0788e438d5fe265524ae3cd5ccd595299985d3bbd39b9efd70f68bed4261a806[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
0788e438d5fe265524ae3cd5ccd595299985d3bbd39b9efd70f68bed4261a806.dll
Size 1.0MB
Sample260702-cwspvsbs7t
SHA256 0788e438d5fe265524ae3cd5ccd595299985d3bbd39b9efd70f68bed4261a806
MD5 a839c2836cb3d33983e6def2d166ab63
SHA1 8721c2c2e892a957cfeb8752a9ec1458dcc9a59f
SHA512 36ed6819049b5ac8d09db07cdf526c766afcac81d65fd131b2142c838ab965264c0f2afd39b39bc7f2c9554515cf93f9dd020a2081c3c67e78d35037cc422742
SSDEEP 24576:o+uIkXVbU0TXLR2P4CONwkDtjno9Dwn83ijPLjhWuPZ3YQTtXDNt5GN:6rVbjZ2PhON1DtjncD2VLjhWuPRYQTZM
TLSH
T163359E1375D18035E5B3063099BDBB25AEFDBA310A32D64E13D82A5E6F72980D73A353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0788e438d5fe265524ae3cd5ccd595299985d3bbd39b9efd70f68bed4261a806.dll

File Explorer

0788e438d5fe265524ae3cd5ccd595299985d3bbd39b9efd70f68bed4261a806.dll

.dll 1.0MB

0788e438d5fe265524ae3cd5ccd595299985d3bbd39b9efd70f68bed4261a806.dll

IMPHASH 566608fc4e739807cf78f375182a051b
SHA256 0788e438d5fe265524ae3cd5ccd595299985d3bbd39b9efd70f68bed4261a806
MD5 a839c2836cb3d33983e6def2d166ab63
SHA1 8721c2c2e892a957cfeb8752a9ec1458dcc9a59f
SHA512 36ed6819049b5ac8d09db07cdf526c766afcac81d65fd131b2142c838ab965264c0f2afd39b39bc7f2c9554515cf93f9dd020a2081c3c67e78d35037cc422742
SSDEEP 24576:o+uIkXVbU0TXLR2P4CONwkDtjno9Dwn83ijPLjhWuPZ3YQTtXDNt5GN:6rVbjZ2PhON1DtjncD2VLjhWuPRYQTZM
TLSH
T163359E1375D18035E5B3063099BDBB25AEFDBA310A32D64E13D82A5E6F72980D73A353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

630521

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

goopdate_unsigned.pdb

kernel32

TransactNamedPipe SetNamedPipeHandleState VirtualQueryEx WaitNamedPipeW InitOnceComplete InitOnceBeginInitialize CreateDirectoryW SizeofResource SetLastError lstrlenW WriteFile GetPrivateProfileIntW OutputDebugStringA SetFilePointer GetEnvironmentVariableW WaitForSingleObject CreateFileW GetCurrentThreadId ReleaseMutex Sleep GetFileInformationByHandle GetFileAttributesExW OutputDebugStringW LockResource CloseHandle FindResourceExW LoadResource FindResourceW GetLocalTime GetCurrentProcessId lstrcmpiW lstrcmpW FindFirstFileW FindNextFileW GetCurrentProcess RemoveDirectoryW WaitForMultipleObjects FindClose GetFileAttributesW DuplicateHandle FormatMessageW GetCurrentThread DeleteFileW LoadLibraryW GetCurrentDirectoryW GetProcAddress LocalFree GetModuleHandleW FreeLibrary GetTempFileNameW OpenMutexW GetTickCount LoadLibraryExW GetExitCodeProcess ReadFile CompareFileTime SetEndOfFile SetFileAttributesW FileTimeToSystemTime MoveFileExW GetFileSize CopyFileW GetSystemTimeAsFileTime GetFileTime FlushFileBuffers lstrcpynW ExitProcess IsDebuggerPresent WideCharToMultiByte MultiByteToWideChar GetTimeZoneInformation FileTimeToLocalFileTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetModuleFileNameW GetTempPathW GetSystemDirectoryW VirtualQuery TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateMutexW CreateEventW SetEvent ResetEvent GetLongPathNameW SetPriorityClass TerminateProcess WaitForMultipleObjectsEx OpenProcess CreateToolhelp32Snapshot ProcessIdToSessionId Process32NextW WaitForSingleObjectEx ReadProcessMemory SetHandleInformation CreatePipe GetSystemPowerStatus GlobalMemoryStatusEx CreateProcessW SetProcessWorkingSetSize GetVersionExW VerSetConditionMask VerifyVersionInfoW LocalAlloc HeapSetInformation GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetStdHandle QueryDosDeviceW GetLogicalDriveStringsW OpenEventW CreateThread SetCurrentDirectoryW OpenThread QueryPerformanceCounter GetCommandLineW GetStringTypeExW GetThreadLocale lstrcmpA GetStringTypeExA SetFilePointerEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead GetStringTypeW TryAcquireSRWLockExclusive CompareStringEx InitializeCriticalSectionEx EncodePointer LCMapStringEx GetCPInfo QueryPerformanceFrequency RtlUnwind InterlockedPushEntrySList InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo VirtualAlloc VirtualProtect GetModuleHandleExW GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileSizeEx SetStdHandle GetConsoleOutputCP GetConsoleMode ReadConsoleW WriteConsoleW GetProcessId ReleaseSemaphore RtlCaptureContext DeleteTimerQueueTimer CreateTimerQueueTimer LoadLibraryExA VirtualFree FlushInstructionCache InterlockedPopEntrySList MulDiv GlobalHandle CreateTimerQueue DeleteTimerQueueEx GetSystemDefaultLangID GetUserDefaultLangID GetComputerNameExW GetPrivateProfileStringW DeviceIoControl GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount GetSystemTime UnregisterWaitEx RegisterWaitForSingleObject QueueUserWorkItem Thread32First Thread32Next SetProcessShutdownParameters GetProcessShutdownParameters CreateSemaphoreW Process32FirstW HeapFree

