7ffb98f70000[.]uxtheme[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

7ffb98f70000.uxtheme.dll
Size

624KB
MD5

98cdb53d949c4f601ff2941f54121bcb
SHA1

28523d873e1f0de53b637ed37be55d75011d7d9f
SHA256

a4597b579d6dcf504084af076a292bae261d79bc59afbf0034561ea1bcd521ee
SHA512

36340299e792ccdff8caabd9560adb04f5c301223ee68c7e44f49ccbbe14d85b70bcbe2cc44b7d09e49b0240a08bb9ba245420e1fe1560e49eae57302ee127ce
SSDEEP

12288:bkJOCWeVxQHD3Jvz97z60cLnWCuqJ1QJTf4tn1KaFBN:f3UQj3x97e3nWCNQKp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ffb98f70000.uxtheme.dll

Files

7ffb98f70000.uxtheme.dll
.dll windows x64

c5a0a96cf2b36e7766a841c435b44e97

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_vsnwprintf
floor
cos
atan
memcmp
fmodf
memcpy
memmove
rand_s
memset
fwprintf
fflush
pow
?terminate@@YAXXZ
sqrt
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
__C_specific_handler
wcstol
memmove_s
_wsplitpath_s
_wtof
wcschr
free
_purecall
rand
memcpy_s
fputws

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameW
LockResource
GetProcAddress
GetModuleHandleExW
FreeLibraryAndExitThread
LoadLibraryExW
LoadStringW
GetModuleFileNameA
FindResourceExW
LoadResource
FreeLibrary
DisableThreadLibraryCalls
SizeofResource

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
CreateSemaphoreExW
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
InitializeCriticalSectionEx
CreateMutexExW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
InitializeCriticalSection
ReleaseMutex
CreateMutexW
InitializeSRWLock
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapDestroy
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentProcess
GetCurrentProcessId
SetThreadToken
CreateThread
TlsFree
TerminateProcess
GetCurrentThreadId
TlsAlloc
TlsSetValue
TlsGetValue

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetACP

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l1-1-0

GetFileTime
ReadFile
GetFullPathNameW
GetFileSize
CreateFileW
FindClose
SetFilePointer
FindFirstFileW
FindNextFileW
GetFileAttributesW

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal
MultiByteToWideChar
GetStringTypeW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegGetValueW
RegQueryValueExW
RegOpenCurrentUser
RegOpenKeyExW

api-ms-win-security-base-l1-1-0

GetLengthSid
RevertToSelf
SetKernelObjectSecurity
CheckTokenMembership
GetTokenInformation
IsValidSid
ImpersonateLoggedOnUser
CopySid

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
InitOnceComplete
Sleep

api-ms-win-core-memory-l1-1-0

VirtualFree
CreateFileMappingW
VirtualAlloc
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-sidebyside-l1-1-0

CreateActCtxW
DeactivateActCtx
ReleaseActCtx
ActivateActCtx

api-ms-win-core-atoms-l1-1-0

DeleteAtom
GetAtomNameW
AddAtomW

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiW
lstrcmpW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRStrIW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

ntdll

wcstok_s
strchr
SbSelectProcedure
wcsspn
wcstoul
NtCreateSection
NtOpenSection
NtClose
NtConnectPort
RtlInitUnicodeString
NtRequestWaitReplyPort
RtlInitializeCriticalSection
RtlGetThreadLangIdByIndex
EtwEventSetInformation
EtwEventUnregister
EtwEventRegister
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlInitializeSRWLock
EtwEventWriteTransfer
bsearch_s

gdi32

CreatePen
CreateDIBitmap
SelectObject
GetClipRgn
CreateRectRgn
IntersectClipRect
CreateSolidBrush
GetStockObject
Rectangle
RoundRect
BeginPath
EndPath
Ellipse
SelectClipPath
BitBlt
SelectClipRgn
SetBkColor
ExtTextOutW
GetBkColor
PathToRegion
GetObjectType
ExcludeClipRect
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
GetDCDpiScaleValue
CreateDPIScaledDIBSection
CreateDIBSection
DeleteDC
GetLayout
GetRandomRgn
LPtoDP
OffsetRgn
GetDeviceCaps
GdiFlush
SetViewportOrgEx
SetWindowOrgEx
CreateRectRgnIndirect
GdiAlphaBlend
SetStretchBltMode
StretchBlt
CreateFontIndirectW
PtInRegion
GdiGradientFill
Arc
SetLayout
GetRegionData
GdiDrawStream
SetTextColor
SetBkMode
GetRgnBox
GetCurrentObject
GetWindowOrgEx
GetViewportOrgEx
SetBitmapAttributes
SetTextAlign
GetTextAlign
GetDIBits
CreatePatternBrush
RectVisible
GetClipBox
SetBrushOrgEx
SetDIBits
ExtCreateRegion
CombineRgn
ExtCreatePen
AbortPath
StrokeAndFillPath
GetTextMetricsW
PatBlt
GdiTransparentBlt
SetBoundsRect
GetBoundsRect
CreateSessionMappedDIBSection
ClearBitmapAttributes
DeleteObject

