UIRibbon[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

UIRibbon.dll
Size

3.2MB
MD5

847d1991bebb633f821bfbc4f9b1e0c5
SHA1

d1bd1acf4849f4a1c1ccaf8459d23cd0302987e7
SHA256

50bf49ad79d202bb3772400acee74106171959e77c330a5005cfe36520e34349
SHA512

cbe9dda5405ce6969b18578baf587c322cf76a1451cb09da849ab8d6eb37b8ed4a6342f4f57e39fa50d66fc63dc5d9bdda085095361176836f43f5db694ca263
SSDEEP

49152:8e/ImlZ4xmmltyQitjoexojTY37cF7lMc0i5t6D1lMXqkCcDiDs5/Xe1+:1ZCyZoyKTY3IbMhi5Y1l3kCcDiDsw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UIRibbon.dll

Files

UIRibbon.dll
.dll windows:10 windows x86 arch:x86

23159f8aedeefa0e8ba7a7ce56b15d0e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

UIRibbon.pdb

Imports

msvcrt

_ftol2
_ftol2_sse
ceil
floor
memcmp
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
wcsncmp
wcsrchr
qsort
swprintf_s
_isnan
__RTDynamicCast
_wtoi
fclose
fopen
fwprintf
wcstoul
_resetstkoflw
strstr
_wcsupr
fgets
iswascii
iswprint
wcstok
_CIsin
_CIpow
_CIlog10
_CIlog
_CIfmod
_CIexp
_CIcos
free
_finite
memcpy_s
_vsnwprintf
realloc
_purecall
_callnewh
malloc
_CIsqrt
memset

advapi32

IsTextUnicode
RegSetKeyValueW
RegGetValueW
RegQueryValueExA
RegOpenKeyExA
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
UnregisterTraceGuids
TraceEvent
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

gdi32

RealizePalette
SetBitmapBits
DeleteEnhMetaFile
SetMapMode
GetTextMetricsW
CreateDIBPatternBrushPt
LPtoDP
PatBlt
ScriptItemize
ScriptBreak
Ellipse
CreatePolygonRgn
SetViewportOrgEx
GetBkColor
GetTextColor
CreateDCW
SetLayout
GetDCOrgEx
RectVisible
GetSystemPaletteEntries
SelectPalette
GetDIBits
DeleteObject
GetObjectType
GetObjectW
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectW
SelectObject
SetBkColor
SetTextColor
CreateSolidBrush
DeleteDC
CreateRectRgn
CombineRgn
FillRgn
CreateBitmap
BitBlt
CreatePatternBrush
GetStockObject
CreateDCA
GetDeviceCaps
ExtTextOutA
GetPixel
GetClipBox
CreateCompatibleBitmap
MoveToEx
SetDIBitsToDevice
GetCurrentObject
GetObjectA
GetDIBColorTable
SetDIBColorTable
StretchDIBits
SetBkMode
CreateFontIndirectA
SetDIBits
CreateDIBitmap
SetStretchBltMode
StretchBlt
GetViewportOrgEx
GetWindowOrgEx
SetPixel
GdiAlphaBlend
GdiTransparentBlt
GdiGradientFill
GetClipRgn
ExtSelectClipRgn
SelectClipRgn
GetLayout
CreateRoundRectRgn
SetWindowOrgEx
IntersectClipRect
SetTextAlign
GetTextAlign
ExcludeClipRect
ExtTextOutW
SetDCBrushColor
GetBrushOrgEx
SetBrushOrgEx
PlayEnhMetaFile
SaveDC
RestoreDC
GetTextExtentPoint32W
GetEnhMetaFileHeader
EqualRgn
SetRectRgn
OffsetRgn
CreatePen
LineTo

