SHA256: 1a0fe20c1fd309f743b303d3b2691f9df808ab862c58ec2628d42f9c01e419e6
SHA1: e30921de97a18e2f84ee51b54554525f3d9af837
MD5: 7b33e2f4e7567e07d63474ba9ee51570
File size: 170.0 KB ( 174080 bytes )
File type: Win32 DLL
Detection ratio: 3 / 43
Analysis date: 2012-01-19 10:19:43 UTC ( 1 minute ago )
DrWeb BackDoor.Siggen.33484 20120119
NOD32 a variant of Win32/Corkow.A 20120119
VBA32 Trojan.FakeDll.1291 20120118
UninitializedDataSize....: 0
InitializedDataSize......: 125440
ImageVersion.............: 6.1
ProductName..............: Microsoft Windows Operating System
FileVersionNumber........: 6.1.7600.16385
LanguageCode.............: English (U.S.)
FileFlagsMask............: 0x003f
FileDescription..........: SPP Notification Service
CharacterSet.............: Unicode
LinkerVersion............: 9.0
FileOS...................: Windows NT 32-bit
MIMEType.................: application/octet-stream
Subsystem................: Windows command line
FileVersion..............: 6.1.7600.16385 (win7_rtm.090713-1255)
TimeStamp................: 2009:07:14 02:10:43+01:00
FileType.................: Win32 DLL
PEType...................: PE32
InternalName.............: sppuinotify.dll
ProductVersion...........: 6.1.7600.16385
SubsystemVersion.........: 6.0
OSVersion................: 6.1
OriginalFilename.........: sppuinotify.dll
LegalCopyright...........: Microsoft Corporation. All rights reserved.
MachineType..............: Intel 386 or later, and compatibles
CompanyName..............: Microsoft Corporation
CodeSize.................: 47616
FileSubtype..............: 0
ProductVersionNumber.....: 6.1.7600.16385
EntryPoint...............: 0x9dcb
ObjectFileType...........: Dynamic link library
publisher................: Microsoft Corporation
product..................: Microsoft_ Windows_ Operating System
internal name............: sppuinotify.dll
copyright................: © Microsoft Corporation. All rights reserved.
original name............: sppuinotify.dll
file version.............: 6.1.7600.16385 (win7_rtm.090713-1255)
description..............: SPP Notification Service
PE Sections...................:
Name Virtual Address Virtual Size Raw Size Entropy MD5
.text 4096 47275 47616 6.81 dbd3522880828685b766faef7ccd0f54
.data 53248 1668 512 0.42 12cad80fe04f94ac1e3c55e37187b5ca
.rsrc 57344 121480 121856 7.99 8b3cd9178593c8c99e118beff333c433
.reloc 180224 2836 3072 5.47 f58760f39bd614f65c3d2ef89ddf087c
PE Imports....................:
urlmon.dll
MkParseDisplayNameEx
KERNEL32.dll
RaiseException, GetCurrentThreadId, ReleaseSemaphore, Sleep, DisableThreadLibraryCalls, InterlockedExchange, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, CreateTimerQueue, HeapAlloc, GetProcessHeap, HeapFree, InterlockedCompareExchange, GetProcAddress, GetLastError, GetModuleHandleExW, GetSystemTime, SystemTimeToFileTime, VirtualProtect, EncodePointer, DecodePointer, DeleteCriticalSection, LocalFree, CloseHandle, UnregisterWaitEx, ChangeTimerQueueTimer, EnterCriticalSection, TryEnterCriticalSection, LeaveCriticalSection, VirtualQuery, DeleteTimerQueueTimer, VirtualAlloc, RegisterWaitForSingleObject, DeleteTimerQueueEx, InitializeCriticalSectionAndSpinCount, GetProductInfo, GetVersionExW, InterlockedDecrement, WaitForMultipleObjects, CreateTimerQueueTimer, SetEvent, LocalAlloc, LockResource, LoadResource, FindResourceExW, WaitForSingleObject
msvcrt.dll
_initterm, free, malloc, _amsg_exit, memmove, memcpy, _purecall, memset, _unlock, __dllonexit, _onexit, _lock, _except_handler4_common, _XcptFilter, _vsnwprintf
OLEAUT32.dll
-, -, -
ADVAPI32.dll
TraceMessage, RegisterServiceCtrlHandlerExW, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, SetServiceStatus, RegOpenKeyExW, RegCreateKeyExW, RegQueryValueExW, RegisterEventSourceW, ReportEventW, DeregisterEventSource, RegCloseKey
ole32.dll
CoRegisterClassObject, CoRevokeClassObject, CoDisconnectContext, CoCreateGuid, CreateBindCtx, StringFromGUID2, CoTaskMemAlloc, CoInitializeEx, CoUninitialize, CoTaskMemFree, CoCreateInstance
slc.dll
SLRegisterWindowsEvent, SLUnregisterWindowsEvent
WTSAPI32.dll
WTSFreeMemory, WTSEnumerateSessionsW, WTSQuerySessionInformationW
PE Exports....................:
D, l, l, G, e, t, C, l, a, s, s, O, b, j, e, c, t, ,, , S, e, r, v, i, c, e, M, a, i, n
Изменено: sunseterry - 19.01.2012 14:35:06
