catsrv[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

catsrv.dll
Size

438KB
MD5

42aeeef31fd2dd7abcb592736859b21a
SHA1

543cfa3d8c435b1d2cf4e8706a2901058f15758e
SHA256

4eb59d5169faccf22b8cc7dcfb6908b7e1713c2f2f9cd5d4b62566163cb46c86
SHA512

b2953948073195948b3796ecfb456871da47b28401b521083a556e6724b758bcd3a8adad2ea2d9d8312f483f2ca38b637becfcb7829939ed757d3b171598a855
SSDEEP

6144:v+1LHR2sjLstcvO7u7jZh85AZQyU714uAsQocmgAmk4liatS5y6rM7W8TJ9PdeHO:6dLn+17yjtUauQkaKLredi6VAd5+1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
catsrv.dll

Files

catsrv.dll
.dll regsvr32 windows:6 windows x86 arch:x86

51165beeb677ebeb57742018f9d9e5a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

catsrv.pdb

Imports

msvcrt

_i64tow
wcsspn
_itow
iswdigit
_wcsnicmp
wcschr
wcsrchr
wcstol
__CxxFrameHandler3
_wrename
_errno
_local_unwind4
_beginthreadex
_vsnwprintf
_wcsicmp
_purecall
memcpy
realloc
free
swscanf
_XcptFilter
_initterm
_amsg_exit
_unlock
__dllonexit
_lock
_onexit
_wstrdate
_wstrtime
_waccess
wcstok
_vsnprintf
_wcsdup
wcstoul
_wtoi
malloc
_except_handler4_common
memset

clbcatq

SetupSave
ServerGetApplicationType
SetupOpen
OpenComponentLibraryEx
CreateComponentLibraryEx
GetSimpleTableDispenser
CLSIDFromStringByBitness
ComPlusPartitionsEnabled
DowngradeAPL

mfcsubs

??0CString@@QAE@GH@Z
??0CString@@QAE@ABV0@@Z
??$ConstructElements@VCString@@@@YGXPAVCString@@H@Z
?Create@CPlex@@SGPAU1@AAPAU1@II@Z
??0CString@@QAE@PBD@Z
??H@YG?AVCString@@PBGABV0@@Z
?Find@CString@@QBEHPBG@Z
?MakeUpper@CString@@QAEXXZ
?Right@CString@@QBE?AV1@H@Z
?Mid@CString@@QBE?AV1@H@Z
??1CString@@QAE@XZ
??4CString@@QAEABV0@ABV0@@Z
?Left@CString@@QBE?AV1@H@Z
?ReverseFind@CString@@QBEHG@Z
??4CString@@QAEABV0@PBG@Z
??0CString@@QAE@XZ
??H@YG?AVCString@@ABV0@0@Z
??0CString@@QAE@PBG@Z
??YCString@@QAEABV0@PBG@Z
??H@YG?AVCString@@ABV0@PBG@Z
?FreeDataChain@CPlex@@QAEXXZ
??$DestructElements@VCString@@@@YGXPAVCString@@H@Z

ole32

CoGetCallContext
CLSIDFromString
StringFromGUID2
CoImpersonateClient
CoRevertToSelf
CoGetObjectContext
CoCreateGuid
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree

ntdll

RtlImageRvaToVa
WinSqmSetDWORD
DbgUserBreakPoint

shlwapi

PathStripPathW

kernel32

MultiByteToWideChar
lstrlenW
lstrcpyW
CloseHandle
CreateEventW
DisableThreadLibraryCalls
GetLastError
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
VirtualQuery
GetProcAddress
GetModuleHandleW
lstrcmpiW
HeapDestroy
lstrcpynW
GetModuleFileNameW
FreeLibrary
lstrcatW
lstrlenA
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
InterlockedCompareExchange
FreeLibraryAndExitThread
DuplicateHandle
GetCurrentProcess
SetEvent
GetThreadLocale
IsValidLocale
SetThreadLocale
GetSystemDirectoryW
OutputDebugStringW
WaitForSingleObject
CopyFileW
GetTempPathW
DeleteFileW
MoveFileExW
WriteFile
WideCharToMultiByte
SetFilePointer
CreateFileW
GetComputerNameW
GetCurrentThread
CreateDirectoryW
FindClose
FindNextFileW
RemoveDirectoryW
FindFirstFileW
ReadFile
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileAttributesExW
GetTempFileNameW
SetFileAttributesW
SetFileTime
DosDateTimeToFileTime
GetFileAttributesW
GetLongPathNameW
GetShortPathNameW
GetUserDefaultLangID
GetFileSize
GetFullPathNameW
DelayLoadFailureHook
LoadLibraryExA
InterlockedCompareExchange64
UnmapViewOfFile
InitializeCriticalSectionAndSpinCount
MapViewOfFile
OpenFileMappingW
ExpandEnvironmentStringsW
Sleep
ResetEvent
GetTickCount
MoveFileW
InterlockedExchange
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateFileMappingW
GetFileSizeEx
GetFileType
LocalFree
GetExitCodeProcess
CreateSemaphoreW
ReleaseSemaphore
FormatMessageW
LockResource
CreateProcessW
GetLocalTime
DebugBreak
GetThreadContext
IsDebuggerPresent
LocalAlloc
LocalSize
LocalReAlloc
CompareStringW
ReleaseMutex
OpenMutexW
GetPrivateProfileStringW
GetSystemDefaultLCID
WritePrivateProfileStringW
GetSystemInfo
VirtualAlloc
VirtualProtect
GetVersionExW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
LoadLibraryW

