b7125f2e4f57af99e5ab98b153df426660d6b0e13fbb3685e4f72
SSDEEP

49152:zaCEwqKAAt8rz/PHWE9SKwZ/VGxR8KpXG8eRaCKRSKyndFMQ/Vsswzn:zO68n/eZ7VPKRSK0dFn/Vsl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XMLTools.dll

Files

XMLTools.dll
.dll windows:6 windows x64 arch:x64

53ca7e5a23933078cb2f0467b6620f6a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
SetEvent
WaitForSingleObject
CreateEventW
SetThreadPriority
ResumeThread
GetCurrentThread
GetVersionExW
lstrcmpA
InitializeCriticalSectionAndSpinCount
GlobalFlags
InitializeCriticalSection
GlobalGetAtomNameW
LocalFree
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
VirtualProtect
VerSetConditionMask
lstrcpyW
VerifyVersionInfoW
SetErrorMode
GetCurrentDirectoryW
DeleteFileW
CreateFileW
FindClose
FindFirstFileW
FlushFileBuffers
GetFileSize
GetFullPathNameW
GetVolumeInformationW
LockFile
ReadFile
SetEndOfFile
SetFilePointer
UnlockFile
WriteFile
DuplicateHandle
GetCurrentProcess
lstrcmpiW
FindResourceExW
GetWindowsDirectoryW
GetTempPathW
GetFileAttributesW
Sleep
SearchPathW
GetTickCount
GetProfileIntW
FileTimeToLocalFileTime
GetFileAttributesExW
GetFileSizeEx
GetFileTime
SystemTimeToTzSpecificLocalTime
GetTempFileNameW
GetUserDefaultLCID
ResetEvent
WaitForSingleObjectEx
FileTimeToSystemTime
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetStringTypeW
LCMapStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
QueryPerformanceFrequency
SetEnvironmentVariableW
SetCurrentDirectoryW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
HeapQueryInformation
GetSystemInfo
VirtualAlloc
VirtualQuery
SetStdHandle
GetFileType
ExitProcess
GetStdHandle
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GlobalSize
GlobalFree
CompareStringW
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetSystemDirectoryW
SetLastError
EncodePointer
OutputDebugStringA
GetCurrentProcessId
CopyFileW
RtlCaptureContext
FormatMessageW
MulDiv
GetModuleHandleExW
GetCurrentThreadId
GlobalLock
GlobalUnlock
GlobalAlloc
WideCharToMultiByte
lstrlenW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetLastError
RaiseException
DecodePointer
RtlUnwind

user32

GetWindowThreadProcessId
GetMessageW
TranslateMessage
PostQuitMessage
ShowOwnedPopups
GetKeyNameTextW
MapVirtualKeyW
RealChildWindowFromPoint
GetSysColorBrush
DestroyMenu
GetMenuItemInfoW
SystemParametersInfoW
CopyImage
MapDialogRect
SetLayeredWindowAttributes
EnumDisplayMonitors
IntersectRect
LoadMenuW
BringWindowToTop
LoadAcceleratorsW
TranslateAcceleratorW
CreatePopupMenu
InsertMenuItemW
DestroyIcon
LoadImageW
UnpackDDElParam
ReuseDDElParam
WindowFromPoint
DrawEdge
DrawFrameControl
SetWindowRgn
DrawIconEx
UpdateLayeredWindow
SetTimer
KillTimer
UnionRect
MonitorFromPoint
TrackMouseEvent
IsZoomed
GetComboBoxInfo
CharUpperW
GetSystemMenu
DeleteMenu
GetMenuDefaultItem
SetMenuDefaultItem
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetCursorPos
SetRect
SetParent
LockWindowUpdate
SetClassLongPtrW
GetDoubleClickTime
GetIconInfo
CopyIcon
ModifyMenuW
RegisterClipboardFormatW
WaitMessage
PostThreadMessageW
GetNextDlgGroupItem
FrameRect
DrawIcon
CharUpperBuffW
IsCharLowerW
MapVirtualKeyExW
DrawMenuBar
RemoveMenu
DefMDIChildProcW
TranslateMDISysAccel
IsClipboardFormatAvailable
GetUpdateRect
SubtractRect
CreateMenu
DestroyCursor
GetWindowRgn
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
SendDlgItemMessageA
RedrawWindow
ValidateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetCapture
GetKeyState
SetFocus
GetDlgCtrlID
GetDlgItem
IsIconic
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
IsMenu
IsWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
RegisterWindowMessageW
GetParent
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
GetFocus
AppendMenuW
FillRect
InsertMenuW
GetMenuState
GetMenuStringW
NotifyWinEvent
LoadCursorW
IsRectEmpty
InflateRect
SetRectEmpty
InvertRect
DrawFocusRect
ClientToScreen
HideCaret
GetCursorPos
SetCursor
MessageBeep
EnableScrollBar
GetSystemMetrics
ReleaseCapture
SetCapture
GetAsyncKeyState
GetWindowTextW
InvalidateRect
DrawStateW
GetDesktopWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
IsDialogMessageW
SetWindowTextW
IsWindowEnabled
CheckDlgButton
SetDlgItemTextW
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
OffsetRect
ReleaseDC
GetWindowDC
GetDC
TabbedTextOutW
GrayStringW
DrawTextExW
ScrollWindow
GetScrollInfo
SetScrollInfo
GetWindow
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
EqualRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
DrawTextW
AdjustWindowRectEx
DefFrameProcW
GetWindowRect
UpdateWindow
GetDialogBaseUnits
LoadIconW
LoadBitmapW
GetWindowTextLengthW
UnregisterClassW
EnableWindow
SendMessageW
GetMenu
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
GetClientRect
MessageBoxW
CheckMenuItem

