libexslt[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

libexslt.dll
Size

60KB
MD5

670d0afb3b3660088e9dc325258a3a03
SHA1

5c5a6bf30995453a4e1a621628e517416cef14a6
SHA256

1988e01c28f02d05877b545a731f1099e977b578d581d4df37e7bdbb1bcaabc3
SHA512

7b51cf2f90a8f5072eb5569de4eee2862dd162ecb46aaac99d980a27483356bb43d11caa738c290f14fd6ac436dc381ba330008fec685069e276da4db0b4a5f7
SSDEEP

1536:njN2IYWLZzO5p+tV+9xBHQqMf2TYwCAhk3/AH7A:njRlO5p+j+9xomtkYH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
libexslt.dll

Files

libexslt.dll
.dll windows:5 windows x86 arch:x86

071cbaf4c406a0bbae4891566a82b5a1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libxslt

xsltRegisterExtModule
xsltRegisterExtModuleFull
xsltRegisterExtModuleTopLevel
xsltNextImport
xsltGetExtInfo
xsltRegisterExtFunction
xsltPrintErrorContext
xsltInitElemPreComp
xsltParseTemplateContent
xsltStyleGetExtData
xsltGetExtData
xsltParseStylesheetCallerParam
xsltLocalVariablePush
xsltApplyOneTemplate
xsltLocalVariablePop
xsltFreeStackElemList
xsltExtensionInstructionResultFinalize
xsltInitGlobals
xsltGenericDebugContext
xsltGenericDebug
xsltRegisterExtModuleFunction
xsltDocumentElem
xsltDocumentComp
xsltRegisterExtModuleElement
xsltGenericErrorContext
xsltGenericError
xsltFunctionNodeSet
xsltXPathGetTransformContext
xsltCreateRVT
xsltTransformError
xsltRegisterLocalRVT
xsltExtensionInstructionResultRegister

libxml2

xmlDebugDumpNode
xmlNewDocNode
xmlHashLookup2
xmlHashAddEntry2
xmlStrEqual
xmlSearchNs
xmlSplitQName2
xmlGetProp
xmlGetNsList
xmlFreeNode
xmlGetNsProp
xmlXPathNewValueTree
xmlXPathCompiledEval
xmlHashScanFull
xmlXPathCastNodeToNumber
xmlXPathNodeSetAddUnique
xmlXPathNodeSetCreate
xmlXPathWrapNodeSet
xmlStrsub
xmlStrlen
xmlXPathPopNumber
xmlXPathWrapExternal
xmlHashAddEntry
xmlHashLookup
xmlXPathPopExternal
xmlXPathCmpNodes
xmlGetLineNo
xmlXPathDifference
xmlXPathIntersection
xmlXPathDistinctSorted
xmlXPathHasSameNodes
xmlXPathNodeLeadingSorted
xmlXPathNodeTrailingSorted
xmlUTF8Charcmp
xmlNewDocRawNode
xmlUTF8Size
xmlStrncasecmp
xmlURIEscapeStr
xmlXPathPopBoolean
xmlStrcmp
xmlCheckUTF8
xmlURIUnescapeString
xmlStrcat
xmlUTF8Strndup
xmlStrncat
xmlStrstr
xmlXPathEval
xmlNewNs
xmlNewChild
xmlXPathNodeSetAdd
xmlXPathNodeSetSort
xmlXPathFreeCompExpr
xmlHashFree
xmlHashCreate
xmlXPathRegisterNs
xmlXPathRegisterFuncNS
xmlXPathCastStringToNumber
xmlXPathIsInf
xmlXPathPopNodeSet
xmlXPathCastNodeToString
xmlXPathFreeNodeSet
xmlFreeNodeList
xmlXPathIsNaN
xmlXPathNewFloat
xmlXPathNewBoolean
xmlXPathNAN
xmlXPathCastNumberToString
xmlMalloc
xmlMallocAtomic
xmlUTF8Strsize
xmlStrdup
xmlXPathWrapString
xmlUTF8Strlen
valuePop
xmlXPathNewCString
xmlXPathFreeObject
xmlXPatherror
xmlXPathPopString
xmlNewDocText
xmlAddChild
xmlXPathNewNodeSet
xmlFree
valuePush
xmlXPathCompile

msvcr90

_except_handler4_common
_onexit
_lock
__dllonexit
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_CIexp
_CIatan2
_CIatan
_CIacos
_CIasin
_CItan
_CIcos
_CIsin
_CIlog
_CIpow
_CIsqrt
rand
__iob_func
floor
_time64
_localtime64
_gmtime64
memset
memcpy
_unlock

advapi32

CryptGetHashParam
CryptCreateHash
CryptReleaseContext
CryptDestroyHash
CryptAcquireContextA
CryptDestroyKey
CryptEncrypt
CryptDeriveKey
CryptDecrypt
CryptHashData

kernel32

TerminateProcess
InterlockedCompareExchange
Sleep
GetCurrentProcess
GetLastError
FormatMessageA
LocalFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange

Exports

Exports

exsltCommonRegister
exsltCryptoRegister
exsltDateRegister
exsltDateXpathCtxtRegister
exsltDynRegister
exsltFuncRegister
exsltLibexsltVersion
exsltLibraryVersion
exsltLibxmlVersion
exsltLibxsltVersion
exsltMathRegister
exsltMathXpathCtxtRegister
exsltRegisterAll
exsltSaxonRegister
exsltSetsRegister
exsltSetsXpathCtxtRegister
exsltStrRegister
exsltStrXpathCtxtRegister

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

071cbaf4c406a0bbae4891566a82b5a1

Headers

File Characteristics

Imports

libxslt

libxml2

msvcr90

advapi32

kernel32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 880B

.rsrc Size: 1024B - Virtual size: 692B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 880B

.rsrc
Size: 1024B - Virtual size: 692B

.reloc
Size: 3KB - Virtual size: 3KB