CleanUp23[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CleanUp23.dll
Size

4.4MB
MD5

eb76163bfbc33bb12e35b802499c437d
SHA1

4569de8158cf2e49b7acbf4fe006c79e4794d2be
SHA256

63d53bba3e0614961d7e36c34b6f6b98a016afa08dfe97c3a5706c0d3cdfa696
SHA512

b34c75520a23c254c9205729039ccf960e5077ec6f1cd1e21d85bfccba7456ddce02603da7eaa18914c45467b18af78a1448cc7a88b064fcd5a1c9f78cf8e1e6
SSDEEP

98304:YG+BZrWx1pN9vX3h0Qo+HtCw/Kx95JFrk8EWYzDMOsY69sd0ZUL:5+frg3N9vXxxLHtCwCX5Jxk89Yn0rU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CleanUp23.dll

Files

CleanUp23.dll
.dll windows:4 windows x86 arch:x86

a70f5d90edc55ac2cf9176de3165aee0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

gdi32

ChoosePixelFormat
EngMarkBandingSurface
ExtTextOutW
GdiPlayJournal
GetBoundsRect
GetFontRealizationInfo
GetICMProfileW
GetLogColorSpaceA
PolyPatBlt
SetAbortProc

kernel32

CallNamedPipeW
ClearCommBreak
CreateActCtxA
CreateFileTransactedA
CreateMutexA
CreateSemaphoreA
CreateTapePartition
DebugActiveProcessStop
DebugBreak
EnumLanguageGroupLocalesA
EnumLanguageGroupLocalesW
EnumResourceNamesExW
EnumResourceNamesW
EnumTimeFormatsEx
FreeLibraryAndExitThread
GetActiveProcessorGroupCount
GetDiskFreeSpaceA
GetLongPathNameTransactedW
GetLongPathNameW
GetPrivateProfileSectionNamesW
GetProcAddress
GetProcessHandleCount
GetProcessIoCounters
GetShortPathNameA
GetSystemDirectoryA
HeapSetInformation
IsBadStringPtrW
LoadLibraryA
LocalSize
OpenWaitableTimerA
PrivCopyFileExW
QueryDepthSList
SetComputerNameExA
SetHandleCount
SetStdHandle
VerLanguageNameA
VerifyVersionInfoW
WaitCommEvent
WaitNamedPipeW
WerGetFlags
WriteFileGather
WritePrivateProfileSectionA

msvcrt

bsearch
fgetws
fopen_s
free
localtime
malloc
memcpy
memset
putwchar
qsort
realloc
strcat_s
strcmp
wcschr
wscanf_s
_wcslwr
_strtoi64
_spawnlpe
_sopen
_ltoa
_creat

shell32

ILCombine
PathMakeUniqueName
SHBrowseForFolderW
SHCreateDefaultExtractIcon
SHCreateItemFromIDList
SHCreateShellItemArrayFromIDLists
SHEmptyRecycleBinA
SHGetIconOverlayIndexA
SHOpenPropSheetW

user32

ArrangeIconicWindows
BeginDeferWindowPos
CancelShutdown
CharNextExA
EnterReaderModeHelper
EnumClipboardFormats
EnumWindows
FreeDDElParam
GetAncestor
GetDesktopWindow
GetDlgItem
GetInputState
GetMonitorInfoA
GetSubMenu
GetSystemMetrics
ImpersonateDdeClientWindow
IsWow64Message
LoadCursorW
LoadLocalFonts
LoadMenuIndirectA
OpenClipboard
PaintMonitor
PeekMessageA
RealGetWindowClassW
RecordShutdownReason
RegisterSessionPort
SetDebugErrorLevel
SetRect
TileWindows
TranslateMDISysAccel
UnregisterHotKey
UnregisterPowerSettingNotification
UpdatePerUserSystemParameters

Exports

Exports

Alaska_hand_diffuseness
Betelgeuse_avatars_exceptionable
EssenAlar
Gatling_copyrights
Lissajous_gunfights
LucyEsteban_humiliates
Noels_fervently
NoemiJehoshaphat_epaulettes
Saracen_chummiest
Socratic_equates
Susana_dabbled
Swinburne_emoting
Test
York_smoldering_scoreboard
anathema_downstairs
aprons_debtLuann
balmier_helpfullyHiram
beeping_specifiers
beer_elliptically
began_mossiest
beyondHamill_juggler
blearily_lapidaries_manacle
bursted_nuptialsWalt
busies_encodesVasquez
cants_atom_photogenic
captives_motionsAltai
caterer_acct
chalkboards_prosier_beach
charters_backstretch_showbiz
clownishlySamaritans
collage_soliderAldo
cosmetology_amputated
cower_places
crepes_concurrences_baits
deadly_pigskin_opportunism
dedicated_commonwealths_schoolroom
densities_scheming
dumfounded_cavalier_scorching
endearingly_lasciviously_gamecock
envisionsEvelyn
exalting_prongs
extemporizesWatertown_dissembling
filler_strange
floured_baskets
flubs_overlandCaterpillar
foothill_anthology_remedial
foretelling_overclocked_polish
headhunters_luridness_pebble
ilk_credible
immunizations_observed
infusionProf_sensationalists
janitors_inning_germicidal
juncoesNkrumah_necromancy
milksops_infusion
miniaturizingAugustsFiji
moped_experimented_haunting
nets_starkest_gifts
niceties_clinical
paltriest_regurgitation
persistently_pouts_oftentimes
poking_underscoring
potboilers_gnarliest_assassinating
punched_coworkers_islanders
quieter_dart
radioed_crunchiest_risers
rashes_piquant_carsickness
redress_difficulties
residences_seventeenthsBabylon
reupholstered_holliesPratchett
sableFelicia
scanties_hubcaps_petrels
schematic_gainsMegan
secured_wrinkles
slenderizing_clutch
sports_granaries
stonily_jells
supplicants_pug
tram_penalizing
treatment_minimization
xxxvi_croaks

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 324KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 446KB - Virtual size: 446KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a70f5d90edc55ac2cf9176de3165aee0

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

kernel32

msvcrt

shell32

user32

Exports

Exports

Sections

.text Size: 3.6MB - Virtual size: 3.6MB

.data Size: 8KB - Virtual size: 8KB

.rdata Size: 324KB - Virtual size: 324KB

.bss Size: - Virtual size: 1KB

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 446KB - Virtual size: 446KB

.text
Size: 3.6MB - Virtual size: 3.6MB

.data
Size: 8KB - Virtual size: 8KB

.rdata
Size: 324KB - Virtual size: 324KB

.bss
Size: - Virtual size: 1KB

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 446KB - Virtual size: 446KB