dpFPCoInstallerEntry
Static task
static1
Behavioral task
behavioral1
Sample
dpCoInst.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
dpCoInst.dll
Resource
win10v2004-20240426-en
General
-
Target
dpCoInst.dll
-
Size
140KB
-
MD5
fd7b9495eac95bb35cedc86d6060d7ff
-
SHA1
92abd4c69d506ad810099808c548ecf6be44ed5c
-
SHA256
fe4272ba86c0d5cc30c42e813e96d189d2e45044639dcb2ee69c535ea0d76c06
-
SHA512
6b9d9641e7389dec47c061bb842631887aae38837aea1da765314be2d923d06fad8fa81e5b364bd8a1b1258889e9a3e38ee938b98ba30263b98b68970d5ff84c
-
SSDEEP
3072:GaqbaFIWIjJ4T9amh7pybydG08ZVco5xPkzc0c5rarMcytw:Ga4NjJZmhgbyg0Exe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dpCoInst.dll
Files
-
dpCoInst.dll.dll windows:4 windows x86 arch:x86
5a44abad5c1a374be6ab660da6425a08
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcmpA
lstrlenW
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
SetLastError
TlsFree
TlsAlloc
TlsSetValue
InterlockedIncrement
GetProcessHeap
HeapAlloc
HeapFree
LocalFree
GlobalAlloc
GlobalLock
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
GlobalUnlock
IsValidCodePage
IsValidLocale
Sleep
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
ReadFile
SetEndOfFile
SetFilePointer
SetConsoleCtrlHandler
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
CreateFileA
FlushFileBuffers
SetStdHandle
UnhandledExceptionFilter
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
VirtualAlloc
SetUnhandledExceptionFilter
FatalAppExitA
HeapSize
HeapReAlloc
WriteFile
VirtualFree
HeapCreate
GetVersionExA
lstrlenA
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableA
InterlockedDecrement
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
GetLocaleInfoA
HeapDestroy
GetModuleHandleA
GetEnvironmentStringsW
GetEnvironmentStrings
RaiseException
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TerminateProcess
ExitProcess
CloseHandle
GetCurrentThread
GetVersion
GetCommandLineA
RtlUnwind
WideCharToMultiByte
GetLastError
TlsGetValue
setupapi
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassInstallParamsA
SetupDiSetClassInstallParamsA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
comctl32
ord17
CreatePropertySheetPageA
user32
GetParent
RegisterClassExA
LoadCursorA
GetClassInfoExA
RegisterWindowMessageA
PostMessageA
GetWindowLongA
SetWindowLongA
wsprintfA
CreateWindowExA
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
CreateAcceleratorTableA
GetDesktopWindow
RedrawWindow
DestroyWindow
IsWindow
GetClassNameA
SetWindowPos
GetFocus
IsChild
SetFocus
GetDC
ReleaseDC
BeginPaint
GetClientRect
FillRect
EndPaint
CallWindowProcA
GetDlgItem
SendMessageA
GetSysColor
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetWindow
DefWindowProcA
gdi32
CreateCompatibleDC
DeleteDC
GetStockObject
CreateCompatibleBitmap
CreateSolidBrush
SelectObject
DeleteObject
GetDeviceCaps
GetObjectA
BitBlt
olepro32
ord253
ole32
CoUninitialize
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc
OleLockRunning
CoInitialize
oleaut32
SysStringLen
SysAllocStringLen
VariantClear
SysAllocString
SysFreeString
VariantInit
GetErrorInfo
SetErrorInfo
VariantChangeType
CreateErrorInfo
LoadRegTypeLi
Exports
Exports
Sections
.text Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