StructuredQuery[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

StructuredQuery.dll
Size

518KB
MD5

5c2375a84715d26063727457272181ea
SHA1

7c6e586c73dc12745d20cc22fad4f866ce2e1421
SHA256

47457b619b0923c5454da9ce372af8d49b4c09cca64abcb98baeb07eddef85b2
SHA512

081127b9ec299b01d466bf1568401bd90d802f5a383d3dbcf7c240ad9c302db8111cf167bcb3cd3afa4b4dcf6b35b4f2870dadc7dc88e20e3765aa42a388961c
SSDEEP

12288:U70DyRFCbJ6GhQVO3S9uC+1PKiWq8P9/gLPRH8oO4Lscyy:U70DyRkThqO3S9uC+1KiWqM9/gL5H8o3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
StructuredQuery.dll

Files

StructuredQuery.dll
.dll regsvr32 windows:10 windows x86 arch:x86

a3c634a88f1ac09312afd93ab507789b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

StructuredQuery.pdb

Imports

msvcrt

?terminate@@YAXXZ
_CxxThrowException
iswspace
bsearch
??1type_info@@UAE@XZ
?what@exception@@UBEPBDXZ
_wcsicmp
_wtoi
__CxxFrameHandler3
_onexit
_vsnprintf_s
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
memcpy_s
_except_handler4_common
_callnewh
malloc
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
wcsncmp
free
memmove
swscanf_s
wcschr
swscanf
_vsnwprintf
_purecall
_wcsnicmp
memcmp
memcpy
memset

oleaut32

VarDateFromUdate
VarUdateFromDate
BSTR_UserMarshal
VariantClear
VariantInit
VariantCopy
SysAllocString
VarBstrFromDate
VarNumFromParseNum
BSTR_UserUnmarshal
LPSAFEARRAY_UserUnmarshal
SysFreeString
SysStringLen
SysAllocStringLen
LPSAFEARRAY_UserFree
VarI4FromStr
LPSAFEARRAY_UserSize
VarParseNumFromStr
LPSAFEARRAY_UserMarshal
BSTR_UserSize
BSTR_UserFree

rpcrt4

CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrCStdStubBuffer2_Release
NdrStubForwardingFunction
NdrStubCall2
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrClientCall2
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_Connect
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow

api-ms-win-shcore-unicodeansi-l1-1-0

SHUnicodeToAnsi

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpW

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetSystemDefaultLangID
GetUserDefaultLangID
GetSystemDefaultLCID
GetCalendarInfoEx
IsValidLocaleName
GetLocaleInfoW
LCMapStringW
GetUserDefaultLCID
GetUserDefaultLocaleName
LocaleNameToLCID
GetLocaleInfoEx
GetSystemPreferredUILanguages
FindNLSStringEx
ResolveLocaleName

api-ms-win-core-string-l1-1-0

GetStringTypeExW
CompareStringW
CompareStringEx
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
CompareStringOrdinal

api-ms-win-core-shlwapi-obsolete-l1-2-0

QISearch
StrStrIW
StrCmpNW
StrStrW
StrTrimW
StrCmpIW
StrToIntExW
StrChrW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-errorhandling-l1-1-1

SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-synch-l1-2-0

ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreExW
InitOnceBeginInitialize
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
Sleep
InitOnceComplete
InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeSRWLock
EnterCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitOnceExecuteOnce
ReleaseMutex

api-ms-win-core-file-l1-2-1

CreateFileW
CompareFileTime
WriteFile
SetFilePointer
GetFileTime
CreateDirectoryW
GetFileAttributesExW

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc

api-ms-win-core-localization-obsolete-l1-3-0

GetSystemDefaultUILanguage
GetUserDefaultUILanguage

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventWrite
EventSetInformation
EventRegister

api-ms-win-core-calendar-l1-1-0

ConvertCalDateTimeToSystemTime
GetCalendarSupportedDateRange
GetCalendarDateFormatEx
ConvertSystemTimeToCalDateTime
AdjustCalendarDate
UpdateCalendarDayOfWeek
IsCalendarLeapYear

api-ms-win-core-sysinfo-l1-2-1

VerSetConditionMask
GetVersionExW
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetLocalTime

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegGetValueW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
TlsFree
OpenProcessToken
TlsGetValue
TlsAlloc
TlsSetValue

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-datetime-l1-1-1

GetTimeFormatW
GetDateFormatW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameA
FreeLibrary
LoadResource
FindResourceExW
LoadStringW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
SearchPathW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-com-private-l1-1-0

CoRevokeInitializeSpy
CoRegisterInitializeSpy

shcore

ord170
ord123
ord130
ord141
ord200

api-ms-win-core-localization-l2-1-0

EnumTimeFormatsEx
EnumCalendarInfoExEx
EnumDateFormatsExEx

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-memory-l1-1-2

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 478KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3c634a88f1ac09312afd93ab507789b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

rpcrt4

api-ms-win-shcore-unicodeansi-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-localization-obsolete-l1-3-0

api-ms-win-core-localization-l1-2-2

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-calendar-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-com-private-l1-1-0

shcore

api-ms-win-core-localization-l2-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 478KB - Virtual size: 478KB

.data Size: 1KB - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 224B

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 478KB - Virtual size: 478KB

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 224B

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 27KB - Virtual size: 27KB