GPRSoP[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

GPRSoP.dll
Size

459KB
MD5

5c570e33003743ce87dd92915c3d4433
SHA1

16460865e656f52a6c07b739e142f5b98ad9946d
SHA256

418bc0720c8a004207ff3cbe3017e4e0ed7ccdda44e19895cec641a49b8ebb4a
SHA512

c86f09b38c9d9016d9b136d340892ebd78815d524bf8a0f094f726517c6806e6bbb934471cc1a3144189397d5efef727be958a682850fa01df8b5678bd515d9f
SSDEEP

3072:C5+fj0ZH/WT8hQa4/96UBMmA8xOh/kN5xdc9dJcfPwKytJ:C5G0ZHOYKa4FrBXNxOYdc9dJIPwLt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GPRSoP.dll

Files

GPRSoP.dll
.dll regsvr32 windows:10 windows x86 arch:x86

ed6bb02bf0ebde0dd6843ebe9e410ecd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

GPRSoP.pdb

Imports

msvcrt

??3@YAXPAX@Z
_ftol2_sse
realloc
_errno
_except_handler4_common
_onexit
__dllonexit
_unlock
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
memmove
memcpy
_CxxThrowException
_callnewh
wcschr
_wcsnicmp
wcsnlen
_wtol
wcsrchr
_wcsicmp
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
_purecall
wcstoul
_vsnwprintf
??_V@YAXPAX@Z
__CxxFrameHandler3
_lock
memset

oleaut32

SafeArrayDestroy
SysAllocString
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayUnaccessData
VariantInit
SafeArrayGetElement
VariantClear
SysStringLen
UnRegisterTypeLi
SysFreeString
LoadTypeLi
SafeArrayPutElement
SafeArrayCreate
VarUI4FromStr
RegisterTypeLi
SafeArrayGetLBound

api-ms-win-core-registry-l1-1-0

RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalReAlloc
LocalFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-1-0

SetFilePointer
WriteFile
FindFirstFileW
CreateFileW
GetFileAttributesExW
FindClose

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetComputerNameExW
GetLocalTime
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
CreateThread
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
OutputDebugStringW

logoncli

DsGetSiteNameW
DsGetDcNameW

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-com-l1-1-0

CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoTaskMemAlloc
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LeaveCriticalSection

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameW
SizeofResource
LoadResource
LockResource
LoadStringW
LoadLibraryExW
DisableThreadLibraryCalls
FindResourceExW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA
LoadLibraryW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW
LookupAccountSidW

api-ms-win-security-base-l1-1-0

GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid
FreeSid
AllocateAndInitializeSid
GetWindowsAccountDomainSid

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-core-localization-l1-2-0

FormatMessageW

netutils

NetApiBufferFree

dsrole

DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory

sspicli

GetUserNameExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

activeds

ord15
ord9

advapi32

RegConnectRegistryW
GetUserNameW

dsuiext

ord10

gdi32

DeleteDC
CreateFontIndirectW
GetTextMetricsW
GetDeviceCaps

kernel32

GlobalLock
lstrcmpiW
LoadLibraryExA
GlobalUnlock
ExpandEnvironmentStringsA

ntdll

RtlCopySid
RtlLengthSid
NtQueryInformationToken
RtlFreeUnicodeString
RtlInitUnicodeString
RtlConvertSidToUnicodeString

ntdsapi

DsCrackNamesW
DsUnBindW
DsListSitesW
DsFreeNameResultW
DsGetDomainControllerInfoW
DsBindW
DsFreeDomainControllerInfoW

ole32

ReleaseStgMedium
CoInitialize

secur32

GetComputerObjectNameW
TranslateNameW

user32

TranslateMessage
UnregisterClassA
DispatchMessageW
GetDlgItem
EnableWindow
PostMessageW
SendDlgItemMessageW
GetParent
SendMessageW
SetWindowLongW
SetDlgItemTextW
IsWindowEnabled
PeekMessageW
MsgWaitForMultipleObjectsEx
UpdateWindow
SetFocus
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
MessageBoxW
ShowWindow
GetClientRect
GetDC
GetSystemMetrics
ReleaseDC
SetCursor
LoadCursorW
LoadIconW
EndDialog
DialogBoxParamW
GetWindowLongW
SystemParametersInfoW
GetDlgItemTextW
RegisterClipboardFormatW

uxtheme

OpenThemeData
IsThemeActive
GetThemeTextExtent

Exports

Exports

ChangeRSOPQueryType
CopyRSOPQuery
CreateRSOPQuery
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FreeRSOPQuery
FreeRSOPQueryResults
RunRSOPQuery

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 311KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed6bb02bf0ebde0dd6843ebe9e410ecd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-registry-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-debug-l1-1-0

logoncli

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-localization-l1-2-0

netutils

dsrole

sspicli

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

activeds

advapi32

dsuiext

gdi32

kernel32

ntdll

ntdsapi

ole32

secur32

user32

uxtheme

Exports

Exports

Sections

.text Size: 131KB - Virtual size: 131KB

.data Size: 512B - Virtual size: 6KB

.idata Size: 7KB - Virtual size: 7KB

.rsrc Size: 311KB - Virtual size: 311KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 131KB - Virtual size: 131KB

.data
Size: 512B - Virtual size: 6KB

.idata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 311KB - Virtual size: 311KB

.reloc
Size: 7KB - Virtual size: 7KB