FirewallControlPanel[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

FirewallControlPanel.dll
Size

302KB
MD5

cdca2e3a582670d34f54378fafd03fea
SHA1

f24f506a1d313cfbe65811252cea3a93134721d2
SHA256

cc721e0e449d9a1f134988fbfd24d21168206fa6f009c2c0dfa163db2deb88ea
SHA512

d33c906421a0b9d9ef4fb5cb73f75ca413cbedafae44d6be133d8ccbd50d54e943e11ae8a6537ec4b46d2be082ef91e609b5d52250ff3f4bb2144a92aaf44f25
SSDEEP

6144:bb19VRqWuFeNKob3YQLPvl/MyQl0bBreL7OeeXPsB77j6XHHBJImOKks90/i:99y2VMyJbUeXUB3jaHHB/usl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FirewallControlPanel.dll

Files

FirewallControlPanel.dll
.dll regsvr32 windows:10 windows x86 arch:x86

9ee24feaa016d8bd4658a7b4f7cd161f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

FirewallControlPanel.pdb

Imports

msvcrt

qsort
_onexit
_wtol
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
wcsspn
??1exception@@UAE@XZ
memcpy_s
??1type_info@@UAE@XZ
_wcsicmp
towupper
wcsrchr
memmove_s
_XcptFilter
_amsg_exit
_CxxThrowException
_ftol2_sse
_except_handler4_common
_initterm
?terminate@@YAXXZ
_lock
memcmp
_unlock
malloc
__dllonexit
_purecall
floor
_vsnwprintf
__CxxFrameHandler3
memset

ntdll

EtwLogTraceEvent
WinSqmIncrementDWORD
RtlQueryElevationFlags
WinSqmAddToStream
WinSqmIsOptedIn
EtwEventWrite
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
EtwEventWriteTransfer

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
LoadStringW
DisableThreadLibraryCalls
LoadLibraryExA
LoadLibraryExW
GetProcAddress
GetModuleFileNameA
FreeLibrary

api-ms-win-core-synch-l1-1-0

CreateEventW
ReleaseSRWLockShared
InitializeCriticalSectionEx
AcquireSRWLockShared
ResetEvent
OpenMutexW
OpenSemaphoreW
ReleaseMutex
WaitForSingleObject
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LeaveCriticalSection
ReleaseSemaphore
CreateMutexExW
CreateSemaphoreExW
WaitForSingleObjectEx
SetEvent
InitializeCriticalSection
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysStringLen
LoadRegTypeLi
SysFreeString
LoadTypeLi
VariantClear
SysAllocString
VariantInit

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
StringFromGUID2
CoSetProxyBlanket
CoCreateInstance
CoCreateGuid
CoTaskMemFree
CoUninitialize
CoInitializeEx

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
EventActivityIdControl

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
Sleep

api-ms-win-security-base-l1-1-0

CheckTokenMembership
AllocateAndInitializeSid
FreeSid

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache
IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpCW
StrCmpICW
QISearch

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW
CommandLineToArgvW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW
lstrlenW

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

shcore

IUnknown_SetSite
ord188
IUnknown_GetSite
IUnknown_Set
IUnknown_QueryService
ord145
ord140
ord190

shlwapi

ord24
PathFindExtensionW
ord538
PathFindFileNameW
AssocQueryStringW
ord172
ord204

user32

SetWindowLongW
PostMessageW
DefWindowProcW
LockSetForegroundWindow
GetActiveWindow
DialogBoxParamW
GetClassInfoExW
RegisterClassExW
GetPropW
GetWindowLongW
UnregisterClassW
SetPropW
LoadCursorW
SetCursor
SetDlgItemTextW
GetDlgItem
ShowWindow
CreateWindowExW
DestroyWindow
CallWindowProcW
SendDlgItemMessageW
UnregisterClassA
IsWindowVisible
RemovePropW
MessageBeep
GetKeyState
ClientToScreen
SetCapture
SetTimer
EnableWindow
GetDlgItemInt
CheckDlgButton
GetWindowTextLengthW
SetDlgItemInt
GetSystemMetrics
KillTimer
ReleaseCapture
LoadImageW
SetClassLongW
GetWindow
SetWindowTextW
CreateIconIndirect
NotifyWinEvent
PtInRect
GetMessagePos
DrawFocusRect
GetFocus
InflateRect
GetParent
MessageBoxW
LoadIconW
MapWindowPoints
SystemParametersInfoW
InvalidateRect
MoveWindow
GetWindowTextW
ReleaseDC
GetDoubleClickTime
SetWindowPos
DrawTextW
GetDlgCtrlID
EndPaint
BeginPaint
SetActiveWindow
FillRect
SetRect
DrawIconEx
SetForegroundWindow
GetClientRect
GetSysColor
IsDlgButtonChecked
GetDC
SetFocus
GetWindowRect
DestroyIcon
EndDialog
GetMonitorInfoW
MonitorFromRect
SendMessageW

kernel32

QueueUserWorkItem
UnregisterWaitEx

gdi32

CreateSolidBrush
CreateFontIndirectW
GetObjectW
CreateBitmapIndirect
DeleteObject
SetBkMode
SetTextColor
GetStockObject
SelectObject
CreateCompatibleDC
DeleteDC
CreateCompatibleBitmap
SetDIBits

uxtheme

GetThemeFont
DrawThemeBackground
SetWindowTheme
GetThemeColor
OpenThemeData
IsThemeActive
CloseThemeData
GetThemeBackgroundContentRect

oleacc

ObjectFromLresult
CreateStdAccessibleProxyW
LresultFromObject

firewallapi

FwGetVersionField
FwIsGroupPolicyEnforced
FWOpenPolicyStore
FWGetConfig
FWClosePolicyStore
IcfChangeNotificationDestroy
IcfChangeNotificationCreate
FwActivate
FWDeleteFirewallRule
FwFree
FWAddFirewallRule
FWSetFirewallRule
FWFreeFirewallRules
FWEnumFirewallRules
FwAnalyzeFirewallPolicyOnProfile
FWFreeProducts
FWEnumProducts
FWGetGlobalConfig

msimg32

GradientFill

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ShowNotificationDialogW
ShowWarningDialogW

Sections

.text
Size: 262KB - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ee24feaa016d8bd4658a7b4f7cd161f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

shcore

shlwapi

user32

kernel32

gdi32

uxtheme

oleacc

firewallapi

msimg32

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

Exports

Exports

Sections

.text Size: 262KB - Virtual size: 261KB

.data Size: 2KB - Virtual size: 4KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 1024B - Virtual size: 964B

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 19KB - Virtual size: 19KB

.text
Size: 262KB - Virtual size: 261KB

.data
Size: 2KB - Virtual size: 4KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 1024B - Virtual size: 964B

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 19KB - Virtual size: 19KB