oledlg[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
oledlg.dll.exe
Size 208KB
Sample261102-g9nqaatt2j
SHA256 c5f8f7ab6c11caed250a958a35a19cf1c2583113fb71817f6fd064c07e806c20
MD5 e547a94346ca67a146fa22e2f9c68587
SHA1 12751378b5b67c52efb41231ce92d264a5314087
SHA512 2e19ae687f37091f33d3090e927d7f99203a34ca296a7255ed5aae19c73f804aa122424cee4084287d6a4dbe51d5c55cc60c0b9566ac586336f275c41d34243b
SSDEEP 6144:5KE1eKGww8UsCLY1wx+b5UFfsM4T7tXOhX:5K4exLHY1k+UsM4ThOhX
TLSH
T1C024192E33BE20A6E86FC23C85464216EA73B4352311A6DB06D0C57D9F57EE97639F01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
oledlg.dll.exe

File Explorer

oledlg.dll.exe

.dll 208KB

oledlg.dll.exe

IMPHASH a5298af77eae9772ff5903c5760e539b
SHA256 c5f8f7ab6c11caed250a958a35a19cf1c2583113fb71817f6fd064c07e806c20
MD5 e547a94346ca67a146fa22e2f9c68587
SHA1 12751378b5b67c52efb41231ce92d264a5314087
SHA512 2e19ae687f37091f33d3090e927d7f99203a34ca296a7255ed5aae19c73f804aa122424cee4084287d6a4dbe51d5c55cc60c0b9566ac586336f275c41d34243b
SSDEEP 6144:5KE1eKGww8UsCLY1wx+b5UFfsM4T7tXOhX:5K4exLHY1k+UsM4ThOhX
TLSH
T1C024192E33BE20A6E86FC23C85464216EA73B4352311A6DB06D0C57D9F57EE97639F01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

159110

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

oledlg.pdb

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__purecall _o__register_onexit_function _o__resetstkoflw _o__seh_filter_dll _o__stricmp _o__wcsicmp memmove _o_free _o_iswalpha _o_malloc __C_specific_handler _o__execute_onexit_table _o__errno _o__crt_atexit _o__configure_narrow_argv _o__cexit _o__callnewh _o__invalid_parameter_noinfo _o__initialize_onexit_table _o__initialize_narrow_environment _o___stdio_common_vswprintf _o___std_type_info_destroy_list _o___std_exception_destroy _o___std_exception_copy wcschr __CxxFrameHandler3 _CxxThrowException memcmp memcpy

api-ms-win-crt-string-l1-1-0

wcsncmp memset

ntdll

EtwTraceMessage NtQuerySystemInformationEx EtwEventWriteTransfer RtlAllocateHeap RtlImageNtHeader NtQuerySecurityAttributesToken RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlFreeHeap

kernel32

VirtualQuery SetThreadStackGuarantee GetSystemInfo VirtualAlloc VirtualProtect GetProcessHeap DeleteCriticalSection AcquireSRWLockShared CreateMutexExW HeapAlloc CreateThreadpoolTimer ReleaseSRWLockShared SetThreadpoolTimer OpenSemaphoreW InitOnceBeginInitialize CreateSemaphoreExW HeapFree EnterCriticalSection ReleaseSemaphore LeaveCriticalSection InitializeCriticalSectionEx WaitForThreadpoolTimerCallbacks ReleaseMutex MulDiv GetFileType CreateFileW FindNextFileW ResetEvent CloseHandle CreateEventW WaitForSingleObject DebugBreak OutputDebugStringW GetLastError FormatMessageW GetModuleHandleExW SetLastError GetModuleFileNameA LoadLibraryExW FindResourceW LoadResource LockResource IsBadStringPtrW IsBadReadPtr IsBadCodePtr IsBadWritePtr GlobalSize GetDateFormatW GetSystemTime SystemTimeToFileTime GetTimeFormatW FileTimeToLocalFileTime GetNumberFormatW FileTimeToSystemTime LocalFileTimeToFileTime GetLocaleInfoW CompareFileTime GetProcAddress GetCurrentDirectoryW LoadLibraryW GetFileAttributesW GetFullPathNameW FindClose GetShortPathNameW SearchPathW FindFirstFileW CompareStringW GlobalUnlock FreeLibrary LocalFree GlobalLock GlobalFree GlobalAlloc GetVersion LocalAlloc WideCharToMultiByte MultiByteToWideChar TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter DisableThreadLibraryCalls ReleaseSRWLockExclusive CloseThreadpoolTimer GetCurrentThread InitOnceComplete WaitForSingleObjectEx AcquireSRWLockExclusive

