OnlineFix[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

OnlineFix.dll
Size

2.2MB
MD5

b2cdc24748cba5e766ba78ffdf718b71
SHA1

6e08e65000b2f3c5f909e13db718365c382dcf10
SHA256

257744e5ec6a5bad22be59bea68ef1c46677c0bf45ad96686b2d88306c11de4f
SHA512

45826cc9b049dfa5e827d25d85b4af74eb8048173f51f5c417cccea70f7bc5c235e95e516b8594f7eb205760718f0347f6c5545d8c667b28e7107c9d7249dde0
SSDEEP

49152:eqxfZU1BJfMccKXwwrY1YPzTMNGFiPN3lKJjP0Bs:txfZUmKXwwrG+gP18

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OnlineFix.dll

Files

OnlineFix.dll
.dll windows:6 windows x86 arch:x86

577ac89c2cff08f580328b9485b2b529

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesA
LoadLibraryA
LoadLibraryW
CreateThread
FindResourceW
GetWindowsDirectoryW
GetProcAddress
ExitProcess
SetEnvironmentVariableA
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleInputW
SetConsoleMode
GetTimeZoneInformation
FlushFileBuffers
SetStdHandle
HeapReAlloc
GetStringTypeW
GetFileSizeEx
GetModuleHandleA
LCMapStringW
CompareStringW
HeapFree
HeapAlloc
ReadConsoleW
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
FreeLibraryAndExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetCPInfo
GetModuleHandleExW
LoadLibraryExW
EncodePointer
InterlockedFlushSList
RaiseException
RtlUnwind
InitializeSListHead
ExitThread
InitializeCriticalSection
LeaveCriticalSection
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SetEvent
GetModuleFileNameW
GetCurrentProcess
EnterCriticalSection
VirtualProtect
SizeofResource
FlushConsoleInputBuffer
GlobalMemoryStatus
GetModuleFileNameA
GetCurrentProcessId
SystemTimeToFileTime
GetSystemTime
LocalFree
FormatMessageA
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
CloseHandle
GetLastError
SetLastError
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
InitializeCriticalSectionEx
DeleteCriticalSection
Sleep
SleepEx
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
FreeLibrary
VerSetConditionMask
GetSystemDirectoryA
VerifyVersionInfoA
WriteFile
GetCurrentThreadId
DecodePointer

user32

MessageBoxA
GetUserObjectInformationW
FindWindowA
GetProcessWindowStation

shell32

ord680
SHGetSpecialFolderPathA

ws2_32

ioctlsocket
shutdown
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
getservbyname
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
WSAStartup
htonl
gethostname
gethostbyname
sendto

wldap32

ord27
ord46
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord143
ord26
ord22
ord41
ord50
ord60
ord211

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource

dbghelp

ImageDirectoryEntryToData

Exports

Exports

Breakpad_SteamMiniDumpInit
Breakpad_SteamSetAppID
Breakpad_SteamSetSteamID
Breakpad_SteamWriteMiniDumpSetComment
Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
CreateInterface
OnlineFix
ShellExecuteA
ShellExecuteW
Steam_BConnected
Steam_BGetCallback
Steam_BLoggedOn
Steam_BReleaseSteamPipe
Steam_ConnectToGlobalUser
Steam_CreateGlobalUser
Steam_CreateLocalUser
Steam_CreateSteamPipe
Steam_FreeLastCallback
Steam_GSBLoggedOn
Steam_GSBSecure
Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient
Steam_GSGetSteamID
Steam_GSLogOff
Steam_GSLogOn
Steam_GSRemoveUserConnect
Steam_GSSendSteam2UserConnect
Steam_GSSendSteam3UserConnect
Steam_GSSendUserDisconnect
Steam_GSSendUserStatusResponse
Steam_GSSetServerType
Steam_GSSetSpawnCount
Steam_GSUpdateStatus
Steam_GetAPICallResult
Steam_GetGSHandle
Steam_InitiateGameConnection
Steam_LogOff
Steam_LogOn
Steam_ReleaseThreadLocalMemory
Steam_ReleaseUser
Steam_SetLocalIPBinding
Steam_TerminateGameConnection
hid_close
hid_enumerate
hid_error
hid_exit
hid_free_enumeration
hid_get_feature_report
hid_get_indexed_string
hid_get_manufacturer_string
hid_get_product_string
hid_get_serial_number_string
hid_init
hid_open
hid_open_path
hid_read
hid_read_timeout
hid_send_feature_report
hid_set_nonblocking
hid_write
hid_write_output_report

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.of0
Size: 642KB - Virtual size: 641KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 652B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

577ac89c2cff08f580328b9485b2b529

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ws2_32

wldap32

advapi32

dbghelp

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 340KB - Virtual size: 339KB

.data Size: 39KB - Virtual size: 50KB

.of0 Size: 642KB - Virtual size: 641KB

.reloc Size: 59KB - Virtual size: 59KB

.rsrc Size: 1024B - Virtual size: 652B

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 340KB - Virtual size: 339KB

.data
Size: 39KB - Virtual size: 50KB

.of0
Size: 642KB - Virtual size: 641KB

.reloc
Size: 59KB - Virtual size: 59KB

.rsrc
Size: 1024B - Virtual size: 652B