CPFilters[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

CPFilters.dll
Size

693KB
MD5

5b99119f715f5935dd9b8906824ca7a1
SHA1

aa25407f15cc6d9b6b67d7a915893017a83753fd
SHA256

f3004cba2edabdd7c66e29381743efd9301bc612d1141eaed327213737476843
SHA512

e454f80cde818018897f522b931cd15f66d149803ee32d118926d1c065a666d293ed528cfe6d17ee11fad114b3e8ea7f65c6f3e3528ebee6f323de9788ec34a1
SSDEEP

12288:jJaZlqnugiCWm8lGJFQNMg7panf5YaNos5PHxzHDzDLwxxDYjjsuPrl4RnkTfMk:F++ugiCpFJFQNMg7panf5Yeo4PRzjzek

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CPFilters.dll

Files

CPFilters.dll
.dll regsvr32 windows:10 windows x86 arch:x86

fdedaa861316f3040b2e837241138554

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CPFilters.pdb

Imports

msvcrt

wcschr
realloc
_wtol
wcspbrk
memcpy
memset
_wcsicmp
wcsncmp
isupper
wcsstr
swscanf
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
tolower
_endthread
_beginthreadex
swscanf_s
iswxdigit
swprintf_s
srand
memmove
wcsncpy_s
strnlen
strcat_s
wcstoul
wcscat_s
strncpy_s
wcsnlen
_time32
time
rand
??0exception@@QAE@XZ
_callnewh
malloc
free
_vsnwprintf
memmove_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_purecall
_wcsnicmp
_ftol2
_ftol2_sse
_lock
_unlock
__dllonexit
memcpy_s
_onexit
??1type_info@@UAE@XZ
_except_handler4_common
sscanf_s
memcmp

advapi32

RegDeleteKeyW
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptGenRandom
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
TraceMessage

crypt32

CertFreeCertificateChain
CertGetNameStringW
CertGetCertificateChain
CertVerifyCertificateChainPolicy

kernel32

GlobalFree
GlobalAlloc
DebugBreak
InterlockedDecrement
LocalAlloc
GetVersion
FreeEnvironmentStringsA
GetEnvironmentStringsW
GetProcessHeap
HeapAlloc
FreeEnvironmentStringsW
DeviceIoControl
GetSystemTime
GetGeoInfoA
GetModuleHandleA
RaiseException
WriteFile
ReadFile
lstrlenW
SetFilePointer
GlobalLock
GetFileSize
GlobalUnlock
CompareStringW
lstrlenA
InterlockedIncrement
GlobalMemoryStatusEx
ExpandEnvironmentStringsW
WaitForMultipleObjects
WaitForSingleObject
LoadLibraryW
GetProcAddress
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DecodeSystemPointer
Sleep
OutputDebugStringW
EncodeSystemPointer
DeleteCriticalSection
GetCurrentProcessId
VirtualProtect
GetCurrentProcess
ResumeThread
GetLastError
RaiseFailFastException
GetCurrentThread
CloseHandle
GetModuleHandleW
DisableThreadLibraryCalls
GetVersionExW
GetModuleFileNameA
MultiByteToWideChar
lstrcmpW
CreateEventW
ResetEvent
GetCurrentThreadId
SetEvent
CreateThread
GetTickCount
SetThreadPriority
lstrcmpiW
CompareFileTime
GetSystemTimeAsFileTime
WideCharToMultiByte
GetLocalTime
SystemTimeToFileTime
GetSystemFirmwareTable
LocalFree
GetTickCount64
GetModuleHandleExW
GetModuleFileNameW
CreateFileW
QueryPerformanceCounter
OutputDebugStringA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
HeapFree
GetDiskFreeSpaceW

ole32

CoCreateGuid
PropVariantCopy
CoCreateInstance
StringFromGUID2
CoFileTimeNow
PropVariantClear
CLSIDFromString
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoFreeUnusedLibraries
CoInitializeEx

oleaut32

SysAllocStringLen
SysAllocString
VariantCopy
SysStringLen
SysStringByteLen
VariantInit
VariantClear
SafeArrayCreate
VariantChangeType
SafeArrayAccessData
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
SafeArrayUnaccessData

slc

SLGetWindowsInformationDWORD

winmm

timeGetTime

wintrust

CryptCATCatalogInfoFromContext
WinVerifyTrust
WTHelperProvDataFromStateData

mfplat

MFCreateCollection

ws2_32

htonl

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
UpdatePlayready

Sections

.text
Size: 657KB - Virtual size: 656KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fdedaa861316f3040b2e837241138554

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

crypt32

kernel32

ole32

oleaut32

slc

winmm

wintrust

mfplat

ws2_32

Exports

Exports

Sections

.text Size: 657KB - Virtual size: 656KB

.data Size: 3KB - Virtual size: 6KB

.idata Size: 5KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 25KB - Virtual size: 25KB

.text
Size: 657KB - Virtual size: 656KB

.data
Size: 3KB - Virtual size: 6KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 25KB - Virtual size: 25KB