oleaut32

SysReAllocStringLen SysAllocString SystemTimeToVariantTime LoadRegTypeLi OleCreateFontIndirect VarBstrCmp VariantChangeType SafeArrayRedim SafeArrayDestroy SafeArrayGetUBound SafeArrayUnlock SafeArrayGetLBound SafeArrayCopy SafeArrayGetVartype SafeArrayLock SafeArrayCreate LoadTypeLi VariantClear VariantInit SysAllocStringLen SysFreeString SysAllocStringByteLen OleLoadPicturePath SysStringLen VarUI4FromStr VariantTimeToSystemTime SysStringByteLen

user32

GetClientRect TranslateMessage MapWindowPoints PeekMessageW GetMonitorInfoW DispatchMessageW CreateWindowExW CloseClipboard EmptyClipboard SetClipboardData SetCapture UnregisterClassW GetParent SetForegroundWindow GetClassNameW SetWindowContextHelpId GetMenuState InflateRect SetActiveWindow OffsetRect IsMenu SetFocus FrameRect IsRectEmpty GetSysColorBrush SystemParametersInfoW UpdateWindow GetCursorPos EnumChildWindows EnableMenuItem EnableWindow IsDialogMessageW GetWindowTextLengthW GetSystemMenu GetFocus GetDC FillRect ScreenToClient EndDialog SetWindowTextW ShowWindow InvalidateRgn MapDialogRect RemoveMenu GetDlgItem GetDesktopWindow CreateDialogIndirectParamW CreateAcceleratorTableW RedrawWindow RegisterWindowMessageW FlashWindow ReleaseCapture PostQuitMessage SetLayeredWindowAttributes OpenClipboard LoadImageW EnumWindows GetSystemMetrics SendMessageW IsWindowVisible GetWindowThreadProcessId PostThreadMessageW CharNextW LoadStringW IsWindow CharLowerBuffA CopyRect CharNextA DestroyIcon ClientToScreen DestroyAcceleratorTable IsChild GetTopWindow GetSysColor MoveWindow InvalidateRect CharUpperW CharLowerW CharLowerBuffW MessageBoxW wvsprintfW wsprintfW GetWindowLongW GetMessageW AllowSetForegroundWindow GetWindow GetWindowRect DestroyWindow SetWindowPos MonitorFromWindow PostMessageW WaitForInputIdle SendDlgItemMessageW CopyImage GetClassInfoExW KillTimer SetWindowLongW LoadCursorW SetTimer RegisterClassExW CallWindowProcW DefWindowProcW CharUpperBuffW GetWindowTextW EndPaint BeginPaint ReleaseDC

iphlpapi

GetIfTable

netapi32

NetGetJoinInformation NetApiBufferFree NetWkstaUserGetInfo NetWkstaGetInfo

psapi

EnumProcesses GetModuleFileNameExW EnumProcessModules

shlwapi

PathAddBackslashW PathRemoveFileSpecW PathRemoveExtensionW PathStripPathW PathCommonPrefixW PathFindFileNameW SHQueryValueExW PathFileExistsW PathAddExtensionW UrlCombineW PathFindExtensionW PathIsDirectoryW PathIsDirectoryEmptyW UrlIsW UrlUnescapeA PathAppendA UrlEscapeW PathCreateFromUrlW PathAppendW PathCanonicalizeW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

userenv

LeaveCriticalPolicySection EnterCriticalPolicySection ExpandEnvironmentStringsForUserW DestroyEnvironmentBlock CreateEnvironmentBlock GetProfileType UnloadUserProfile

