catsrvut[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

catsrvut.dll
Size

397KB
MD5

ab02b296cafeb789c4c23f7164f51353
SHA1

3adb72b15666f14bc92ef76db22c1cb8c68f92ee
SHA256

ca2806dd8353a957c9284db2c7885cb9ff14cf6f8c65d1995f9998779a0b2990
SHA512

fd3e89423de0e3ca05218f22073cec033b17dcc0d672ebf67f93be4f388522d81a5f84be2f648af806b654871bf7cd6169a6bd4303bf5e2a7e7e35a76707f2f5
SSDEEP

6144:YTrouM4fId/H2jO0nLh0sdlVVI9bM8OlOeriQwkzjePIg7Kml1Voy1HqxWhDi6JL:KtlVVI9485UZWhl1Voy1HDNijUWI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
catsrvut.dll

Files

catsrvut.dll
.dll regsvr32 windows:10 windows x86 arch:x86

21ca59a27bc7671e9186174fc5014f85

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

catsrvut.pdb

Imports

msvcrt

_initterm
__dllonexit
_onexit
memcpy
__CxxFrameHandler3
_lock
_unlock
?terminate@@YAXXZ
__isascii
iswprint
_itow
towupper
wcsncmp
_except_handler4_common
_amsg_exit
_XcptFilter
_wcsnicmp
_ltow
_waccess
_vsnwprintf
_wcsicmp
_purecall
iswspace
wcsrchr
wcschr
wcscpy_s
realloc
memcmp
wcscat_s
malloc
free
_local_unwind4
memset

api-ms-win-core-synch-l1-1-0

ReleaseMutex
CreateEventW
LeaveCriticalSection
EnterCriticalSection
OpenEventW
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
OpenMutexW
InitializeCriticalSection
SetEvent

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
LockResource
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
FreeLibraryAndExitThread
FindResourceExW
LoadResource
GetModuleHandleExW
LoadStringW
SizeofResource

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoGetObjectContext
CLSIDFromString
CoCreateInstanceEx
StringFromIID
CoTaskMemAlloc
StringFromGUID2
CoImpersonateClient
CoCreateInstance
CoRevertToSelf
CoInitializeEx
CoGetCallContext
StringFromCLSID
IIDFromString
CoUninitialize
CoTaskMemRealloc
CoCreateGuid

api-ms-win-core-string-l2-1-0

CharNextW
CharPrevW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetErrorMode
UnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteTreeW
RegEnumValueW
RegCreateKeyExW
RegQueryValueExW
RegFlushKey

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
VirtualProtect
UnmapViewOfFile
CreateFileMappingW
VirtualAlloc
VirtualQuery
MapViewOfFile

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetSystemInfo

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapDestroy

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

CreateProcessAsUserW
CreateThread
OpenThreadToken
ExitProcess
SetThreadStackGuarantee
GetExitCodeProcess
CreateProcessW
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
SetThreadToken
TerminateProcess
GetCurrentThread

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-file-l1-1-0

GetLongPathNameW
FindFirstFileW
GetShortPathNameW
CreateFileW
CreateDirectoryW
FindClose
FindNextFileW
SetFileAttributesW
DeleteFileW

api-ms-win-service-management-l1-1-0

CreateServiceW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
DeleteService

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-security-base-l1-1-0

GetTokenInformation
AddAccessAllowedAce
DuplicateTokenEx
GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
AdjustTokenPrivileges
IsValidSid
IsValidSecurityDescriptor
AddAce
DestroyPrivateObjectSecurity
CreatePrivateObjectSecurityEx
GetSecurityDescriptorDacl
FreeSid
IsWellKnownSid
GetSidLengthRequired
GetSidSubAuthority
AllocateAndInitializeSid
GetSidSubAuthorityCount
GetSecurityDescriptorLength
CheckTokenMembership
AllocateLocallyUniqueId
EqualSid
CreateWellKnownSid
CopySid
SetSecurityDescriptorDacl

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
LocalReAlloc

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W
ChangeServiceConfigW
QueryServiceConfigW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l2-1-0

CopyFileExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernel32

LocalSize
OpenFile
lstrcpyW
lstrcmpiW
lstrcpynW
GetComputerNameW

advapi32

SaferIdentifyLevel
SaferCloseLevel
SaferCreateLevel
SaferSetLevelInformation
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegConnectRegistryW
LsaLookupNames
BuildTrusteeWithSidW
BuildTrusteeWithNameW
BuildSecurityDescriptorW
RegDeleteKeyW
RegOverridePredefKey
RegCreateKeyW
SaferGetLevelInformation

mfcsubs

??4CString@@QAEABV0@ABV0@@Z
??0CString@@QAE@XZ
??YCString@@QAEABV0@ABV0@@Z
??0CString@@QAE@PBD@Z
??1CString@@QAE@XZ
??H@YG?AVCString@@ABV0@PBG@Z
??0CString@@QAE@PBG@Z
??4CString@@QAEABV0@PBG@Z
??H@YG?AVCString@@PBGABV0@@Z

ntdll

RtlGetVersion
WinSqmSetDWORD
RtlFreeHeap
RtlImageNtHeader
RtlAllocateHeap

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-com-private-l1-1-0

UpdateDCOMSettings
CoGetModuleType

api-ms-win-core-shlwapi-legacy-l1-1-0

PathStripPathW

Exports

Exports

??0CComPlusComponent@@QAE@$$QAV0@@Z
??0CComPlusComponent@@QAE@ABV0@@Z
??0CComPlusInterface@@QAE@$$QAV0@@Z
??0CComPlusInterface@@QAE@ABV0@@Z
??0CComPlusMethod@@QAE@ABV0@@Z
??0CComPlusObject@@QAE@ABV0@@Z
??1CComPlusComponent@@UAE@XZ
??1CComPlusInterface@@UAE@XZ
??4CComPlusComponent@@QAEAAV0@$$QAV0@@Z
??4CComPlusComponent@@QAEAAV0@ABV0@@Z
??4CComPlusInterface@@QAEAAV0@$$QAV0@@Z
??4CComPlusInterface@@QAEAAV0@ABV0@@Z
??4CComPlusMethod@@QAEAAV0@ABV0@@Z
??4CComPlusObject@@QAEAAV0@ABV0@@Z
??4CComPlusTypelib@@QAEAAV0@ABV0@@Z
??_7CComPlusComponent@@6B@
??_7CComPlusInterface@@6B@
??_7CComPlusMethod@@6B@
??_7CComPlusObject@@6B@
?GetITypeLib@CComPlusTypelib@@QAEPAUITypeLib@@XZ
CGMIsAdministrator
COMPlusUninstallActionW
CreateComRegDBWriter
DestroyComRegDBWriter
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FindAssemblyModulesW
ManagedRequestW
QueryUserDllW
RegDBBackup
RegDBRestore
RunMTSToCom
StartMTSTOCOM
SysprepComplus
SysprepComplus2
WinlogonHandlePendingInfOperations

Sections

.text
Size: 353KB - Virtual size: 352KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

21ca59a27bc7671e9186174fc5014f85

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-synch-l1-2-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-profile-l1-1-0

kernel32

advapi32

mfcsubs

ntdll

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

Exports

Exports

Sections

.text Size: 353KB - Virtual size: 352KB

.data Size: 7KB - Virtual size: 16KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 276B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 23KB - Virtual size: 23KB

.text
Size: 353KB - Virtual size: 352KB

.data
Size: 7KB - Virtual size: 16KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 276B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 23KB - Virtual size: 23KB