hgcpl[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

hgcpl.dll
Size

569KB
MD5

9d963bb9e6e75f4fb194075414953ef5
SHA1

ed50d041d7531d845421aa2dbc7eeaba599e02cd
SHA256

72ae0b36152cb45e7ad7ec2d2170898176dabb0d81627562c2496bf8e302ee6c
SHA512

bb02f6ef3baf47f710e70b6bdb1f7c02feb447b99cef70af961c7759523d63953381f63ff2eee138671231df6ceaf861570eb12582ffa38bdbb024d6b1f1ec99
SSDEEP

6144:DxDFqCHgrD5M7TRzaMrdIXiw3FABYyIJnGvWqC0TCt+DHxbpbXTwtt+RCVmzSBN:lIQgrZABVvj1CtKzD++RCY6i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hgcpl.dll

Files

hgcpl.dll
.dll windows:10 windows x86 arch:x86

bb518fb95d575bfe32dfbed3ac004851

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

hgcpl.pdb

Imports

msvcrt

_vsnprintf_s
wcschr
?terminate@@YAXXZ
__RTDynamicCast
_ftol2
memcmp
memcpy
realloc
_errno
_except_handler4_common
__CxxFrameHandler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
memmove_s
free
malloc
wcsncpy_s
wcsstr
memcpy_s
_vsnwprintf
memset

propsys

PSPropertyBag_ReadStr
PropVariantToUInt32
PSPropertyBag_ReadType

shell32

SHGetKnownFolderPath
SHParseDisplayName
ord25
SHBindToObject
ord891
SHChangeNotifySuspendResume
SHGetKnownFolderIDList
ord526
ord155
SHChangeNotify
SHGetIDListFromObject
SHCreateItemFromRelativeName
SHEnableServiceObject
ShellExecuteExW
ShellExecuteW
SHCreateItemFromParsingName
SHGetKnownFolderItem
ord645
ord102
ord4
ord18
ord2
ord644

shlwapi

StrDupW
StrChrW
ord628
StrCmpIW
StrRChrW
PathFindExtensionW
SHDeleteKeyW
ord156
ord24
ord514
ord174
ord204
SHDeleteValueW
ord260
ord172
ord158
ord199
PathFindFileNameW
PathRemoveExtensionW
ord176
ord278
SHStrDupW
ord256
ord219
ord154
ord437
ord16
ord538
ord618
SHEnumValueW

uxtheme

IsAppThemed

api-ms-win-core-libraryloader-l1-2-0

LoadResource
GetModuleHandleA
GetModuleHandleW
FindResourceExW
FreeLibrary
DisableThreadLibraryCalls
LoadStringW
GetProcAddress
GetModuleFileNameW
LoadLibraryExW
GetModuleFileNameA
SizeofResource
LoadLibraryExA
GetModuleHandleExW
LockResource

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
AcquireSRWLockShared
CreateSemaphoreExW
InitializeCriticalSectionEx
CreateEventExW
AcquireSRWLockExclusive
ReleaseSRWLockShared
InitializeCriticalSection
OpenSemaphoreW
ReleaseMutex
ReleaseSRWLockExclusive
DeleteCriticalSection
ResetEvent
CreateEventW
LeaveCriticalSection
WaitForSingleObject
CreateMutexExW
ReleaseSemaphore
SetEvent
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

oleaut32

VariantInit
VariantClear
VarUI4FromStr
SysAllocString
SysStringLen
SysFreeString

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-com-l1-1-0

CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
StringFromGUID2
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoRevokeClassObject
CoReleaseMarshalData
CoTaskMemFree
PropVariantClear
CoCreateGuid
CLSIDFromString
CoInitializeEx
CoUninitialize
CoGetMalloc
CoSetProxyBlanket
CoWaitForMultipleHandles
CoTaskMemAlloc
CoTaskMemRealloc
CoRegisterClassObject

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventActivityIdControl
EventWriteTransfer

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegGetValueW

api-ms-win-core-file-l1-1-0

GetTempFileNameW
WriteFile
DeleteFileW
CreateFileW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle
StartServiceW

api-ms-win-service-winsvc-l1-1-0

ControlService
QueryServiceStatus

sspicli

LogonUserExExW
GetUserNameExW

api-ms-win-service-management-l2-1-0

NotifyServiceStatusChangeW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-security-base-l1-1-0

IsValidSid
GetTokenInformation
EqualSid
GetAclInformation
GetAce
GetFileSecurityW
GetSecurityDescriptorDacl
GetSidSubAuthorityCount
CopySid
GetSidSubAuthority
GetLengthSid

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache
IsProcessorFeaturePresent
GetProcessMitigationPolicy

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-security-lsapolicy-l1-1-0

LsaLookupSids
LsaOpenPolicy
LsaClose
LsaLookupNames2
LsaFreeMemory

api-ms-win-core-sidebyside-l1-1-0

ActivateActCtx
ReleaseActCtx
DeactivateActCtx
CreateActCtxW

kernel32

GetComputerNameW
RegisterWaitForSingleObject
UnregisterWaitEx
MoveFileW
lstrcmpiW
MulDiv

ntdll

WinSqmIncrementDWORD
WinSqmSetDWORD
WinSqmAddToStream
NtOpenThreadToken
NtClose
NtQueryInformationToken
NtOpenProcessToken
EtwLogTraceEvent
RtlMapGenericMask
EtwEventWriteTransfer
RtlInitUnicodeString

ole32

CoAllowSetForegroundWindow
CreateBindCtx
CoGetObject

duser

CreateAction
DeleteHandle

gdi32

GetObjectW
GetDeviceCaps
CreateFontIndirectW
CreateSolidBrush
SetBkColor
GetTextExtentPoint32W
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
GetStockObject
Rectangle
BitBlt
DeleteDC
CreateDIBSection
DeleteObject
SetTextColor

user32

SetCursor
GetWindowRect
PostMessageW
DestroyIcon
UnregisterClassA
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
SetTimer
KillTimer
SetPropW
GetPropW
GetSystemMetrics
SendDlgItemMessageW
ReleaseDC
GetDC
MessageBoxW
EnableWindow
DefWindowProcW
SetDlgItemTextW
GetWindowLongW
DestroyWindow
SetWindowLongW
GetParent
GetDlgItem
SendMessageW
GetSysColor
SetWindowPos
BeginPaint
EndPaint
InvalidateRect
GetDlgItemTextW
SetFocus
BringWindowToTop
SetProcessDPIAware
ShowWindow
GetFocus
LoadImageW
LoadCursorW
RemovePropW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList
InterlockedPushEntrySList

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 398KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb518fb95d575bfe32dfbed3ac004851

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

propsys

shell32

shlwapi

uxtheme

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

sspicli

api-ms-win-service-management-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

kernel32

ntdll

ole32

duser

gdi32

user32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

Exports

Exports

Sections

.text Size: 398KB - Virtual size: 398KB

.data Size: 9KB - Virtual size: 11KB

.idata Size: 11KB - Virtual size: 11KB

.didat Size: 1024B - Virtual size: 640B

.rsrc Size: 121KB - Virtual size: 121KB

.reloc Size: 26KB - Virtual size: 25KB

.text
Size: 398KB - Virtual size: 398KB

.data
Size: 9KB - Virtual size: 11KB

.idata
Size: 11KB - Virtual size: 11KB

.didat
Size: 1024B - Virtual size: 640B

.rsrc
Size: 121KB - Virtual size: 121KB

.reloc
Size: 26KB - Virtual size: 25KB