AddEmail[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AddEmail.dll
Size

322KB
MD5

7b430318f44a6ea975ab07190166d6a7
SHA1

1fedf78f4f39839591c6d0700bba2d44ccd07d12
SHA256

353da5aa024355ca2217e22b7a8437edc473562736c83de4bcc5df8f215a5b3a
SHA512

84060529c3e203da0bccf24f7c37e1110139e5225bc68cd67487d545bf30fa77a2fcef3e075478af41b616792bf013962807b32876e7dd6f6d66b129de4fa618
SSDEEP

6144:VaGPZl5JKqnJeH92lFte0KKpqKO9DKXC0Psoaydk9rDB5iz2/y:VaszKkJLe0KVJ9mXhUYz4y

Score

1^/10

Malware Config

Signatures

Files

AddEmail.dll
.dll regsvr32 windows:4 windows x86 arch:x86

63197f41a2c9d55c419ade0fd0890d93

Code Sign

04:00:00:00:00:01:1e:44:a5:e2:4e
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 13:00

Not After

27/01/2017, 12:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:20:19:c1:90:66
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/03/2009, 11:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:26:05:78:b6:85
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

06/01/2010, 20:35

Not After

07/01/2011, 20:35

Subject

CN=Traysoft Inc.,O=Traysoft Inc.,L=Hamilton,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c11696e666f4074726179736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Not Before

21/12/2009, 09:32

Not After

22/12/2020, 09:32

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:1e:44:a5:ec:be
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 10:00

Not After

27/01/2017, 11:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6e:10:6c:e8:d4:96:48:fb:56:46:1a:10:d5:d7:12:c4:2f:cc:48:71
Signer

Actual PE Digest

6e:10:6c:e8:d4:96:48:fb:56:46:1a:10:d5:d7:12:c4:2f:cc:48:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Traysoft\DevTools\AddEmail\Src\ReleaseU\AddEmail.pdb

Imports

wsock32

ioctlsocket
gethostbyname
shutdown
closesocket
WSAStartup
getservbyname
htons
socket
connect
recv
send
select
WSAGetLastError
WSASetLastError

kernel32

lstrcmpiW
lstrcatW
GetModuleFileNameW
lstrcpynW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrlenA
LockResource
FindResourceExW
CloseHandle
ReadFile
GetFileSize
CreateFileW
FormatMessageW
WideCharToMultiByte
GetTickCount
GetTimeZoneInformation
GetLocalTime
GetTimeFormatW
GetDateFormatW
GetComputerNameW
lstrcmpiA
Sleep
SetEvent
WaitForSingleObject
MulDiv
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
SetLastError
GetLastError
LCMapStringW
LCMapStringA
VirtualQuery
GetSystemInfo
VirtualProtect
TerminateProcess
GetModuleHandleA
TlsAlloc
TlsFree
IsBadWritePtr
HeapCreate
SetUnhandledExceptionFilter
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineA
IsBadReadPtr
CreateThread
ResumeThread
TlsGetValue
TlsSetValue
ExitThread
GetFileAttributesW
RtlUnwind
ExitProcess
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcpyW
lstrlenW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetOEMCP
GetCPInfo
GetStringTypeA
GetStringTypeW
SetHandleCount
UnhandledExceptionFilter
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
IsBadCodePtr
GetEnvironmentStringsW
WriteFile
CreateEventW
SetEnvironmentVariableA
CompareStringW
CompareStringA
HeapFree
FlushFileBuffers
SetStdHandle
SetFilePointer
HeapAlloc
HeapDestroy
GetVersionExA
RaiseException
LoadLibraryA
GetProcAddress
LocalAlloc

user32

CharNextW
LoadIconW
GetClassInfoExW
LoadCursorW
RegisterClassExW
CreateWindowExW
GetParent
SetFocus
ShowWindow
GetFocus
IsChild
BeginPaint
GetClientRect
EndPaint
InvalidateRect
IsWindow
GetKeyState
CallWindowProcW
GetWindowLongW
SetWindowLongW
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
GetDC
ReleaseDC
UnionRect
PtInRect
DefWindowProcW
DestroyWindow
DrawIcon
wsprintfW
LoadStringW
UnregisterClassA

gdi32

CreateDCW
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
GetClipRgn
CreateRectRgn
SelectClipRgn
Rectangle
SetTextAlign
TextOutW
CreateRectRgnIndirect

advapi32

RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

ole32

OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateOleAdviseHolder
OleRegGetMiscStatus
OleRegGetUserType
OleRegEnumVerbs
CoInitialize
CoUninitialize
ProgIDFromCLSID
StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance

oleaut32

SysStringLen
SetErrorInfo
CreateErrorInfo
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantInit
VariantClear
SysStringByteLen
VariantChangeType
SysAllocStringByteLen
OleCreatePropertyFrame
VARIANT_UserFree
VARIANT_UserUnmarshal
VARIANT_UserMarshal
VARIANT_UserSize
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SysAllocString
LoadTypeLi
SysFreeString
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysAllocStringLen
LoadRegTypeLi

shlwapi

PathFindExtensionW

rpcrt4

NdrOleAllocate
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrStubForwardingFunction
NdrStubCall2

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 196KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 160B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63197f41a2c9d55c419ade0fd0890d93

Code Sign

04:00:00:00:00:01:1e:44:a5:e2:4eCertificate

Key Usages

04:00:00:00:00:01:20:19:c1:90:66Certificate

Key Usages

01:00:00:00:00:01:26:05:78:b6:85Certificate

Extended Key Usages

Key Usages

01:00:00:00:00:01:25:b0:b4:cc:01Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:1e:44:a5:ec:beCertificate

Key Usages

6e:10:6c:e8:d4:96:48:fb:56:46:1a:10:d5:d7:12:c4:2f:cc:48:71Signer

Headers

File Characteristics

PDB Paths

Imports

wsock32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

rpcrt4

Exports

Exports

Sections

.text Size: 196KB - Virtual size: 194KB

.orpc Size: 4KB - Virtual size: 160B

.rdata Size: 44KB - Virtual size: 41KB

.data Size: 16KB - Virtual size: 22KB

.rsrc Size: 36KB - Virtual size: 33KB

.reloc Size: 16KB - Virtual size: 15KB

04:00:00:00:00:01:1e:44:a5:e2:4e
Certificate

04:00:00:00:00:01:20:19:c1:90:66
Certificate

01:00:00:00:00:01:26:05:78:b6:85
Certificate

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

04:00:00:00:00:01:1e:44:a5:ec:be
Certificate

6e:10:6c:e8:d4:96:48:fb:56:46:1a:10:d5:d7:12:c4:2f:cc:48:71
Signer

.text
Size: 196KB - Virtual size: 194KB

.orpc
Size: 4KB - Virtual size: 160B

.rdata
Size: 44KB - Virtual size: 41KB

.data
Size: 16KB - Virtual size: 22KB

.rsrc
Size: 36KB - Virtual size: 33KB

.reloc
Size: 16KB - Virtual size: 15KB