MSVidCtl[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MSVidCtl.dll
Size

2.1MB
MD5

1888bb7729e4c5fba6adb4525696cecd
SHA1

fa01915877765bdcf1f5addd09c576b1a6a951ec
SHA256

4d299e190d9d2b4c7097cf5b2e2df7f55d90403527bcc7482add178e18e28be5
SHA512

334986c3facffde4e33eacc1c9a4bfb3cedea57d38c6d35366b50648b97cdf3936c6a625b6004339087ecd0917dc2b78b0b547d668f3f361fb971a127a7ffc40
SSDEEP

49152:P2P/BlYVtadcLwp67734anq6k90Q498Si:Y5qJcp67734a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MSVidCtl.dll

Files

MSVidCtl.dll
.dll regsvr32 windows:10 windows x86 arch:x86

84f22e3e45a3ea98a71b472a611cec87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MSVidCtl.pdb

Imports

msvcrt

_lock
_unlock
??8type_info@@QBEHABV0@@Z
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_except_handler4_common
__dllonexit
_onexit
??1type_info@@UAE@XZ
memcmp
floor
_ftol2_sse
_ftol2
__CxxFrameHandler3
_callnewh
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
iswalpha
wcsncmp
_wcsicmp
wcscspn
_wsplitpath_s
_ui64tow
_errno
wcstol
wcsstr
iswspace
wcstoul
_vsnprintf
_wcsnicmp
_vsnwprintf
_itow
_wtoi
iswdigit
_purecall
realloc
wcscat_s
malloc
wcsnlen
free
wcscpy_s
??3@YAXPAX@Z
??_V@YAXPAX@Z
memmove
memset

ole32

GetRunningObjectTable
MkParseDisplayName
CreateBindCtx
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
OleRegGetMiscStatus
CreateDataAdviseHolder
CoGetMalloc
CoInitializeEx
CoWaitForMultipleHandles
CoUninitialize
ProgIDFromCLSID
StringFromCLSID
OleSaveToStream
WriteClassStm
CreateItemMoniker
StringFromGUID2
CoCreateFreeThreadedMarshaler
CLSIDFromString
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
ReadClassStm
HDC_UserMarshal
HDC_UserFree
HDC_UserUnmarshal
HDC_UserSize
HWND_UserMarshal
HWND_UserSize
HWND_UserFree
HWND_UserUnmarshal
OleLoadFromStream

oleaut32

OleCreatePropertyFrame
OleCreatePictureIndirect
VarCmp
VariantInit
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
SafeArrayDestroy
SysAllocStringLen
SysStringByteLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantChangeType
SysAllocStringByteLen
VarUI4FromStr
VariantClear
VariantCopy
LoadTypeLi
SysAllocString
SysStringLen
RegisterTypeLi
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserSize
BSTR_UserMarshal
VARIANT_UserMarshal
BSTR_UserUnmarshal
VARIANT_UserSize
VARIANT_UserUnmarshal
VARIANT_UserFree
BSTR_UserFree
BSTR_UserSize
SysFreeString
VariantChangeTypeEx

kernel32

QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionEx
GetTickCount
InterlockedPushEntrySList
FlushInstructionCache
GetProcessHeap
IsProcessorFeaturePresent
DecodePointer
HeapAlloc
EncodePointer
LoadLibraryExA
VirtualFree
HeapFree
WriteFile
OutputDebugStringA
GetTempPath2W
ExpandEnvironmentStringsW
GetLocalTime
SetLastError
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
GetTickCount64
GetCurrentProcessId
IsValidLocale
GetDriveTypeW
LoadLibraryW
GetSystemDirectoryW
WideCharToMultiByte
GetVersionExW
DeviceIoControl
CreateFileW
Sleep
GetLocaleInfoW
DecodeSystemPointer
SizeofResource
GetCurrentProcess
DuplicateHandle
RaiseException
WaitForMultipleObjects
CreateThread
ResetEvent
SetEvent
CreateMutexW
LockResource
GetSystemTimeAsFileTime
InterlockedPopEntrySList
LoadResource
FindResourceW
ReleaseMutex
WaitForSingleObject
CloseHandle
CreateEventW
MultiByteToWideChar
FormatMessageW
lstrlenA
OutputDebugStringW
DebugBreak
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
GetModuleHandleW
lstrcpynW
lstrcmpiW
lstrlenW
lstrcpyW
HeapDestroy
DisableThreadLibraryCalls
FreeLibrary
EncodeSystemPointer
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
GetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetThreadExecutionState

user32

GetWindowLongW
SetWindowLongW
DefWindowProcW
LoadCursorW
wsprintfW
GetClassInfoExW
RegisterClassExW
BeginPaint
EndPaint
UnionRect
CreateWindowExW
SetWindowRgn
SetWindowPos
FillRect
GetClientRect
PtInRect
SendMessageW
DestroyWindow
SetCursor
LoadImageW
DestroyAcceleratorTable
ShowWindow
IsChild
OffsetRect
CallWindowProcW
CharNextW
LoadStringW
CharPrevW
wvsprintfW
MsgWaitForMultipleObjectsEx
PeekMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
IsWindow
CopyRect
MapWindowPoints
EqualRect
ReleaseDC
GetDC
SystemParametersInfoW
GetWindowRect
GetParent
IntersectRect
PostMessageW
GetKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDesktopWindow
InvalidateRect
SetFocus
GetFocus

advapi32

CryptHashData
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegSetValueW
RegQueryValueExW
RegQueryValueW
InitializeSecurityDescriptor
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
CryptCreateHash
SetSecurityDescriptorDacl

gdi32

GetDeviceCaps
DeleteDC
CreateCompatibleDC
SelectObject
CreateDIBitmap
CreateSolidBrush
DeleteMetaFile
CloseMetaFile
RestoreDC
SetWindowOrgEx
SaveDC
SetWindowExtEx
CreateMetaFileW
CreateRectRgnIndirect
DeleteObject

shlwapi

UrlIsW
PathCreateFromUrlW

rpcrt4

NdrCStdStubBuffer_Release
NdrStubForwardingFunction
NdrStubCall2
IUnknown_AddRef_Proxy
NdrOleFree
IUnknown_Release_Proxy
NdrOleAllocate
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Invoke
NdrDllCanUnloadNow
NdrClientCall2
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrCStdStubBuffer2_Release
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject

slc

SLGetWindowsInformationDWORD

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 208KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 314KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

84f22e3e45a3ea98a71b472a611cec87

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ole32

oleaut32

kernel32

user32

advapi32

gdi32

shlwapi

rpcrt4

slc

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.data Size: 208KB - Virtual size: 210KB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 314KB - Virtual size: 314KB

.reloc Size: 168KB - Virtual size: 168KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 208KB - Virtual size: 210KB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 314KB - Virtual size: 314KB

.reloc
Size: 168KB - Virtual size: 168KB