user32

TrackMouseEvent
CallWindowProcW
SetWindowLongW
SetWindowLongPtrW
GetWindowLongW
DefWindowProcW
GetDCEx
IsChild
GetWindowThreadProcessId
PostMessageW
ord2525
ord2527
GetDesktopWindow
ReleaseDC
GetDC
SetSysColors
SetProcessDPIAware
GetClassNameW
EnumDesktopsW
CloseDesktop
EnumDesktopWindows
OpenDesktopW
EnumChildWindows
GetWindow
RemovePropW
SetPropW
ord2705
SetWindowPos
ord2703
IsTopLevelWindow
GetSysColor
SystemParametersInfoW
SendNotifyMessageW
GetPropW
InflateRect
DrawTextW
DrawTextExW
GetGUIThreadInfo
GetUserObjectInformationW
GetProcessWindowStation
CopyRect
GetSystemMetrics
PtInRect
WindowFromDC
RedrawWindow
KillTimer
SetTimer
EqualRect
OffsetRect
MapWindowPoints
GetWindowRect
IsRectEmpty
IntersectRect
SetRect
FillRect
IsWindow
IsThreadDesktopComposited
GetClassLongW
GetClientRect
GetSystemMetricsForDpi
GetAncestor
SendMessageW
MonitorFromWindow
GetMonitorInfoW
IsZoomed
GetTitleBarInfo
GetSystemMenu
GetMenuItemInfoW
GetIconInfo
CreateIconIndirect
GetWindowLongPtrW
GetParent
GetWindowInfo
IsIconic
GetForegroundWindow
GetWindowRgnBox
InvalidateRect
IsWindowInDestroy
SetWindowRgn
SetRectEmpty
CalcMenuBar
InternalGetWindowText
GetWindowTextW
GetWindowDC
LoadIconW
DestroyIcon
SetCapture
MsgWaitForMultipleObjectsEx
PeekMessageW
ReleaseCapture
DispatchMessageW
GetCapture
ClientToScreen
DrawEdge
DrawIconEx
IsWindowVisible
IsWindowRedirectedForPrint
PaintMenuBar
GetSysColorBrush
ValidateRect
DefFrameProcW
IsServerSideWindow
MonitorFromRect
GetMessagePos
GetKeyState
GetMenuBarInfo
GetMenuItemCount
DrawMenuBar
ord2707
GetDpiForSystem
SetMenuItemInfoW
CopyImage
RegisterUserApiHook
ord2708
SystemParametersInfoA
SystemParametersInfoForDpi
AdjustWindowRectEx
GetWindowPlacement
FindWindowW
GetShellWindow
SetWindowsHookExW
UnhookWindowsHookEx
AllowSetForegroundWindow
CallNextHookEx
IsMenu
GetMenuInfo
SendMessageTimeoutW
GetClassLongPtrW
GetThreadDesktop
IsProcessDPIAware
EnumDisplayDevicesW
EnumDisplaySettingsW
ord2706
GetDpiForMonitorInternal
ord2711
EnumDisplayMonitors
DisplayConfigGetDeviceInfo

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

BeginBufferedAnimation
BeginBufferedPaint
BeginPanningFeedback
BufferedPaintClear
BufferedPaintInit
BufferedPaintRenderAnimation
BufferedPaintSetAlpha
BufferedPaintStopAllAnimations
BufferedPaintUnInit
CloseThemeData
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DrawThemeBackground
DrawThemeBackgroundEx
DrawThemeEdge
DrawThemeIcon
DrawThemeParentBackground
DrawThemeParentBackgroundEx
DrawThemeText
DrawThemeTextEx
EnableThemeDialogTexture
EnableTheming
EndBufferedAnimation
EndBufferedPaint
EndPanningFeedback
GetBufferedPaintBits
GetBufferedPaintDC
GetBufferedPaintTargetDC
GetBufferedPaintTargetRect
GetColorFromPreference
GetCurrentThemeName
GetImmersiveColorFromColorSetEx
GetImmersiveUserColorSetPreference
GetThemeAnimationProperty
GetThemeAnimationTransform
GetThemeAppProperties
GetThemeBackgroundContentRect
GetThemeBackgroundExtent
GetThemeBackgroundRegion
GetThemeBitmap
GetThemeBool
GetThemeColor
GetThemeDocumentationProperty
GetThemeEnumValue
GetThemeFilename
GetThemeFont
GetThemeInt
GetThemeIntList
GetThemeMargins
GetThemeMetric
GetThemePartSize
GetThemePosition
GetThemePropertyOrigin
GetThemeRect
GetThemeStream
GetThemeString
GetThemeSysBool
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysFont
GetThemeSysInt
GetThemeSysSize
GetThemeSysString
GetThemeTextExtent
GetThemeTextMetrics
GetThemeTimingFunction
GetThemeTransitionDuration
GetUserColorPreference
GetWindowTheme
HitTestThemeBackground
IsAppThemed
IsCompositionActive
IsThemeActive
IsThemeBackgroundPartiallyTransparent
IsThemeDialogTextureEnabled
IsThemePartDefined
OpenThemeData
OpenThemeDataEx
OpenThemeDataForDpi
SetThemeAppProperties
SetWindowTheme
SetWindowThemeAttribute
ThemeInitApiHook
UpdatePanningFeedback

Sections

.text
Size: 360KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5a0a96cf2b36e7766a841c435b44e97

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

ntdll

gdi32

user32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 360KB - Virtual size: 360KB

.rdata Size: 204KB - Virtual size: 204KB

.data Size: 12KB - Virtual size: 12KB

.pdata Size: 28KB - Virtual size: 28KB

.didat Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 360KB - Virtual size: 360KB

.rdata
Size: 204KB - Virtual size: 204KB

.data
Size: 12KB - Virtual size: 12KB

.pdata
Size: 28KB - Virtual size: 28KB

.didat
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 8KB