cic[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cic.dll
Size

158KB
MD5

4c83756d138072d604312c918b4ee8ae
SHA1

6a28bfa4829e1d3ef7b83989c0ab3f8aa7130119
SHA256

a19fe1abb3c2c82bc76901d7e41aa9a9bf203791a348e0871c73dad1aad509c2
SHA512

fe29599fcc746f8ab1ec280e584779235431d9f889306da36236e3c9125d84eadfe47195a1c759a743942ab2de0d60d1eabac4d7d99a1972ae5c67daac3456f8
SSDEEP

3072:ia1zY+yTdTCA2I2fN1aY0Fxmwuf3cwZI30jqnvJzhspNxslxH5Mmu8AZpzg6:iUYXTdTCA2I2fN1p0Fx9uf3HNqvfspNn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cic.dll

Files

cic.dll
.dll regsvr32 windows:10 windows x86 arch:x86

b2bd5ad8a2b11d4c8a30ea916f462c54

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cic.pdb

Imports

mmcbase

?GetSnapinName@BookKeeping@@SGPBGH@Z
?InvalidInterface@BookKeeping@@SGXHPBG0@Z
?InterfaceMethodException@BookKeeping@@SGXHPBG0KPAU_EXCEPTION_POINTERS@@@Z
?MMCNullInterface@BookKeeping@@SGXHPBG0@Z
?AddSnapinInterface@BookKeeping@@SG_NPAUIUnknown@@PBGAAH@Z
?InterfaceMethodActivationContextException@BookKeeping@@SGXHPBG0KPAU_EXCEPTION_POINTERS@@@Z
MMCUpdateRegistry
?ReleaseSnapinInterface@BookKeeping@@SGJPAUIUnknown@@H@Z
?FromLastError@SC@mmcerror@@QAEAAV12@XZ
?ToHr@SC@mmcerror@@QBEJXZ
??0SC@mmcerror@@QAE@ABV01@@Z
??4SC@mmcerror@@QAEAAV01@ABV01@@Z
?SetFunctionName@SC@mmcerror@@QAEXPBG@Z
??BSC@mmcerror@@QBE_NXZ
??1SC@mmcerror@@QAE@XZ
?s_CallDepth@SC@mmcerror@@0IA

msvcrt

memcmp
_callnewh
__CxxFrameHandler3
??_V@YAXPAX@Z
??3@YAXPAX@Z
_purecall
_wcsnicmp
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
memset
wcsrchr
wcschr
_wcslwr
_wtol
_wcsupr
_wcsdup
realloc
malloc
wcscpy_s
_wcsicmp
free

ntdll

EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage

user32

BeginPaint
GetFocus
IsChild
DestroyWindow
SendMessageW
TranslateMessage
DispatchMessageW
SetFocus
SetWindowPos
CharNextW
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
DestroyAcceleratorTable
IsWindow
UnionRect
PtInRect
InvalidateRect
GetClientRect
GetParent
RegisterClassExW
GetClassInfoExW
wsprintfW
ReleaseDC
DefWindowProcW
SetWindowLongW
GetWindowLongW
CreateWindowExW
CallWindowProcW
WindowFromDC
PostMessageW
GetSysColor
GetDlgItem
GetClassNameW
EndPaint
ShowWindow
GetDC
LoadCursorW

gdi32

DeleteDC
GetDeviceCaps
SetViewportOrgEx
RestoreDC
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
CreateDCW
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
CreateMetaFileW
CreateRectRgnIndirect

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

kernel32

GetVersionExW
GetSystemDirectoryW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
HeapDestroy
GetModuleHandleW
GetProcAddress
GetLastError
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetCurrentProcess
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
GetLongPathNameW
ReleaseSRWLockExclusive
Sleep
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
DecodePointer
EncodePointer
LoadLibraryExA
VirtualFree
GetModuleHandleA
GetProcessHeap
HeapAlloc
HeapFree
HeapCreate
LocalFree
RaiseException
SetLastError
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
lstrcpyW
LeaveCriticalSection
AcquireSRWLockExclusive
EnterCriticalSection

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b2bd5ad8a2b11d4c8a30ea916f462c54

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mmcbase

msvcrt

ntdll

user32

gdi32

api-ms-win-core-registry-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 112KB

.data Size: 10KB - Virtual size: 11KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 100B

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 112KB - Virtual size: 112KB

.data
Size: 10KB - Virtual size: 11KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 100B

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 12KB - Virtual size: 11KB