deployJava1[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

deployJava1.dll
Size

989KB
MD5

fa737f0eb9b5915d681affcad6a5e28b
SHA1

acec5ab33ed56c5c9dde20273c93b53c8f9a7a7d
SHA256

8b90bd96ee62daf37a1bb4b803bee0755c894944e4a41f810e3b74e8a0a3802a
SHA512

cb1ff5140172556569bf886c858ba52c8761582810e3a143a7ba701963e72bb81004abf6026fb06b804b413ae1d94c14537b0c8ffe94cecb6635d19067b9af5e
SSDEEP

12288:zVKkXDUPauT37kSdWltEI31uHv6eK5z6a4E0wvyfvChbOso6CyQJ1ed:z4kXiauT3gSd0ETvI5ma8S

Score

1^/10

Malware Config

Signatures

Files

deployJava1.dll
.dll regsvr32 windows:5 windows x64 arch:x64

d19e7259e91baf68839816d1270b9532

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/04/2015, 00:00

Not After

13/04/2018, 23:59

Subject

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c0:8a:0e:20:b8:9e:54:68:05:2d:f3:d3:db:c6:72:ea:34:7e:49:29
Signer

Actual PE Digest

c0:8a:0e:20:b8:9e:54:68:05:2d:f3:d3:db:c6:72:ea:34:7e:49:29

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\re\workspace\8-2-build-windows-amd64-cygwin\jdk8u51\3951\build\windows-amd64\deploy\tmp\deployJava1\obj64\deployJava1.pdb

Imports

urlmon

IsValidURL

wininet

InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpQueryInfoW
InternetTimeToSystemTimeW
InternetReadFile
InternetCloseHandle
InternetCrackUrlW
InternetErrorDlg
HttpSendRequestW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

comctl32

ord17

wsock32

gethostbyaddr
inet_addr
gethostbyname
ioctlsocket

imagehlp

ImageUnload
ImageLoad

kernel32

CreateMutexW
CloseHandle
LocalAlloc
lstrlenW
FormatMessageW
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
FlushInstructionCache
GetCurrentProcess
GlobalAlloc
FindResourceW
GetEnvironmentVariableW
GetLocaleInfoW
SetEvent
GetCurrentThreadId
CreateEventW
lstrcmpW
MulDiv
GlobalUnlock
GlobalLock
SetLastError
GlobalFree
GlobalHandle
LockResource
LoadResource
WriteFile
SetEndOfFile
SetFilePointer
CompareFileTime
SystemTimeToFileTime
Sleep
GetFileSize
CreateFileW
ReleaseMutex
GetDiskFreeSpaceW
DeleteFileW
MultiByteToWideChar
lstrlenA
GetTempFileNameW
GetTempPathW
GetProcAddress
GetExitCodeProcess
GetThreadLocale
SizeofResource
GetModuleHandleW
lstrcmpiW
FindClose
FindFirstFileW
GetFullPathNameW
GetFileAttributesW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetWindowsDirectoryW
GetShortPathNameW
MoveFileExW
FindNextFileW
CopyFileW
FreeLibrary
LoadLibraryExW
GetSystemDirectoryW
GetSystemTime
LoadLibraryW
GetSystemWow64DirectoryW
OpenProcess
GetModuleFileNameW
CreateProcessW
ExpandEnvironmentStringsW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
CreateThread
WideCharToMultiByte
GetLongPathNameW
GlobalMemoryStatusEx
GetVersionExW
VerifyVersionInfoW
VerSetConditionMask
GetNativeSystemInfo
GetSystemWindowsDirectoryW
InitializeCriticalSection
DisableThreadLibraryCalls
GetModuleHandleExW
OutputDebugStringW
GetCurrentProcessId
GetStringTypeW
EncodePointer
DecodePointer
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
ExitThread
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileExW
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetDateFormatW
GetTimeFormatW
GetTimeZoneInformation
GetCPInfo
FlsSetValue
GetCommandLineA
LCMapStringW
FlsGetValue
FlsFree
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
TerminateProcess
GetStdHandle
GetACP
GetOEMCP
IsValidCodePage
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
HeapSize
ExitProcess
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetConsoleCP
GetConsoleMode
GetFileInformationByHandle
PeekNamedPipe
GetFileType
ReadFile
SetHandleCount
GetStartupInfoW
FlushFileBuffers
SetEnvironmentVariableA
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
SetStdHandle
WriteConsoleW
GetProcessHeap
InterlockedPushEntrySList
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
LocalFree
GetModuleFileNameA