gdi32

CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgn
Escape
ExcludeClipRect
CreateCompatibleDC
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
BitBlt
CreateDCW
CopyMetaFileW
GetTextMetricsW
SelectObject
CreateRectRgnIndirect
CreateFontIndirectW
GetStockObject
DeleteObject
CreateSolidBrush
GetObjectW
SetTextColor
GetClipBox
CreateBitmap
GetTextFaceW
DeleteDC
GetDeviceCaps
GetTextExtentPoint32W
LineTo
GetViewportOrgEx
GetWindowOrgEx
GetBoundsRect
FillRgn
SetPaletteEntries
ExtFloodFill
SetPixelV
PtInRegion
FrameRgn
RoundRect
LPtoDP
GetSystemPaletteEntries
GetNearestPaletteIndex
OffsetRgn
GetRgnBox
SetDIBColorTable
StretchBlt
SetPixel
EnumFontFamiliesExW
CreateRoundRectRgn
RealizePalette
Rectangle
GetPaletteEntries
CreatePalette
CreateDIBSection
Polyline
Polygon
CreatePolygonRgn
GetTextColor
GetBkColor
Ellipse
CreateEllipticRgn
DPtoLP
SetRectRgn
CombineRgn
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
CreateCompatibleBitmap
PatBlt
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
SetBkColor

shell32

SHGetFileInfoW
SHGetDesktopFolder
SHBrowseForFolderW
SHAppBarMessage
SHGetSpecialFolderLocation
SHGetPathFromIDListW
DragFinish
ShellExecuteW
DragQueryFileW

ole32

OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
OleLockRunning
DoDragDrop
CreateStreamOnHGlobal
CoDisconnectObject
CoInitializeEx
CoCreateGuid
ReleaseStgMedium
OleDuplicateData

oleaut32

VariantInit
SysFreeString
VariantCopy
SysAllocString
SysStringLen
SysAllocStringLen
VariantChangeType
VariantClear
LoadTypeLi
VarBstrFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime

msimg32

AlphaBlend
TransparentBlt

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathFindExtensionW

uxtheme

GetThemeSysColor
GetThemeColor
DrawThemeBackground
IsThemeBackgroundPartiallyTransparent
IsAppThemed
CloseThemeData
OpenThemeData
GetThemePartSize
GetWindowTheme
GetCurrentThemeName
DrawThemeText
DrawThemeParentBackground

gdiplus

GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageI
GdipBitmapLockBits

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegEnumKeyW
RegQueryValueW
RegEnumValueW
RegEnumKeyExW

Exports

Exports

beNotified
getFuncsArray
getName
isUnicode
messageProc
setInfo

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 631KB - Virtual size: 631KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

53ca7e5a23933078cb2f0467b6620f6a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

msimg32

shlwapi

uxtheme

gdiplus

oleacc

imm32

winmm

winspool.drv

advapi32

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 631KB - Virtual size: 631KB

.data Size: 33KB - Virtual size: 63KB

.pdata Size: 96KB - Virtual size: 96KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 243KB - Virtual size: 242KB

.reloc Size: 61KB - Virtual size: 61KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 631KB - Virtual size: 631KB

.data
Size: 33KB - Virtual size: 63KB

.pdata
Size: 96KB - Virtual size: 96KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 243KB - Virtual size: 242KB

.reloc
Size: 61KB - Virtual size: 61KB