kernel32

InterlockedPushEntrySList
InterlockedPopEntrySList
QueryDepthSList
GetFileAttributesA
DeleteFileA
ExpandEnvironmentStringsW
GetFullPathNameW
lstrcmpW
Wow64RevertWow64FsRedirection
IsProcessorFeaturePresent
LoadLibraryExA
EncodePointer
DecodePointer
FlushInstructionCache
GetLocaleInfoA
IsDBCSLeadByte
IsWow64Process2
Wow64DisableWow64FsRedirection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
HeapFree
GetProcessHeap
CloseHandle
SetLastError
GetModuleHandleW
GetProcAddress
GetLastError
GetVersionExW
FormatMessageW
GetCurrentThreadId
HeapAlloc
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
OpenSemaphoreW
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
FindAtomW
VirtualProtect
VirtualAlloc
VirtualQuery
GetSystemInfo
TlsGetValue
TlsAlloc
TlsFree
TlsSetValue
CompareStringOrdinal
GetLocaleInfoW
GetNumberFormatW
GetUserDefaultLCID
CompareStringW
ReleaseSRWLockShared
AcquireSRWLockShared
RaiseException
CreateEventW
CompareStringEx
SetEvent
ResetEvent
CreateThread
SetThreadPriority
GetCurrentThread
FreeLibraryAndExitThread
GetThreadPriority
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
FreeLibrary
GetSystemDirectoryW
GetModuleHandleA
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
GetVersionExA
VirtualFree
LoadLibraryA
GetUserDefaultLangID
InitOnceBeginInitialize
InitOnceComplete
Sleep
GetTickCount
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
FindResourceA
LoadResource
LockResource
SizeofResource
MulDiv
GetACP
WideCharToMultiByte
CreateFileW
GetFileType
GlobalMemoryStatusEx
FindResourceW
InitOnceExecuteOnce
InitializeSRWLock
MultiByteToWideChar
GlobalAddAtomW
GetModuleHandleExA
WaitForMultipleObjects
ResolveDelayLoadedAPI
DelayLoadFailureHook
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetProcessWorkingSetSize
GetStringTypeExW
GetAtomNameW
AddAtomW
DeleteAtom
WriteFile
InitializeCriticalSectionAndSpinCount
GetFileSize
ReadFile
HeapCreate
HeapReAlloc
GetFileAttributesW
InitializeSListHead
InterlockedFlushSList

ole32

CoInitialize
CLSIDFromString
CoLockObjectExternal
OleDraw
OleUninitialize
CoUninitialize
CoInitializeEx
CoDisconnectObject
CreateStreamOnHGlobal
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
PropVariantCopy
PropVariantClear
RevokeDragDrop

user32

IsIconic
GetClientRect
SetWindowsHookExW
UnhookWindowsHookEx
TranslateMessage
DispatchMessageW
GetPropW
SendMessageW
CallNextHookEx
MonitorFromRect
SetTimer
KillTimer
LoadStringW
LoadImageW
GetSysColor
FillRect
DrawTextW
GetAsyncKeyState
CreateWindowExW
DefWindowProcW
LoadIconW
ReleaseDC
RegisterClassW
ClientToScreen
BeginPaint
EndPaint
InvalidateRect
TrackMouseEvent
SetCapture
ReleaseCapture
GetSystemMetrics
LoadCursorA
RegisterWindowMessageA
GetProcessDefaultLayout
SystemParametersInfoA
GetMonitorInfoA
EnumDisplayMonitors
GetSysColorBrush
IntersectRect
GetSystemMetricsForDpi
LogicalToPhysicalPointForPerMonitorDPI
SetThreadDpiAwarenessContext
MonitorFromPoint
GetClassInfoExW
RegisterClassExW
EnableWindow
GetParent
GetKeyState
GetClassLongA
UnregisterClassA
GetFocus
SendMessageA
DestroyWindow
PostQuitMessage
WaitMessage
IsWindowVisible
AdjustWindowRectEx
GetWindowLongA
GetWindowRect
SetWindowPos
SetRect
IsRectEmpty
IsChild
GetSystemMenu
GetWindowPlacement
EnableMenuItem
OffsetRect
SetWindowTextW
UnregisterClassW
MessageBeep
EqualRect
SetLayeredWindowAttributes
MapWindowPoints
MoveWindow
PtInRect
PostMessageA
InflateRect
GetWindowThreadProcessId
SendMessageTimeoutW
SendMessageTimeoutA
SetWindowTextA
AppendMenuW
EnumThreadWindows
EnumWindows
GetClassNameA
GetWindow
MonitorFromWindow
CallWindowProcW
PostMessageW
GetActiveWindow
WindowFromPoint
GetCursorPos
ScreenToClient
SetParent
NotifyWinEvent
SetFocus
GetClassNameW
DeferWindowPos
AnimateWindow
SetCursor
DefWindowProcA
GetWindowTextW
PeekMessageA
PeekMessageW
GetMessageW
MsgWaitForMultipleObjects
GetMessagePos
GetForegroundWindow
SystemParametersInfoW
GetKeyboardLayout
LoadImageA
UpdateWindow
GetDoubleClickTime
IsWindowEnabled
SetForegroundWindow
GetPropA
UnionRect
BeginDeferWindowPos
GetCapture
SetWindowsHookExA
RedrawWindow
EndDeferWindowPos
SetWindowRgn
CopyRect
UpdateLayeredWindow
IsMenu
GetClassInfoA
GetWindowDC
ValidateRect
LockWindowUpdate
TrackPopupMenuEx
SetPropW
RemovePropW
FrameRect
VkKeyScanExW
RegisterWindowMessageW
IsProcessDPIAware
DestroyIcon
GetTitleBarInfo
SetRectEmpty
GetWindowInfo
IsZoomed
InternalGetWindowText
DrawIconEx
DrawFrameControl
DrawTextExW
DrawEdge
GetIconInfo
CreateIconIndirect
GetClassLongW
GetMessageTime
DrawFocusRect
GetWindowTextLengthW
CreatePopupMenu
DestroyMenu
InvertRect
GetMonitorInfoW
IsWinEventHookInstalled
ChildWindowFromPointEx
GetKeyboardState
SetWindowLongW
SetMenu
GetDC
ord2707
IsTopLevelWindow
ord2706
ord2705
ord2704
ord2559
RegisterSystemThread
IsWindowInDestroy
SetWindowLongA
ShowWindow
GetWindowLongW
GetDesktopWindow
GetAncestor
IsWindow
CopyImage
LoadBitmapA
IsWindowUnicode
LoadCursorW