advapi32

RegEnumKeyExW
RegCloseKey
RegDeleteTreeW
RegFlushKey
RegConnectRegistryW
LogonUserW
LsaRetrievePrivateData
LsaStorePrivateData
LsaRemoveAccountRights
LsaEnumerateAccountRights
LsaAddAccountRights
IsValidSecurityDescriptor
CreatePrivateObjectSecurityEx
DestroyPrivateObjectSecurity
LsaLookupNames
GetSidLengthRequired
ConvertSidToStringSidW
IsWellKnownSid
BuildTrusteeWithNameW
BuildSecurityDescriptorW
ConvertStringSidToSidW
LsaOpenPolicy
LsaQueryInformationPolicy
LsaClose
LsaFreeMemory
AllocateAndInitializeSid
FreeSid
LookupAccountSidW
GetSidSubAuthority
GetSidSubAuthorityCount
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
QueryServiceConfigW
SaferCloseLevel
SaferGetLevelInformation
CheckTokenMembership
RevertToSelf
AddAce
LookupAccountNameW
OpenProcessToken
CopySid
RegisterEventSourceW
ReportEventW
DeregisterEventSource
DuplicateTokenEx
CreateProcessAsUserW
SetEntriesInAclW
GetSecurityDescriptorLength
BuildTrusteeWithSidW
GetSecurityDescriptorDacl
RegCreateKeyW
SetThreadToken
RegQueryValueExW
InitializeSecurityDescriptor
OpenThreadToken
GetTokenInformation
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
LockServiceDatabase
UnlockServiceDatabase
QueryServiceStatus
DeleteService
CreateServiceW
ChangeServiceConfigW
ControlService
OpenSCManagerW
OpenServiceW
StartServiceW
CloseServiceHandle
SaferGetPolicyInformation
SaferCreateLevel
RegDeleteValueW

user32

CharPrevW
CharLowerW
DialogBoxParamW
EndDialog
SetDlgItemTextW
CloseWindowStation
CloseDesktop
GetProcessWindowStation
GetThreadDesktop
OpenWindowStationW
SetProcessWindowStation
OpenDesktopW
SetThreadDesktop
GetDesktopWindow
GetWindowRect
GetClientRect
MapWindowPoints
SetWindowPos
IsCharAlphaNumericW
LoadStringW
CharNextW

oleaut32

LoadTypeLi
SysFreeString
SysAllocString
QueryPathOfRegTypeLi
RegisterTypeLi
SysStringLen
VarUI4FromStr
LoadRegTypeLi
LoadTypeLibEx

version

VerQueryValueW

Exports

Exports

?CancelWriteICR@@YGJPAPAUIComponentRecords@@@Z
?GetReadICR@@YGJHPAPAUIComponentRecords@@@Z
?GetWriteICR@@YGJPAPAUIComponentRecords@@@Z
?ReleaseReadICR@@YGXPAPAUIComponentRecords@@@Z
?SaveWriteICR@@YGJPAPAUIComponentRecords@@@Z
CreateComponentLibraryTS
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetAppImport
GetCatalogCRMClerk
OpenComponentLibraryTS

Sections

.text
Size: 418KB - Virtual size: 417KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51165beeb677ebeb57742018f9d9e5a4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

clbcatq

mfcsubs

ole32

ntdll

shlwapi

kernel32

advapi32

user32

oleaut32

version

Exports

Exports

Sections

.text Size: 418KB - Virtual size: 417KB

.data Size: 3KB - Virtual size: 12KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 418KB - Virtual size: 417KB

.data
Size: 3KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 14KB - Virtual size: 14KB