dot3gpui[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

dot3gpui.dll
Size

259KB
MD5

ec5d8d6f83c31fe4385a263d3b933912
SHA1

5e828205cd30970f3f262ae4f031c6d0f28665c1
SHA256

85efc836120eb81fdf8bc6e1720d91d1538217c21e68279ae853eb43da6d8978
SHA512

284fc7562e35fec5e91a8f5a7f7ce41d8ae7975e4a4cbeff587b42f539767cfacac1b6433f791fcdc8dc4b29d00b23cfd986812cca8ce0b59af6f573581a094c
SSDEEP

6144:xdaH7fDggEYE6cGXSm+zmQaOR0mlE59/kvKpiIU4uePRq:x8bfDggEY+USm+zmQaOR0mlE59/kvzeP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dot3gpui.dll

Files

dot3gpui.dll
.dll regsvr32 windows:6 windows x86 arch:x86

08c645fd84a1c0b36e142049176365da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dot3gpui.pdb

Imports

mfc42u

ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4848
ord5261
ord4942
ord4970
ord4736
ord4899
ord5154
ord5156
ord5155
ord768
ord6024
ord4704
ord4352
ord4371
ord491
ord1145
ord2820
ord5436
ord6379
ord2836
ord2099
ord6279
ord6278
ord5446
ord6390
ord498
ord771
ord1008
ord656
ord609
ord6330
ord2634
ord3090
ord1771
ord5947
ord567
ord3569
ord3397
ord5157
ord5286
ord4390
ord1768
ord6051
ord2567
ord3605
ord2281
ord2293
ord2362
ord2294
ord3087
ord6195
ord925
ord6920
ord6865
ord5977
ord859
ord3871
ord3577
ord4392
ord2570
ord4213
ord2015
ord2403
ord616
ord3714
ord793
ord2357
ord4282
ord3133
ord600
ord1571
ord1250
ord1248
ord1563
ord1194
ord1240
ord342
ord1179
ord1570
ord1568
ord1173
ord1115
ord269
ord826
ord6370
ord4347
ord5283
ord3793
ord4829
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord4621
ord4419
ord489
ord2859
ord6451
ord4253
ord1899
ord1128
ord2717
ord3948
ord815
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3396
ord3825
ord3826
ord3820
ord3074
ord4075
ord4616
ord4418
ord3733
ord561
ord1197
ord1196
ord501
ord998
ord773
ord5617
ord2810
ord922
ord942
ord2644
ord1662
ord823
ord2910
ord5568
ord861
ord535
ord858
ord1143
ord1634
ord3566
ord268
ord2406
ord2385
ord3621
ord3658
ord1560
ord538
ord540
ord6466
ord4155
ord940
ord800
ord1165
ord4831
ord825

msvcrt

memcpy
__CxxFrameHandler3
_purecall
_wcsicmp
_wcsnicmp
wcsncmp
free
wcscat_s
swprintf_s
malloc
wcscpy_s
_wcsdup
time
memset
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
??1type_info@@UAE@XZ
_amsg_exit
_initterm
_XcptFilter
_wtoi
__RTDynamicCast
memcpy_s
realloc

atl

ord43
ord44
ord15
ord57
ord21
ord16
ord18
ord32
ord31
ord30

advapi32

RegisterTraceGuidsW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExW
RegCloseKey
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage

gdi32

SelectObject
GetTextExtentPoint32W

kernel32

DeleteCriticalSection
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
ExpandEnvironmentStringsW
GetComputerNameW
lstrlenW
GetLastError
GlobalAlloc
GlobalFree
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
lstrcmpiW
FormatMessageW
LoadLibraryA
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
FlushInstructionCache
GetCurrentProcess
HeapFree
GetProcessHeap
HeapAlloc
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
GetSystemWindowsDirectoryW
RaiseException
lstrcmpW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ExpandEnvironmentStringsA
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
InterlockedExchange
InterlockedCompareExchange
Sleep

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
StringFromCLSID
CoCreateGuid
CoUninitialize
CoInitialize

oleaut32

VariantInit
VariantClear
SysFreeString
SysStringLen
VariantChangeType
SysAllocString

user32

DialogBoxParamW
LoadIconW
LoadBitmapW
RegisterClipboardFormatW
LoadStringW
GetParent
SendMessageW
GetDesktopWindow
MessageBeep
SetWindowLongW
GetActiveWindow
GetDlgCtrlID
GetSystemMetrics
GetWindowRect
ReleaseDC
GetDC
CheckDlgButton
CheckRadioButton
GetDlgItemInt
GetDlgItemTextW
IsDlgButtonChecked
SetDlgItemInt
GetDlgItem
SetCursor
LoadCursorW
EndDialog
EnableWindow

ws2_32

WSAStartup
WSACleanup

secur32

TranslateNameW

l2gpstore

L2GPPolicyDataRead
L2GPPolicyStoreOpen
L2GPPolicyDataDelete
L2GPPolicyDataWrite
L2GPPolicyFreeMem
L2GPPolicyStoreClose

onex

OneXCreateDefaultProfile
OneXFreeMemory

eappcfg

EapHostPeerConfigBlob2Xml
EapHostPeerConfigXml2Blob
EapHostPeerGetMethodProperties
EapHostPeerGetMethods
EapHostPeerInvokeConfigUI
EapHostPeerFreeErrorMemory
EapHostPeerFreeMemory

ntdll

EtwTraceMessage

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08c645fd84a1c0b36e142049176365da

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc42u

msvcrt

atl

advapi32

gdi32

kernel32

ole32

oleaut32

user32

ws2_32

secur32

l2gpstore

onex

eappcfg

ntdll

Exports

Exports

Sections

.text Size: 144KB - Virtual size: 144KB

.data Size: 4KB - Virtual size: 13KB

.rsrc Size: 98KB - Virtual size: 97KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 144KB - Virtual size: 144KB

.data
Size: 4KB - Virtual size: 13KB

.rsrc
Size: 98KB - Virtual size: 97KB

.reloc
Size: 11KB - Virtual size: 11KB