FirewallControlPanel[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

FirewallControlPanel.dll
Size

835KB
MD5

3aa8b5c2a11b77b70ba6d425614d7d9a
SHA1

9c21d59c4ab23cb6bb428a2cea66a7fc8cf9745d
SHA256

913b1f0edd8bd779be6ef8c8211b1e3be3af0fc19446cbd0b2130322dca9dc6c
SHA512

5f16414d4e9bc7140a21572a80eed0f6e72b63306d19a666297f4fe94c17781bf7aade2afc07e5e5e8d342ed38b1ac09f37997bf6ea4aab9d0559aefc29e7eef
SSDEEP

12288:wmWZk+DEXdFAOxIBzJHMed87HHjlmoRnJj0ZbC0XWNYacpR:JWm+AXdFAOxI9J7danZmkR04Xy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FirewallControlPanel.dll

Files

FirewallControlPanel.dll
.dll regsvr32 windows:6 windows x86 arch:x86

b9d839adbd4ddf6f926c14cb8ff56ee7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

FirewallControlPanel.pdb

Imports

msvcrt

__CxxFrameHandler3
_CxxThrowException
_ftol2_sse
_XcptFilter
floor
wcsrchr
memset
_amsg_exit
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_lock
_unlock
__dllonexit
_onexit
towupper
_vsnwprintf
_wcsicmp
wcsspn
malloc
qsort
memcpy_s
_purecall
_wtol
free
_except_handler4_common
memcpy

ntdll

EtwLogTraceEvent
WinSqmIncrementDWORD
RtlQueryElevationFlags
WinSqmAddToStream
WinSqmIsOptedIn
EtwEventWrite
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage

oleaut32

LoadTypeLi
SysFreeString
SysAllocString
SysStringLen
LoadRegTypeLi
VariantClear
VariantInit

api-ms-win-core-com-l1-1-1

CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoSetProxyBlanket
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateGuid

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadStringW
LoadLibraryExW
GetModuleFileNameW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleW

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
Sleep
SetEvent
ResetEvent
CreateEventW
InitializeCriticalSection
ReleaseMutex
WaitForSingleObject
DeleteCriticalSection
OpenMutexW
LeaveCriticalSection

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal

api-ms-win-core-processthreads-l1-1-2

IsProcessorFeaturePresent
GetCurrentProcess
FlushInstructionCache
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-base-l1-2-0

CheckTokenMembership
FreeSid
AllocateAndInitializeSid

api-ms-win-core-sysinfo-l1-2-1

GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-memory-l1-1-2

VirtualFree
VirtualAlloc

api-ms-win-core-interlocked-l1-2-0

InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpCW
QISearch
StrCmpICW
SHLoadIndirectString

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpW
lstrcmpiW

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

shcore

CommandLineToArgvW
IUnknown_QueryService
ord145
IUnknown_Set
ord140
ord190
SHStrDupW
IUnknown_SetSite
IUnknown_GetSite

shlwapi

PathFindExtensionW
ord538
PathFindFileNameW
AssocQueryStringW
ord172
ord204
ord24
ord278

user32

MessageBeep
GetKeyState
ClientToScreen
SetCapture
SetTimer
GetDlgItemInt
GetWindowTextLengthW
SetDlgItemInt
KillTimer
ReleaseCapture
GetWindow
SetWindowTextW
NotifyWinEvent
PtInRect
GetMessagePos
DrawFocusRect
GetFocus
InflateRect
GetParent
MessageBoxW
LoadIconW
MapWindowPoints
SystemParametersInfoW
InvalidateRect
MoveWindow
GetWindowTextW
ReleaseDC
DrawTextW
GetDlgCtrlID
EndPaint
BeginPaint
FillRect
IsWindowVisible
SetRect
DrawIconEx
GetClientRect
GetSysColor
GetDC
SetFocus
DestroyIcon
EndDialog
GetMonitorInfoW
MonitorFromRect
GetWindowRect
IsDlgButtonChecked
SetForegroundWindow
SetActiveWindow
SetWindowPos
SetClassLongW
LoadImageW
GetSystemMetrics
CheckDlgButton
EnableWindow
SendDlgItemMessageW
ShowWindow
GetDlgItem
SetDlgItemTextW
SetCursor
LoadCursorW
SendMessageW
SetPropW
UnregisterClassW
CallWindowProcW
GetPropW
RegisterClassExW
GetClassInfoExW
DialogBoxParamW
GetActiveWindow
UnregisterClassA
CreateIconIndirect
CreateWindowExW
RemovePropW
DestroyWindow
GetWindowLongW
DefWindowProcW
SetWindowLongW
PostMessageW
LockSetForegroundWindow
GetDoubleClickTime

kernel32

QueueUserWorkItem
UnregisterWaitEx

gdi32

GetStockObject
SelectObject
CreateCompatibleDC
DeleteDC
SetTextColor
CreateBitmapIndirect
SetBkMode
DeleteObject
CreateSolidBrush
CreateFontIndirectW
GetObjectW
SetDIBits
CreateCompatibleBitmap

uxtheme

SetWindowTheme
GetThemeBackgroundContentRect
GetThemeFont
DrawThemeBackground
CloseThemeData
GetThemeColor
OpenThemeData
IsThemeActive

oleacc

ObjectFromLresult
LresultFromObject
CreateStdAccessibleProxyW

firewallapi

IsRuleOpenPortOrAuthApp
FWGetGlobalConfig
FwGetVersionField
FwIsGroupPolicyEnforced
FWOpenPolicyStore
FWGetConfig
FWClosePolicyStore
IcfChangeNotificationCreate
IcfChangeNotificationDestroy
FWEnumProducts
FWFreeProducts
FwAnalyzeFirewallPolicyOnProfile
IsRuleOldGlobalOpenPort
IsRuleOldAuthApp
FWEnumFirewallRules
FWFreeFirewallRules
FWSetFirewallRule
FwAlloc
FwActivate
FWDeleteFirewallRule
FwFree
FWAddFirewallRule

msimg32

GradientFill

api-ms-win-core-sidebyside-l1-1-0

ActivateActCtx
ReleaseActCtx
DeactivateActCtx
CreateActCtxW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ShowNotificationDialogW
ShowWarningDialogW

Sections

.text
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 594KB - Virtual size: 594KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9d839adbd4ddf6f926c14cb8ff56ee7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-core-com-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

shcore

shlwapi

user32

kernel32

gdi32

uxtheme

oleacc

firewallapi

msimg32

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 205KB - Virtual size: 204KB

.data Size: 3KB - Virtual size: 4KB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 594KB - Virtual size: 594KB

.reloc Size: 23KB - Virtual size: 23KB

.text
Size: 205KB - Virtual size: 204KB

.data
Size: 3KB - Virtual size: 4KB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 594KB - Virtual size: 594KB

.reloc
Size: 23KB - Virtual size: 23KB