DTSPipeline[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

DTSPipeline.dll
Size

678KB
MD5

ae21f49eb35fdd34ca80351035c48383
SHA1

423fd1bbb03b8589a0c4304ffc7c75b9f4b7bf94
SHA256

41a9de7449ec313a85ec5ff1c2eaf4bba27c2b99930a0ca4239b6a2de379def7
SHA512

fe05399d8c3736f8caa6428be30b6087acfb44da045bd19db81c5cf062b6920fd8d43b2d302d984656892ba5159a737349c824c4d164f0d3c9016f3a6b17c94a
SSDEEP

12288:M4lovaZyf2/LV+l/MV/uchbkMG/m8xojYDNE6MO4zDUT06qA4wTM6:MF8nkBMVmZ7mhBZ0T06qA4wTM6

Score

1^/10

Malware Config

Signatures

Files

DTSPipeline.dll
.dll regsvr32 windows:6 windows x86 arch:x86

0023fffa4c56b38aa4486b3b6ffb9828

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f0:b0:5f:de:3f:10:c2:2a:61:96:f7:16:9e:39:87:6f:64:1c:76:ed
Signer

Actual PE Digest

f0:b0:5f:de:3f:10:c2:2a:61:96:f7:16:9e:39:87:6f:64:1c:76:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DTSPipeline.pdb

Imports

msvcr80

_crt_debugger_hook
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_vsnwprintf_s
__doserrno
_beginthreadex
_vscwprintf
_time64
_wcsdup
memmove
wcscspn
wcsspn
_snwprintf_s
_ui64tow
wcscpy_s
memcpy_s
vswprintf_s
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??3@YAXPAX@Z
??0bad_cast@std@@QAE@PBD@Z
_vsnwprintf
memmove_s
__RTDynamicCast
_invalid_parameter_noinfo
wcsncpy_s
calloc
_ultow_s
_purecall
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
??_U@YAPAXI@Z
fwrite
fclose
??_V@YAXPAX@Z
_recalloc
free
swprintf_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
memset
__CxxFrameHandler3
_CxxThrowException
ldiv
memcpy
wcspbrk
wcsrchr
wcsncat_s

msvcp80

??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@F@Z
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@QAEXXZ
?_Register@facet@locale@std@@QAEXXZ
??1locale@std@@QAE@XZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?widen@?$ctype@G@std@@QBEGD@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??_D?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
??0?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
?str@?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEHPBGH@Z
?id@?$ctype@G@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

atl80

ord25
ord32
ord23
ord61
ord58
ord31
ord30
ord64
ord15
ord18
ord22

kernel32

IsDBCSLeadByteEx
GetCPInfo
GetFullPathNameW
WaitForSingleObjectEx
LoadLibraryW
GetStringTypeW
FreeLibrary
FindClose
FindFirstFileW
SetLastError
SetEnvironmentVariableW
GetProcessHeap
HeapSize
HeapReAlloc
GetVersionExA
GetLocaleInfoA
GetACP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetExitCodeThread
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
SetEvent
CreateEventW
CreateMemoryResourceNotification
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
LocalAlloc
GetFileSize
SetFilePointerEx
GetCurrentProcess
DuplicateHandle
VirtualAlloc
Sleep
ReadFile
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetEnvironmentVariableW
CloseHandle
SetEndOfFile
SetFilePointer
CreateFileW
QueryMemoryResourceNotification
GlobalMemoryStatusEx
HeapFree
HeapAlloc
InterlockedCompareExchange
HeapSetInformation
HeapCreate
VirtualQuery
InterlockedExchange
HeapDestroy
GetSystemInfo
DeleteFileW
GetTempFileNameW
VirtualFree
GetTickCount
IsValidLocale
WriteFile
IsValidCodePage
lstrcmpW
MultiByteToWideChar
lstrlenA
GetProcAddress
GetModuleHandleA
GetModuleHandleW
GetUserDefaultUILanguage
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
CompareStringW
GetSystemTimeAsFileTime
LoadLibraryA
LeaveCriticalSection
RaiseException
EnterCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentThreadId
QueryPerformanceFrequency
InitializeCriticalSection
lstrlenW
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
GetLastError
FormatMessageW
LocalFree
GetThreadLocale
SetThreadLocale

user32

LoadStringW
UnregisterClassA

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW

oleaut32

VarBstrCat
SafeArrayRedim
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayCreate
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
SafeArrayPutElement
SysAllocStringLen
VarBstrCmp
SysStringByteLen
SysAllocString
VariantClear
VariantChangeType
LoadTypeLi
LoadRegTypeLi
SysStringLen
VariantInit
SafeArrayDestroy
SafeArrayCreateVector
SysFreeString
SysAllocStringByteLen

ole32

CoUninitialize
CoInitializeEx
StringFromIID
CoTaskMemAlloc
CoCreateGuid
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoTaskMemFree
StringFromCLSID
StringFromGUID2

dtsmsg100

?SetIDTSComponentMetaData@CErrorSupport@@QAEXPAUIDTSComponentMetaData100@@@Z
?GetErrorDescription@CErrorHelper@@SAJJPAPAG@Z
?GetAllErrorInfo@CErrorHelper@@SAJJPAPAG0PAJ@Z
?FormatMessageWithVaList@CErrorHelper@@SAJPAKPBXKPAPAGPAD@Z
??1CErrorSupport@@QAE@XZ
?PostErrorWithArg@CErrorSupport@@QAAJJPA_NZZ
?PostError@CErrorSupport@@QAEJJPAGPA_N@Z

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
SetDebugHook
TruncateStrA

Sections

.text
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0023fffa4c56b38aa4486b3b6ffb9828

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

f0:b0:5f:de:3f:10:c2:2a:61:96:f7:16:9e:39:87:6f:64:1c:76:edSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr80

msvcp80

atl80

kernel32

user32

advapi32

oleaut32

ole32

dtsmsg100

Exports

Exports

Sections

.text Size: 448KB - Virtual size: 448KB

.data Size: 22KB - Virtual size: 23KB

.rsrc Size: 160KB - Virtual size: 160KB

.reloc Size: 40KB - Virtual size: 40KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

f0:b0:5f:de:3f:10:c2:2a:61:96:f7:16:9e:39:87:6f:64:1c:76:ed
Signer

.text
Size: 448KB - Virtual size: 448KB

.data
Size: 22KB - Virtual size: 23KB

.rsrc
Size: 160KB - Virtual size: 160KB

.reloc
Size: 40KB - Virtual size: 40KB