CPFilters[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CPFilters.dll
Size

693KB
MD5

813327bd25eaa7a82eb85ac0544ae99a
SHA1

74b002f4199645eab297f7a1acc7f5d249ec5a9b
SHA256

a6beebaf1df7464eb7a132f9b83cd0022e895de8e593859fc64b781a586ce22f
SHA512

600533c8121b1eb94046aa355faa0a4e2a48d314f9cfa898baab8a587a6425f42b995038793edf9429a8f970b41dccb98c4b419772b1b68981b6e7c48a8b74bf
SSDEEP

12288:O+ZTBoRg3vlpzYxH0ClJyZNqnuQiCWm8pPJe/cSB7pelI57a6HD4cxmIX//7lHCH:O+ZTBoRg3vlpzYxH0CvC+uQiCpIJe/cj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CPFilters.dll

Files

CPFilters.dll
.dll regsvr32 windows:10 windows x86 arch:x86

fdedaa861316f3040b2e837241138554

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CPFilters.pdb

Imports

msvcrt

wcschr
realloc
_wtol
wcspbrk
memcpy
memset
_wcsicmp
wcsncmp
isupper
wcsstr
swscanf
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
tolower
_endthread
_beginthreadex
swscanf_s
iswxdigit
swprintf_s
srand
memmove
wcsncpy_s
strnlen
strcat_s
wcstoul
wcscat_s
strncpy_s
wcsnlen
_time32
time
rand
??0exception@@QAE@XZ
_callnewh
malloc
free
_vsnwprintf
memmove_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_purecall
_wcsnicmp
_ftol2
_ftol2_sse
_lock
_unlock
__dllonexit
memcpy_s
_onexit
??1type_info@@UAE@XZ
_except_handler4_common
sscanf_s
memcmp

advapi32

RegDeleteKeyW
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptGenRandom
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
TraceMessage

crypt32

CertFreeCertificateChain
CertGetNameStringW
CertGetCertificateChain
CertVerifyCertificateChainPolicy

kernel32

GlobalFree
GlobalAlloc
DebugBreak
InterlockedDecrement
LocalAlloc
GetVersion
FreeEnvironmentStringsA
GetEnvironmentStringsW
GetProcessHeap
HeapAlloc
FreeEnvironmentStringsW
DeviceIoControl
GetSystemTime
GetGeoInfoA
GetModuleHandleA
RaiseException
WriteFile
ReadFile
lstrlenW
SetFilePointer
GlobalLock
GetFileSize
GlobalUnlock
CompareStringW
lstrlenA
InterlockedIncrement
GlobalMemoryStatusEx
ExpandEnvironmentStringsW
WaitForMultipleObjects
WaitForSingleObject
LoadLibraryW
GetProcAddress
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DecodeSystemPointer
Sleep
OutputDebugStringW
EncodeSystemPointer
DeleteCriticalSection
GetCurrentProcessId
VirtualProtect
GetCurrentProcess
ResumeThread
GetLastError
RaiseFailFastException
GetCurrentThread
CloseHandle
GetModuleHandleW
DisableThreadLibraryCalls
GetVersionExW
GetModuleFileNameA
MultiByteToWideChar
lstrcmpW
CreateEventW
ResetEvent
GetCurrentThreadId
SetEvent
CreateThread
GetTickCount
SetThreadPriority
lstrcmpiW
CompareFileTime
GetSystemTimeAsFileTime
WideCharToMultiByte
GetLocalTime
SystemTimeToFileTime
GetSystemFirmwareTable
LocalFree
GetTickCount64
GetModuleHandleExW
GetModuleFileNameW
CreateFileW
QueryPerformanceCounter
OutputDebugStringA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
HeapFree
GetDiskFreeSpaceW

ole32

CoCreateGuid
PropVariantCopy
CoCreateInstance
StringFromGUID2
CoFileTimeNow
PropVariantClear
CLSIDFromString
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoFreeUnusedLibraries
CoInitializeEx

oleaut32

SysAllocStringLen
SysAllocString
VariantCopy
SysStringLen
SysStringByteLen
VariantInit
VariantClear
SafeArrayCreate
VariantChangeType
SafeArrayAccessData
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
SafeArrayUnaccessData

slc

SLGetWindowsInformationDWORD

winmm

timeGetTime

wintrust

CryptCATCatalogInfoFromContext
WinVerifyTrust
WTHelperProvDataFromStateData

mfplat

MFCreateCollection

ws2_32

htonl

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
UpdatePlayready

Sections

.text
Size: 657KB - Virtual size: 656KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fdedaa861316f3040b2e837241138554

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

crypt32

kernel32

ole32

oleaut32

slc

winmm

wintrust

mfplat

ws2_32

Exports

Exports

Sections

.text Size: 657KB - Virtual size: 656KB

.data Size: 3KB - Virtual size: 6KB

.idata Size: 5KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 25KB - Virtual size: 25KB

.text
Size: 657KB - Virtual size: 656KB

.data
Size: 3KB - Virtual size: 6KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 25KB - Virtual size: 25KB