user32

ReleaseDC DialogBoxParamW RegisterWindowMessageW CreateIcon SetWindowWord GetWindowWord CharLowerW SetCursor ShowCursor DefWindowProcW SetWindowLongPtrW UnregisterClassW GetWindowLongPtrW RegisterClassW LoadBitmapW LoadCursorW BeginPaint EndPaint GetWindowLongW DialogBoxIndirectParamW RegisterClipboardFormatW SetClipboardViewer ChangeClipboardChain GetForegroundWindow GetWindowTextLengthW IsWindowEnabled GetDlgItemInt SetDlgItemInt MessageBoxW GetWindowInfo CheckDlgButton SetWindowLongW GetFocus GetSystemMetrics DrawIcon DestroyIcon DrawFocusRect SetFocus DestroyWindow SetWindowPos CheckRadioButton CharPrevW MapWindowPoints GetDialogBaseUnits IsDlgButtonChecked GetClipboardFormatNameW UpdateWindow InvalidateRect EnableWindow GetWindowThreadProcessId GetLastActivePopup GetWindow IsWindowVisible GetDesktopWindow GetParent SetForegroundWindow IsIconic GetWindowTextW PostMessageW GetWindowRect GetMenu InflateRect GetDC GetPropW FillRect CreateWindowExW DeleteMenu ScreenToClient SendMessageW EndDialog RemovePropW SetWindowTextW CreatePopupMenu LoadStringW GetActiveWindow ShowWindow IsWindow DispatchMessageW SetTimer IsDialogMessageW PeekMessageW SetDlgItemTextW GetDlgItemTextW SendDlgItemMessageW GetSysColor DestroyMenu CharNextW SetPropW TranslateMessage LoadIconW DrawMenuBar InsertMenuW GetClientRect GetDlgItem KillTimer

gdi32

GetTextExtentPointW GetBkColor UnrealizeObject SetBrushOrgEx CreateBitmap SetMapMode RestoreDC EnumMetaFile BitBlt CreateCompatibleBitmap CreateCompatibleDC GetLayout GetDeviceCaps DeleteDC GetObjectW SelectObject GetStockObject GetTextMetricsW SetTextColor SetBkMode SetBkColor ExtTextOutW GetMetaFileBitsEx DeleteObject CreateSolidBrush CreateICW SetDIBits SaveDC PlayMetaFileRecord GetBitmapBits SetViewportExtEx SetViewportOrgEx PlayMetaFile

advapi32

RegEnumKeyExW RegLoadMUIStringW EventWriteTransfer RegQueryValueW RegNotifyChangeKeyValue EventRegister EventSetInformation RegOpenUserClassesRoot OpenProcessToken SetThreadToken RegOpenKeyExW RegGetValueW EventUnregister ConvertSidToStringSidW OpenThreadToken GetTokenInformation RegCloseKey

ole32

OleGetIconOfFile OleCreateFromFile GetClassFile OleMetafilePictFromIconAndLabel OleRegGetUserType CLSIDFromString CoGetTreatAsClass OleGetIconOfClass StringFromGUID2 OleDuplicateData OleCreateLinkToFile OleQueryLinkFromData OleGetClipboard ReleaseStgMedium CLSIDFromProgID CoCreateInstance IIDFromString OleQueryCreateFromData CoGetMalloc CoTaskMemFree CoTaskMemRealloc OleCreate

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString WindowsDeleteString WindowsGetStringRawBuffer WindowsCreateString

api-ms-win-core-wow64-l1-1-1

Wow64SetThreadDefaultGuestMachine

Name

.text

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.jv0

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

oledlg.dll.exe

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

kernel32

user32

gdi32

advapi32

ole32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-wow64-l1-1-1

generic