NaturalLanguage6[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

NaturalLanguage6.dll
Size

896KB
MD5

769e0e0b76ab47ca094e23b11b0ab311
SHA1

df2ce29e98a8065ab5118a2639e276c54962166e
SHA256

593089bcceffed3e7c403d486d19bf905790f8c6da9474c28e4f9e23b09b3d54
SHA512

37e7bbef8ef366b415fc5fe248fa59c44d3398521485be67690114d70a8beeb5447de79b86088875e27948b2c4f254e310ec7e918649c0cfec870d8bb8b8af02
SSDEEP

24576:2kforSFmLDolOiNg2ylKP1B/q2+0KbSH:2kf0SQLoNJpq2+M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NaturalLanguage6.dll

Files

NaturalLanguage6.dll
.dll regsvr32 windows:6 windows x86 arch:x86

b33e6cb8a86e73438f4e2d7e612632a3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

NaturalLanguage6.pdb

Imports

msvcrt

__dllonexit
_unlock
memcpy
memset
isdigit
isxdigit
isleadbyte
_fileno
calloc
localeconv
ungetc
_onexit
_vsnwprintf
_lock
__pioinfo
__badioinfo
??1type_info@@UAE@XZ
_read
wcstombs
iswctype
wctomb
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
__CxxFrameHandler
wcsstr
realloc
wcsncmp
malloc
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_resetstkoflw
qsort
__mb_cur_max
free
wcschr
memmove
_purecall
??0exception@@QAE@XZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
_errno
fclose
fgetws
_wfopen
_wgetcwd
_waccess
_wgetenv
wcsrchr
fread
ftell
fseek
atoi
?name@type_info@@QBEPBDXZ
??8type_info@@QBEHABV0@@Z
tolower
toupper
iswspace
_isctype
mbtowc
_CIsqrt
memcmp

oleaut32

VariantChangeType
VariantClear
VariantCopy
CreateErrorInfo
SetErrorInfo
GetErrorInfo
SysAllocString
SysFreeString
SysStringLen
VariantInit
SysStringByteLen
SysAllocStringLen
SysAllocStringByteLen

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
Sleep
DeleteCriticalSection

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
RegQueryValueExW

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
LoadLibraryExA
GetProcAddress
GetModuleHandleW

api-ms-win-core-file-l1-2-1

SetFilePointerEx
ReadFile
CreateFileW
GetFileInformationByHandle

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-1

StringFromGUID2
IIDFromString
CoTaskMemAlloc

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-rtlsupport-l1-2-0

RtlUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetVersion
GetTickCount

shell32

SHGetFolderPathW

kernel32

FlushFileBuffers
WriteFile
SetFilePointer
CreateFileMappingW
SleepEx
UnmapViewOfFile
MapViewOfFile
DelayLoadFailureHook
GetLocaleInfoA
SetEndOfFile
GetSystemDefaultLCID
CompareStringW
GetFileSize
CreateMutexW
CreateEventW
GetLocalTime
FormatMessageW
lstrlenA
lstrlenW
LoadLibraryW
LocalFree

crypt32

CertOpenSystemStoreW
CryptAcquireCertificatePrivateKey
CertGetCertificateContextProperty
CertCloseStore
CertFindCertificateInStore

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 781KB - Virtual size: 781KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b33e6cb8a86e73438f4e2d7e612632a3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-debug-l1-1-1

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

shell32

kernel32

crypt32

Exports

Exports

Sections

.text Size: 781KB - Virtual size: 781KB

.data Size: 16KB - Virtual size: 16KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 20B

.rsrc Size: 52KB - Virtual size: 51KB

.reloc Size: 40KB - Virtual size: 40KB

.text
Size: 781KB - Virtual size: 781KB

.data
Size: 16KB - Virtual size: 16KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 20B

.rsrc
Size: 52KB - Virtual size: 51KB

.reloc
Size: 40KB - Virtual size: 40KB