user32

LoadBitmapW
GetDlgCtrlID
MessageBoxW
CreateWindowExW
SetWindowPos
GetWindow
SetWindowContextHelpId
SendMessageW
MapDialogRect
SetWindowLongPtrW
GetSysColor
CharNextW
GetWindowLongW
SetWindowLongW
MoveWindow
ClientToScreen
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetParent
GetClassNameW
ReleaseCapture
FillRect
CallWindowProcW
GetWindowLongPtrW
EndPaint
BeginPaint
GetDesktopWindow
DestroyAcceleratorTable
SetFocus
GetFocus
GetClassInfoExW
LoadCursorW
RegisterClassExW
CreateAcceleratorTableW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
DialogBoxIndirectParamW
SendDlgItemMessageW
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
DialogBoxParamW
wsprintfW
wsprintfA
GetWindowThreadProcessId
GetShellWindow
SetCursor
PtInRect
GetCursorPos
ShowWindow
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
UnionRect
GetKeyState
UnregisterClassA
SetTimer
KillTimer
EnableWindow
GetDlgItem
DefWindowProcW
GetActiveWindow
SetWindowTextW
LoadStringW
PostMessageW
EndDialog
GetClientRect
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DestroyWindow
IsWindow
PeekMessageW
DispatchMessageA
DispatchMessageW
MsgWaitForMultipleObjectsEx

ole32

OleRegGetMiscStatus
OleRegGetUserType
CreateOleAdviseHolder
OleRegEnumVerbs
WriteClassStm
OleSaveToStream
ReadClassStm
StringFromCLSID
CoFreeUnusedLibraries
CoInitialize
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CreateStreamOnHGlobal
CoTaskMemAlloc
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoCreateInstance
OleInitialize
OleUninitialize

oleaut32

OleCreatePropertyFrame
VarUI4FromStr
OleCreateFontIndirect
SysAllocStringLen
LoadRegTypeLi
VariantChangeType
VariantCopy
SysStringByteLen
VariantClear
VariantInit
LoadTypeLi
SysAllocStringByteLen
SysFreeString
SysStringLen
SysAllocString

gdi32

DPtoLP
GetDeviceCaps
LPtoDP
SetMapMode
CreateDCW
CreateRectRgnIndirect
CreateFontIndirectW
SetBkMode
CreateSolidBrush
BitBlt
CreateCompatibleBitmap
SelectObject
GetStockObject
GetObjectW
SetTextColor
RestoreDC
CreateCompatibleDC
StretchBlt
DeleteObject
DeleteDC
SaveDC
SetGraphicsMode
ModifyWorldTransform
SetViewportOrgEx
SetWindowOrgEx

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 470KB - Virtual size: 469KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d19e7259e91baf68839816d1270b9532

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

c0:8a:0e:20:b8:9e:54:68:05:2d:f3:d3:db:c6:72:ea:34:7e:49:29Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

urlmon

wininet

version

comctl32

wsock32

imagehlp

kernel32

user32

ole32

oleaut32

gdi32

Exports

Exports

Sections

.text Size: 470KB - Virtual size: 469KB

.rdata Size: 199KB - Virtual size: 198KB

.data Size: 26KB - Virtual size: 37KB

.pdata Size: 19KB - Virtual size: 19KB

.rsrc Size: 260KB - Virtual size: 260KB

.reloc Size: 7KB - Virtual size: 6KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

c0:8a:0e:20:b8:9e:54:68:05:2d:f3:d3:db:c6:72:ea:34:7e:49:29
Signer

.text
Size: 470KB - Virtual size: 469KB

.rdata
Size: 199KB - Virtual size: 198KB

.data
Size: 26KB - Virtual size: 37KB

.pdata
Size: 19KB - Virtual size: 19KB

.rsrc
Size: 260KB - Virtual size: 260KB

.reloc
Size: 7KB - Virtual size: 6KB