SWind[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

SWind.dll
Size

152KB
MD5

f5c2bc3da7f755a5b9a7ccf9008fc8b2
SHA1

543b335163413d86ff1892d3c9e9b485ed2cdc88
SHA256

09f4522407d2621ea90e79f85af26bf090146fb38f33b516d970ad825194c6b4
SHA512

049aa162d1f4c37c7e0c074b999cab8aee3fafcc38044acb7cf69e3122164cb127ef16c5c73d4e59f582e5a5877f0bce2cad14f87426fdc681b9e1627cb83740
SSDEEP

3072:G0xJDEOuV1eVZeYQZ3vgoVJu8i8IPHHl:FVuYV268aH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SWind.dll

Files

SWind.dll
.dll windows:4 windows x86 arch:x86

1a6c36857a6184eb347e201b91f980a6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

kernel32

SetEndOfFile
RtlUnwind
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
ExitProcess
TerminateProcess
CreateThread
ExitThread
RaiseException
HeapSize
HeapReAlloc
GetACP
FlushFileBuffers
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
SetFilePointer
GetCurrentProcess
GetOEMCP
GetCPInfo
GetProcessVersion
WritePrivateProfileStringA
GlobalFlags
lstrcpynA
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalFree
LocalAlloc
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
FreeLibrary
GetLastError
lstrcatA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
lstrcpyA
GetModuleHandleA
GetProcAddress
lstrlenA
SuspendThread
GetModuleFileNameA
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
SetEvent
Sleep
SetThreadPriority
ResumeThread
ReadFile
WriteFile
CreateEventA
DeviceIoControl
WaitForSingleObject
CancelIo
GetOverlappedResult
SetLastError
GetVersion
GetVersionExA
CloseHandle
CreateFileA

user32

CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
LoadIconA
SetWindowTextA
ShowWindow
UnregisterClassA
GetClassNameA
PtInRect
ClientToScreen
GetDC
ReleaseDC
TabbedTextOutA
DrawTextA
GrayStringA
GetSysColorBrush
LoadStringA
DestroyMenu
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
DefWindowProcA
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
SetCursor
SendMessageA
RegisterDeviceNotificationA
wsprintfA
IsWindow
LoadCursorA
PostMessageA
PostQuitMessage
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
EnableWindow
GetWindowRect

gdi32

SelectObject
GetStockObject
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
RestoreDC
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SaveDC
DeleteDC
DeleteObject
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA

comctl32

ord17

Exports

Exports

SW_CIDClear
SW_CIDEnd
SW_CheckCIDEnd
SW_CheckDial
SW_CheckDisconnect
SW_CheckFileCopy
SW_CheckFilePlay
SW_CheckFileRecordEnd
SW_CheckOffHook
SW_CheckPlayEnd
SW_CheckRecEnd
SW_CheckRing
SW_CheckSilence
SW_Disconnect
SW_Free
SW_GetCID
SW_GetCount
SW_GetDTMF
SW_GetInfo
SW_GetPolarity
SW_GetSN
SW_GetSignal
SW_GetStrCID
SW_GetStrDTMF
SW_HangUpCtrl
SW_I_Disconnect
SW_I_Get_CID
SW_I_Get_END
SW_I_Get_SN
SW_I_LED_FLASH
SW_I_Off_HOOK
SW_I_Reconnect
SW_I_USBInit
SW_Init
SW_LED
SW_OffHook
SW_OffHookCtrl
SW_Play
SW_PlayEnd
SW_RecEnd
SW_ReceiveCID
SW_ReceiveDTMF
SW_Reconnect
SW_Record
SW_Record1
SW_SN
SW_SetSignalPara
SW_SetType
SW_SetVolume
SW_StartDial
SW_StartDrv
SW_StartFileCopy
SW_StartFilePlay
SW_StartFileRecord
SW_StartPlay
SW_StartSignal
SW_StopDial
SW_StopDrv
SW_StopFileCopy
SW_StopFilePlay
SW_StopFileRecord
SW_StopPlay
SW_StopSignal
SW_TestSignal
SW_USBInit

Sections

.text
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1a6c36857a6184eb347e201b91f980a6

Headers

File Characteristics

Imports

setupapi

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 90KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 8KB - Virtual size: 84KB

.rsrc Size: 12KB - Virtual size: 10KB

.reloc Size: 16KB - Virtual size: 14KB

.text
Size: 92KB - Virtual size: 90KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 8KB - Virtual size: 84KB

.rsrc
Size: 12KB - Virtual size: 10KB

.reloc
Size: 16KB - Virtual size: 14KB