fontext[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

fontext.dll
Size

889KB
MD5

e54143c712a7074002f7a28d1eaf606d
SHA1

d2e91c9492ab0cc7649e22f9ab7c60e861c919da
SHA256

033bd4b112379e8252286b701db2a3038419c40655e90ebd022287aa32dd8d6e
SHA512

25e25e380fbd735ebd37794ffd0644fba9eb1ce8b4fbb2096ffc2bd302a52b944074ff4b5d5b24edd13add4d816c2cd479d3889d89337df103eec929e37b1b2e
SSDEEP

12288:kEDCPw+3nH9oecXhytFrUS/sa9j/wHXuvYdSnEGzuMnEP0Afdoq:dDCPw+3H9ovOF4Stjgu4/GzuMnEPze

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fontext.dll

Files

fontext.dll
.dll windows:10 windows x86 arch:x86

33339b463fc1810bac747bc90e6770ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

fontext.pdb

Imports

msvcrt

__CxxFrameHandler3
memcpy
_vsnwprintf
memcmp
_ftol2_sse
memmove
??1type_info@@UAE@XZ
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
bsearch_s
_wcsnset_s
wcsstr
_wtoi
wcstok_s
_wcsicmp
iswxdigit
wcschr
swprintf_s
memcpy_s
_CxxThrowException
memmove_s
_stricmp
_strcmpi
_vsnprintf
_vsnprintf_s
memset

propsys

VariantCompare
VariantToPropVariant
PropVariantToVariant
PSGetPropertyFromPropertyStorage
PSPropertyBag_ReadType
PSPropertyBag_ReadInt
InitPropVariantFromStringVector
InitPropVariantFromFileTime
PSCreateMemoryPropertyStore
VariantGetStringElem
VariantGetElementCount
PSFormatForDisplay
PSPropertyBag_ReadStr

shell32

ord25
ord155
ord680
ord16
SHGetIconOverlayIndexW
ord18
ord702
SHCreateShellItemArrayFromIDLists
SHParseDisplayName
ord19
ord152
ShellExecuteExW
ord256
ord701
SHChangeNotify
ord727
SHGetKnownFolderPath
SHBindToObject
SHCreateDataObject
SHGetFolderPathW
ord763
SHGetPathFromIDListW
ord17
AssocCreateForClasses
SHBindToParent
SHGetSpecialFolderLocation
SHCreateDefaultContextMenu

shlwapi

PathRemoveExtensionA
PathRemoveFileSpecA
PathFindFileNameA
ord204
ord156
ord618
ord24
ord12
ord639
ord174
ord215
ord16
StrDupW
StrStrW
PathRenameExtensionW
AssocCreate
ord158
ord538
ord172
ord176
ord256
PathFileExistsW
PathCompactPathExW
StrChrW
PathStripPathW
ord619
ord514
ord268
ord199
StrRetToBufW
PathFindExtensionW
PathRemoveFileSpecW
PathRemoveExtensionW
PathCombineW
PathIsPrefixW
SHCreateStreamOnFileW
ord219
PathAppendW
PathAddBackslashW
PathStripToRootW
PathIsUNCW
SHStrDupW
PathFindFileNameW
ord197

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FindResourceExW
DisableThreadLibraryCalls
LockResource
GetModuleHandleW
LoadResource
LoadLibraryExW
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleA
LoadStringW
SizeofResource
GetProcAddress

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
ReleaseSRWLockShared
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreExW
ReleaseSRWLockExclusive
OpenSemaphoreW
AcquireSRWLockExclusive
CreateMutexExW
ReleaseMutex
EnterCriticalSection
WaitForSingleObjectEx
InitializeCriticalSectionEx
LeaveCriticalSection
AcquireSRWLockShared

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

IsDBCSLeadByte
GetLocaleInfoEx
GetLocaleInfoW
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-1-0

FindNextFileW
CompareFileTime
CreateFileW
ReadFile
SetFilePointer
GetDiskFreeSpaceExW
FindClose
FindFirstFileW
GetDriveTypeW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
CreateFileA
GetFileSize
SetEndOfFile

