FirewallControlPanel[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

FirewallControlPanel.dll
Size

898KB
MD5

c7fe56bbe1a57c6eacf553886d459927
SHA1

e4e9736890a8d1458ef291f182b40ed2ee275934
SHA256

d16891835a53d0a0b18c5e64c8c3eaaa1e2e69eb4d63d42e0fe615f1edb6b770
SHA512

9cf0ffe3f90cb0640dadc74e7eb3962414611e15e25c8c075c95605b8f1d32204ea75f07e6345bea0a26a2e6f989652bbf0917800b428e25de8c4057a475566b
SSDEEP

12288:sGBmPM0iANjLjqxezzJHMed87HHjlmoRnJj0ZbC0XWNYacp:NF0iIHeevJ7danZmkR04Xy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FirewallControlPanel.dll

Files

FirewallControlPanel.dll
.dll regsvr32 windows:6 windows x64 arch:x64

9dd41034669de864b9a81e688d450a34

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

FirewallControlPanel.pdb

Imports

msvcrt

_CxxThrowException
floorf
memcmp
malloc
_XcptFilter
wcsspn
_wcsicmp
_amsg_exit
_initterm
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
towupper
wcsrchr
_unlock
__dllonexit
_onexit
memset
__C_specific_handler
__CxxFrameHandler3
_vsnwprintf
qsort
memcpy_s
_purecall
_wtol
free
memcpy

ntdll

EtwLogTraceEvent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmIncrementDWORD
RtlQueryElevationFlags
WinSqmAddToStream
WinSqmIsOptedIn
EtwEventWrite
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage

oleaut32

LoadTypeLi
VariantClear
VariantInit
LoadRegTypeLi
SysStringLen
SysAllocString
SysFreeString

api-ms-win-core-com-l1-1-1

CoCreateInstance
CoCreateGuid
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoSetProxyBlanket
CoInitializeEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleW
LoadStringW
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
GetProcAddress
LoadLibraryExA

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
Sleep
OpenMutexW
SetEvent
ResetEvent
CreateEventW
EnterCriticalSection
WaitForSingleObject
ReleaseMutex

api-ms-win-core-heap-l1-2-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringW

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-base-l1-2-0

FreeSid
CheckTokenMembership
AllocateAndInitializeSid

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-memory-l1-1-2

VirtualAlloc
VirtualFree

api-ms-win-core-interlocked-l1-2-0

InterlockedPushEntrySList
InterlockedPopEntrySList

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpICW
QISearch
StrCmpCW
SHLoadIndirectString

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrlenW
lstrcmpiW

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

shcore

CommandLineToArgvW
IUnknown_QueryService
ord145
IUnknown_Set
ord140
ord190
SHStrDupW
IUnknown_SetSite
IUnknown_GetSite

shlwapi

PathFindExtensionW
ord538
PathFindFileNameW
AssocQueryStringW
ord172
ord204
ord278
ord24

user32

MessageBeep
GetKeyState
ClientToScreen
RemovePropW
SetTimer
GetDlgItemInt
GetWindowTextLengthW
SetDlgItemInt
KillTimer
ReleaseCapture
GetWindow
SetWindowTextW
NotifyWinEvent
PtInRect
GetMessagePos
DrawFocusRect
GetFocus
InflateRect
SetWindowLongW
GetWindowLongW
GetParent
MessageBoxW
LoadIconW
MapWindowPoints
SystemParametersInfoW
InvalidateRect
MoveWindow
GetWindowTextW
ReleaseDC
DrawTextW
GetDlgCtrlID
EndPaint
BeginPaint
FillRect
SetRect
DrawIconEx
GetClientRect
GetSysColor
IsWindowVisible
GetDC
SetFocus
DestroyIcon
EndDialog
GetMonitorInfoW
MonitorFromRect
GetWindowRect
IsDlgButtonChecked
SetForegroundWindow
SetActiveWindow
SetWindowPos
GetDoubleClickTime
SetClassLongPtrW
LoadImageW
CheckDlgButton
EnableWindow
SendDlgItemMessageW
ShowWindow
GetDlgItem
SetDlgItemTextW
SetCursor
LoadCursorW
SendMessageW
SetPropW
UnregisterClassW
CallWindowProcW
GetPropW
RegisterClassExW
GetClassInfoExW
DialogBoxParamW
GetActiveWindow
LockSetForegroundWindow
PostMessageW
SetWindowLongPtrW
DefWindowProcW
GetWindowLongPtrW
UnregisterClassA
CreateIconIndirect
CreateWindowExW
SetCapture
DestroyWindow
GetSystemMetrics

kernel32

QueueUserWorkItem
UnregisterWaitEx

gdi32

SetTextColor
GetStockObject
SetBkMode
DeleteObject
CreateSolidBrush
CreateBitmapIndirect
CreateFontIndirectW
SelectObject
GetObjectW
CreateCompatibleDC
DeleteDC
SetDIBits
CreateCompatibleBitmap

uxtheme

SetWindowTheme
GetThemeBackgroundContentRect
GetThemeFont
DrawThemeBackground
CloseThemeData
GetThemeColor
OpenThemeData
IsThemeActive

oleacc

ObjectFromLresult
LresultFromObject
CreateStdAccessibleProxyW

firewallapi

FWEnumProducts
FWGetGlobalConfig
FwGetVersionField
FwIsGroupPolicyEnforced
FWOpenPolicyStore
FWGetConfig
FWClosePolicyStore
IcfChangeNotificationDestroy
IcfChangeNotificationCreate
FWFreeProducts
FwAnalyzeFirewallPolicyOnProfile
IsRuleOpenPortOrAuthApp
IsRuleOldGlobalOpenPort
IsRuleOldAuthApp
FWEnumFirewallRules
FwActivate
FWDeleteFirewallRule
FwFree
FWAddFirewallRule
FWSetFirewallRule
FWFreeFirewallRules
FwAlloc

msimg32

GradientFill

api-ms-win-core-sidebyside-l1-1-0

CreateActCtxW
DeactivateActCtx
ActivateActCtx
ReleaseActCtx

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ShowNotificationDialogW
ShowWarningDialogW

Sections

.text
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 594KB - Virtual size: 594KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9dd41034669de864b9a81e688d450a34

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-core-com-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

shcore

shlwapi

user32

kernel32

gdi32

uxtheme

oleacc

firewallapi

msimg32

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 271KB - Virtual size: 271KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 13KB - Virtual size: 13KB

.idata Size: 11KB - Virtual size: 10KB

.didat Size: 2KB - Virtual size: 1KB

.rsrc Size: 594KB - Virtual size: 594KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 271KB - Virtual size: 271KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 13KB - Virtual size: 13KB

.idata
Size: 11KB - Virtual size: 10KB

.didat
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 594KB - Virtual size: 594KB

.reloc
Size: 3KB - Virtual size: 2KB