shell32

ShellExecuteW

gdiplus

GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipSetClipRect
GdipDrawImageRectRect
GdiplusShutdown
GdipFillRectangle
GdipCreateRegion
GdipGetClip
GdipIsClipEmpty
GdipSetClipRegion
GdipDeleteRegion
GdipDeletePen
GdipCreateMatrix
GdipDeleteMatrix
GdipSetCompositingMode
GdipGetCompositingMode
GdipSetCompositingQuality
GdipCreateBitmapFromFile
GdipSetInterpolationMode
GdipGetInterpolationMode
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipSetPixelOffsetMode
GdipGetPixelOffsetMode
GdipSetTextContrast
GdipGetTextContrast
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipGetWorldTransform
GdipTranslateRegionI
GdipSetWorldTransform
GdipGetDC
GdipReleaseDC
GdipResetWorldTransform
GdipCreateMatrix2
GdipSaveGraphics
GdipRestoreGraphics
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromStream
GdipSetImageAttributesColorKeys
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipImageRotateFlip
GdipCloneBitmapAreaI
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipBitmapGetPixel
GdipGetImageHeight
GdipGetCompositingQuality
GdipGetImageWidth

xmllite

CreateXmlReader
CreateXmlWriter

oleaut32

VarCmp
VarDecDiv
VarDecInt
VarDecMul
VarDecAdd
VariantChangeTypeEx
VarDecFromR8
OleCreateFontIndirect
VariantChangeType
VariantCopy
VariantInit
VariantClear
SetErrorInfo
SysAllocStringLen
SysStringLen
SafeArrayPutElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayGetElement
SafeArrayCopy
SafeArrayGetVartype
SysAllocString
VarDecSu
VarDecRound
VarI4FromStr
VarBstrFromDec
VarDecFromStr
VarUI4FromDec
VarDecFromI4
VarDecCmp
VarBstrFromI4
SafeArrayDestroy
SysFreeString
SafeArrayCreateVector

api-ms-win-core-path-l1-1-0

PathCchAppend
PathCchRemoveFileSpec

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 93KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bootdat
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 253KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23159f8aedeefa0e8ba7a7ce56b15d0e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

gdi32

kernel32

ole32

user32

shell32

gdiplus

xmllite

oleaut32

api-ms-win-core-path-l1-1-0

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.data Size: 93KB - Virtual size: 101KB

.idata Size: 15KB - Virtual size: 14KB

.didat Size: 512B - Virtual size: 232B

.bootdat Size: 4KB - Virtual size: 3KB

.rsrc Size: 253KB - Virtual size: 252KB

.reloc Size: 162KB - Virtual size: 161KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 93KB - Virtual size: 101KB

.idata
Size: 15KB - Virtual size: 14KB

.didat
Size: 512B - Virtual size: 232B

.bootdat
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 253KB - Virtual size: 252KB

.reloc
Size: 162KB - Virtual size: 161KB