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSFreeMemory

advapi32

RegEnumKeyExW ControlService QueryServiceStatus SystemFunction036 DuplicateToken RegOverridePredefKey GetUserNameW SetSecurityDescriptorOwner GetAce RegOpenCurrentUser IsTextUnicode DeregisterEventSource CreateServiceW SetServiceStatus ChangeServiceConfig2W DeleteService RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW QueryServiceConfigW ChangeServiceConfigW QueryServiceConfig2W RegisterEventSourceW ReportEventW TraceEvent GetSecurityInfo CryptAcquireContextW CryptGenRandom CryptReleaseContext GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids GetSidSubAuthorityCount GetSidIdentifierAuthority AllocateAndInitializeSid ImpersonateSelf FreeSid CheckTokenMembership RegNotifyChangeKeyValue RegQueryInfoKeyW RegDeleteKeyW RegCreateKeyExW GetAclInformation RegSetValueExW RegDeleteValueW RegEnumValueW LookupPrivilegeValueW AdjustTokenPrivileges CreateProcessAsUserW ConvertSidToStringSidW DuplicateTokenEx SetSecurityDescriptorDacl RevertToSelf MakeSelfRelativeSD RegQueryValueExW GetSecurityDescriptorLength GetLengthSid RegOpenKeyExW InitializeAcl AddAce IsValidSid GetSecurityDescriptorOwner InitializeSid CopySid GetSecurityDescriptorControl SetNamedSecurityInfoW GetSidLengthRequired GetSidSubAuthority GetSecurityDescriptorGroup RegCloseKey GetSecurityDescriptorDacl GetSecurityDescriptorSacl GetTokenInformation SetSecurityDescriptorGroup MakeAbsoluteSD OpenThreadToken OpenServiceW InitializeSecurityDescriptor StartServiceW OpenProcessToken ImpersonateLoggedOnUser ConvertStringSidToSidW GetNamedSecurityInfoW OpenSCManagerW CloseServiceHandle EqualSid

ntdll

NtDeleteKey

ole32

CoGetCallContext CoRevertToSelf CoTaskMemFree CoSetProxyBlanket IIDFromString CoReleaseServerProcess CoTaskMemAlloc CoInitializeSecurity CoRegisterClassObject CoResumeClassObjects CoImpersonateClient CoTaskMemRealloc CoInitializeEx CoRevokeClassObject CoRegisterPSClsid OleSaveToStream ReadClassStm WriteClassStm CoCreateInstance StringFromGUID2 CoCreateGuid CoSuspendClassObjects CoGetObject CoUninitialize CreateStreamOnHGlobal CoGetClassObject OleUninitialize CLSIDFromProgID OleInitialize CoAddRefServerProcess CLSIDFromString OleLockRunning

shell32

ShellExecuteExW CommandLineToArgvW SHGetFolderPathW ord680

comctl32

InitCommonControlsEx _TrackMouseEvent

crypt32

CryptHashCertificate CryptUnprotectData CryptProtectData CertFreeCertificateContext CryptQueryObject CertDuplicateCertificateContext CertCloseStore CertFindCertificateInStore CertGetNameStringW

msimg32

GradientFill

uxtheme

SetWindowTheme

wininet

InternetCrackUrlW HttpSendRequestW InternetCloseHandle InternetConnectW HttpQueryInfoW InternetQueryDataAvailable InternetReadFile HttpAddRequestHeadersW HttpOpenRequestW InternetOpenW

wintrust

WinVerifyTrust

gdi32

CreateRectRgnIndirect DPtoLP CreateFontIndirectW CreateSolidBrush DeleteObject GetObjectW DeleteDC GetDeviceCaps GetStockObject CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt ExtTextOutW FillRgn CombineRgn SetBkColor SetViewportOrgEx GetRegionData SetTextColor CreateRectRgn OffsetRgn GetTextMetricsW