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-security-base-l1-1-0

MapGenericMask
GetFileSecurityW
CreateWellKnownSid
AccessCheck
DuplicateToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-string-l1-1-0

CompareStringEx
MultiByteToWideChar
CompareStringOrdinal
CompareStringW
WideCharToMultiByte

api-ms-win-core-com-l1-1-0

CoGetMalloc
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoInitializeEx
PropVariantClear
CoTaskMemFree
CreateStreamOnHGlobal
CoTaskMemAlloc
CoSetProxyBlanket
CoUninitialize

mpr

WNetGetConnectionW

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
Sleep
InitOnceComplete
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalAlloc
LocalFree
GlobalFree

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

oleaut32

VariantInit
SysAllocString
VariantClear

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW
LoadLibraryA

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetSystemTime

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-localization-l2-1-0

GetNumberFormatEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW
SetEntriesInAclW

gdi32

MoveToEx
LineTo
AddFontResourceW
RemoveFontResourceW
DeleteObject
AddFontResourceExW
GetFontResourceInfoW
GetTextExtentPointI
ExtTextOutW
GetTextExtentExPointI
GetTextExtentExPointW
GetGlyphIndicesW
CreateDIBSection
SetBkMode
GetTextCharsetInfo
GetLayout
GetTextMetricsW
EnumFontFamiliesExW
GetDeviceCaps
CreateSolidBrush
RemoveFontResourceExW
CreateCompatibleDC
DeleteDC
GetTextExtentPoint32W
SelectObject
SetTextAlign
SetTextColor
SetBkColor
CreateFontIndirectW

kernel32

CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
CreateFileMappingA
_lclose
LZOpenFileW
LZClose
_lopen
lstrcmpW
LZRead
LZSeek
MulDiv
GlobalSize
GlobalUnlock
lstrcmpiA
lstrlenW
GlobalLock

ntdll

EtwLogTraceEvent
WinSqmAddToStream
EtwEventWriteTransfer

ole32

ReleaseStgMedium
CoGetObject
CreateBindCtx

user32

CreateDialogParamW
DrawTextW
DefWindowProcW
InvalidateRect
ScrollWindowEx
SetRect
SetScrollInfo
GetClientRect
EndPaint
BeginPaint
SetWindowLongW
GetWindowLongW
FillRect
CreateWindowExW
RegisterClassW
GetParent
GetFocus
GetSysColorBrush
PeekMessageW
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
SetWindowPos
UnregisterClassW
DestroyWindow
MessageBoxW
ReleaseDC
GetDC
GetDesktopWindow
PostMessageW
GetActiveWindow
RegisterClipboardFormatW
InsertMenuItemW
LoadCursorW
SetWindowTextW
SetCursor
SetMenuItemInfoW
GetMenuItemInfoW
ShowWindow
SendMessageW
LoadImageW
DrawIconEx
DestroyIcon
DrawTextExW
GetSystemMetrics
GetWindowRect
MoveWindow
SetPropW
GetPropW
SetTimer
KillTimer
GetDlgItem
RemovePropW

uxtheme

BeginBufferedPaint
BufferedPaintInit
BufferedPaintUnInit
EndBufferedPaint

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DownloadAndInstallOptionalFontsAsync
InstallFontFile

Sections

.text
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 660KB - Virtual size: 659KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

33339b463fc1810bac747bc90e6770ea

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

propsys

shell32

shlwapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

mpr

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-sddl-l1-1-0

oleaut32

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-security-provider-l1-1-0

gdi32

kernel32

ntdll

ole32

user32

uxtheme

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 203KB - Virtual size: 202KB

.data Size: 1024B - Virtual size: 4KB

.idata Size: 11KB - Virtual size: 11KB

.didat Size: 512B - Virtual size: 508B

.rsrc Size: 660KB - Virtual size: 659KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 203KB - Virtual size: 202KB

.data
Size: 1024B - Virtual size: 4KB

.idata
Size: 11KB - Virtual size: 11KB

.didat
Size: 512B - Virtual size: 508B

.rsrc
Size: 660KB - Virtual size: 659KB

.reloc
Size: 12KB - Virtual size: 11KB