wtsapi32[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

wtsapi32.dll
Size

278KB
MD5

bd4bdfe0371c5a2b85b0f8fd675039c0
SHA1

c8d18b3187d8849c6e0065ed2e3e6274848be885
SHA256

5c8862095a3b53bb16f03f5ee24dca833835a1b0fcab442fb87eff75c38e1693
SHA512

4deb5b1e2101c3037d40af6d6d4c08ccdf8403169d494d1b9698468f8a6ad5440009250eff72d1c4a593bf6713d51739b4f29761d481f1d73fa502dcbc55d591
SSDEEP

6144:CtfBBxdeYa+iIBZXY2OLYpHzAjDy0R8SuWtOiVSTrWjrm:SfnLaLIBZoBMtqLNnVSTrWjrm

Score

N/A

Malware Config

Signatures

Files

wtsapi32.dll
.dll windows x86

b6380e8147be266b66aa86935acd9914

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA

user32

OffsetRect

advapi32

RegisterEventSourceA

shlwapi

PathRemoveFileSpecW

shell32

SHGetDiskFreeSpaceExW

Exports

Exports

WTSCloseServer
WTSConnectSessionA
WTSConnectSessionW
WTSCreateListenerA
WTSCreateListenerW
WTSDisconnectSession
WTSEnumerateListenersA
WTSEnumerateListenersW
WTSEnumerateProcessesA
WTSEnumerateProcessesExA
WTSEnumerateProcessesExW
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSEnumerateServersW
WTSEnumerateSessionsA
WTSEnumerateSessionsExA
WTSEnumerateSessionsExW
WTSEnumerateSessionsW
WTSFreeMemory
WTSFreeMemoryExA
WTSFreeMemoryExW
WTSGetListenerSecurityA
WTSGetListenerSecurityW
WTSLogoffSession
WTSOpenServerA
WTSOpenServerExA
WTSOpenServerExW
WTSOpenServerW
WTSQueryListenerConfigA
WTSQueryListenerConfigW
WTSQuerySessionInformationA
WTSQuerySessionInformationW
WTSQueryUserConfigA
WTSQueryUserConfigW
WTSQueryUserToken
WTSRegisterSessionNotification
WTSRegisterSessionNotificationEx
WTSSendMessageA
WTSSendMessageW
WTSSetListenerSecurityA
WTSSetListenerSecurityW
WTSSetSessionInformationA
WTSSetSessionInformationW
WTSSetUserConfigA
WTSSetUserConfigW
WTSShutdownSystem
WTSStartRemoteControlSessionA
WTSStartRemoteControlSessionW
WTSStopRemoteControlSession
WTSTerminateProcess
WTSUnRegisterSessionNotification
WTSUnRegisterSessionNotificationEx
WTSVirtualChannelClose
WTSVirtualChannelOpen
WTSVirtualChannelOpenEx
WTSVirtualChannelPurgeInput
WTSVirtualChannelPurgeOutput
WTSVirtualChannelQuery
WTSVirtualChannelRead
WTSVirtualChannelWrite
WTSWaitSystemEvent

Sections

Size: - Virtual size: 104KB

IMAGE_SCN_MEM_READ

Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 94KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b6380e8147be266b66aa86935acd9914

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

Exports

Exports

Sections

Size: - Virtual size: 104KB

Size: 2KB - Virtual size: 4KB

Size: 512B - Virtual size: 4KB

Size: 512B - Virtual size: 4KB

Size: 94KB - Virtual size: 96KB