StructuredQuery[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

StructuredQuery.dll
Size

355KB
MD5

6a1e8deb746912df47cf651e138401d7
SHA1

db0a20eaefb276d312cf2e8f6a2e25d38eac17af
SHA256

f0deebab4b1827a502b05f5c18e0a7480c3c8eddab306575ac40fd7048827fc4
SHA512

929591c347d0e07cf318eedad5d886e57b55feec1ccad8702b12e8b3d1eb3a983101f8d6858b0b3ba7a68c052d1fc169c6532d008a273a802bf4c7144a5fa22e
SSDEEP

6144:lD7h5W90TxzH2BXUl0uOq/wLq1vp6XipM0Ne0XjF3BZlGEH01jy47/G40IvyTQrd:x7TecxLKUrwLq1v0XipM0E0XjF3zlGi+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
StructuredQuery.dll

Files

StructuredQuery.dll
.dll regsvr32 windows:6 windows x86 arch:x86

33c48631ac4120bef5a03ec4cb76ed32

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

StructuredQuery.pdb

Imports

msvcrt

memset
memmove
wcsncmp
_wcsnicmp
_wcsicmp
bsearch
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
_amsg_exit
_initterm
_XcptFilter
_wtoi
free
_callnewh
malloc
swscanf_s
iswalpha
wcschr
swscanf
memcpy
_vsnwprintf
iswspace

kernel32

CreateFileMappingW
MapViewOfFile
LoadLibraryExW
LoadResource
FindResourceExW
VerSetConditionMask
VerifyVersionInfoW
IsValidLocaleName
GetCalendarSupportedDateRange
GetCalendarDateFormatEx
EnumTimeFormatsEx
EnumDateFormatsExEx
GetLastError
InterlockedIncrement
InterlockedDecrement
CompareStringOrdinal
GetUserDefaultLocaleName
HeapAlloc
HeapReAlloc
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
GetUserDefaultUILanguage
GetSystemDefaultLangID
GetUserDefaultLangID
IsValidLocale
GetSystemDefaultLCID
GetUserDefaultLCID
lstrcmpW
CompareFileTime
HeapFree
GetProcessHeap
LCIDToLocaleName
GetLocalTime
lstrlenW
lstrlenA
CreateDirectoryW
CloseHandle
GetVersionExW
CreateFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
CompareStringW
GetTimeFormatW
GetDateFormatW
LCMapStringW
FindNLSStringEx
CompareStringEx
QueryPerformanceCounter
GetCurrentThreadId
SetFilePointer
ExpandEnvironmentStringsW
WriteFile
WideCharToMultiByte
GetTimeZoneInformation
GetSystemTime
QueryPerformanceFrequency
InitializeCriticalSection
GetStringTypeExW
DelayLoadFailureHook
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
GetLocaleInfoW
FileTimeToSystemTime
InterlockedExchange
Sleep
GetTickCount
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
UnmapViewOfFile
GetSystemDefaultUILanguage
SearchPathW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsAlloc
GetFileTime
TlsFree
EnumCalendarInfoExEx
SetLastError
GetCalendarInfoEx
ConvertSystemTimeToCalDateTime
MultiByteToWideChar
UpdateCalendarDayOfWeek
GetSystemPreferredUILanguages
ResolveLocaleName
TlsGetValue
TlsSetValue
GetModuleHandleExW
AdjustCalendarDate
LocaleNameToLCID
GetLocaleInfoEx
GetStringTypeW
IsCalendarLeapYear
ConvertCalDateTimeToSystemTime

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
EventWrite
RegQueryInfoKeyW

ole32

StringFromGUID2
CLSIDFromString
OleSaveToStream
CoCreateInstance
CoTaskMemFree
PropVariantClear
PropVariantCopy
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoGetMalloc
CoGetApartmentType
CoRegisterInitializeSpy
CoRevokeInitializeSpy

oleaut32

BSTR_UserMarshal
BSTR_UserSize
VariantClear
VarNumFromParseNum
VarParseNumFromStr
VarI4FromStr
SysStringLen
SysFreeString
SysAllocStringLen
VariantCopy
VariantInit
SysAllocString
VarUdateFromDate
VarBstrFromDate
VarDateFromUdate
BSTR_UserFree
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
BSTR_UserUnmarshal

secur32

GetUserNameExW

shlwapi

ord212
ord219
SHCreateStreamOnFileW
ord632
StrStrW
SHStrDupW
ord199
ord270
SHRegGetValueW
ord611
ord184

user32

GetKeyboardLayout
LoadStringW

rpcrt4

CStdStubBuffer_QueryInterface
NdrClientCall2
NdrStubForwardingFunction
NdrStubCall2
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrDllGetClassObject
NdrDllCanUnloadNow

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 659B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

33c48631ac4120bef5a03ec4cb76ed32

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

ole32

oleaut32

secur32

shlwapi

user32

rpcrt4

Exports

Exports

Sections

.text Size: 334KB - Virtual size: 334KB

.orpc Size: 1024B - Virtual size: 659B

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 334KB - Virtual size: 334KB

.orpc
Size: 1024B - Virtual size: 659B

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 16KB - Virtual size: 15KB