NaturalLanguage6[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

NaturalLanguage6.dll
Size

797KB
MD5

8bed7c8fc9701efdfb0206666c061d40
SHA1

2d2c5bd8e06e034db615c8d904479822fb3e1555
SHA256

c4b51634aadd2c16c891166958ef974639e66fb7ef7964c22b32d8d9347706ed
SHA512

7c7d45c44a88699b073309969a1f8f376f4dda103889fc88f11b8b712069c31ea63402fbdd65b872df879fd12d1603a42362a3bd84ac8f1ee3725c2cbe7b3fa7
SSDEEP

12288:4w2NFn7GdT/vpPmAGG2uOlTkR9WbKXczFSBsKdcitmbocHbJ5o:4wwFQheAGJlTkR9WbNzF4sKciUbjHbQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NaturalLanguage6.dll

Files

NaturalLanguage6.dll
.dll regsvr32 windows:10 windows x86 arch:x86

f15678cfcf6064747a7e2e6b97ca4052

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

NaturalLanguage6.pdb

Imports

msvcrt

realloc
_vsnwprintf
fgetws
_wfopen
wcsstr
_callnewh
??0exception@@QAE@ABV0@@Z
wcsncmp
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
_XcptFilter
wcschr
_errno
??1exception@@UAE@XZ
fclose
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_resetstkoflw
qsort
??0exception@@QAE@XZ
_vsnprintf_s
memcpy_s
_initterm
??1type_info@@UAE@XZ
_lock
_unlock
__dllonexit
_amsg_exit
memmove_s
malloc
free
_wsplitpath_s
__CxxFrameHandler3
memmove
_wgetcwd
_onexit
?terminate@@YAXXZ
_except_handler4_common
_waccess
wcsrchr
ftell
fseek
fread
_itow_s
atoi
_itoa_s
_isctype
toupper
iswspace
iswctype
tolower
?name@type_info@@QBEPBDXZ
??8type_info@@QBEHABV0@@Z
wcsncpy_s
_wgetenv
_purecall
swscanf_s
_CIsqrt
_ftol2_sse
memcmp
memcpy
memset

api-ms-win-core-heap-l2-1-0

LocalFree

oleaut32

SysAllocStringByteLen
SysAllocStringLen
VariantChangeType
VariantInit
VariantClear
GetErrorInfo
SetErrorInfo
VariantCopy
SysAllocString
SysFreeString
SysStringLen
CreateErrorInfo
SysStringByteLen

api-ms-win-core-synch-l1-2-0

InitializeCriticalSectionAndSpinCount
InitOnceBeginInitialize
InitOnceComplete
SleepEx
OpenSemaphoreW
Sleep
LeaveCriticalSection
WaitForSingleObject
DeleteCriticalSection
WaitForSingleObjectEx
ReleaseMutex
EnterCriticalSection
InitOnceExecuteOnce
ReleaseSemaphore
CreateSemaphoreExW
CreateEventW
CreateMutexW
CreateMutexExW

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegCloseKey
RegEnumValueW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
GetModuleHandleExW
GetModuleFileNameA
LoadLibraryExW
GetProcAddress

api-ms-win-core-localization-l1-2-1

GetLocaleInfoA
GetSystemDefaultLCID
FormatMessageW

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-com-l1-1-1

IIDFromString
CoTaskMemAlloc
StringFromGUID2

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-file-l1-2-1

CreateFileW
ReadFile
GetFileInformationByHandle
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetFileSize
SetFilePointerEx

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrlenA

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetLocalTime
GetSystemTimeAsFileTime
GetTickCount

crypt32

CryptAcquireCertificatePrivateKey
CertCloseStore
CertFindCertificateInStore
CertOpenSystemStoreW
CertGetCertificateContextProperty

api-ms-win-security-cryptoapi-l1-1-0

CryptDecrypt
CryptGetUserKey
CryptReleaseContext

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
MapViewOfFile
UnmapViewOfFile

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 698KB - Virtual size: 697KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f15678cfcf6064747a7e2e6b97ca4052

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-l2-1-0

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-file-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

crypt32

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-memory-l1-1-2

Exports

Exports

Sections

.text Size: 698KB - Virtual size: 697KB

.data Size: 3KB - Virtual size: 17KB

.idata Size: 5KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 51KB - Virtual size: 51KB

.reloc Size: 38KB - Virtual size: 37KB

.text
Size: 698KB - Virtual size: 697KB

.data
Size: 3KB - Virtual size: 17KB

.idata
Size: 5KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 51KB - Virtual size: 51KB

.reloc
Size: 38KB - Virtual size: 37KB