izenstrmapi[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

izenstrmapi.dll
Size

1.9MB
MD5

386a6edeb3e0bbeec8a8946f7ee93653
SHA1

d7add3f5125c10c509674b3b59713ec019c98a5a
SHA256

6f1cf272ec6410cc967513fb26d722422e075ef4a6bd76a18b195614dcdaf2af
SHA512

d1d0e04e26e8e357daba5686c5600c0b9b2802b0a2fa9d754a1d308cd968e3af74355a481f5f964f5b0e3d780625f4523ef0fddef6cad9260b5a961bac9eb7f1
SSDEEP

49152:GrN/APdBuusxqqm7RwioTtpNImKTTTtTkDzjhy:k/nUqm7xoePTTT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
izenstrmapi.dll

Files

izenstrmapi.dll
.dll windows:4 windows x86

a24745521ac62c248ff14d46824feb02

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

timeGetTime

ws2_32

WSASetLastError
getservbyport
gethostbyaddr
getservbyname
inet_ntoa
gethostbyname
WSAGetLastError
inet_addr
htons
htonl
ntohl
ntohs
ioctlsocket
socket
getsockopt
__WSAFDIsSet
setsockopt
gethostname
WSAStartup
WSACleanup
accept
connect
bind
listen
closesocket
shutdown
send
recv
sendto
recvfrom
select
getsockname
getpeername

iphlpapi

GetIpAddrTable
GetAdaptersInfo

kernel32

FindFirstFileW
FindClose
FindNextFileW
VirtualAlloc
CreateDirectoryW
Sleep
GetLastError
InterlockedIncrement
InterlockedDecrement
GetACP
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
ResumeThread
WaitForSingleObject
GetCurrentThreadId
CreateEventA
GetProcAddress
FreeLibrary
LoadLibraryA
GetSystemDirectoryA
SystemTimeToTzSpecificLocalTime
GetSystemTime
GetTimeZoneInformation
GetCurrentProcessId
GetModuleFileNameA
GetFileAttributesA
DeleteFileA
MoveFileA
CreateDirectoryA
RemoveDirectoryA
GetFullPathNameA
GetModuleHandleA
GetDiskFreeSpaceExA
CreateFileA
CreateMutexA
SetLastError
GetVersionExA
OpenMutexA
CreateMailslotA
WriteFile
GetMailslotInfo
ReadFile
InterlockedCompareExchange
InterlockedExchange
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetSystemTimeAsFileTime
ExitThread
CreateThread
LCMapStringA
LCMapStringW
GetCPInfo
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetOEMCP
IsValidCodePage
HeapSize
FatalAppExitA
RemoveDirectoryW
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateEventW
CreateMutexW
ReleaseMutex
WaitForMultipleObjects
SetThreadPriority
GetExitCodeThread
GetExitCodeProcess
GetProcessTimes
CreateProcessW
DuplicateHandle
GetStartupInfoW
OpenProcess
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
GetEnvironmentVariableW
SetEnvironmentVariableW
GetVersionExW
GetSystemInfo
GetComputerNameW
CreateFileW
CreatePipe
GetCurrentDirectoryW
GetLongPathNameW
GetTempPathW
ExpandEnvironmentStringsW
GetLogicalDriveStringsW
GetFileAttributesW
GetFileAttributesExW
SetFileTime
SetFileAttributesW
CopyFileW
MoveFileW
DeleteFileW

winspool.drv

EnumPortsA
ClosePrinter
XcvDataW
OpenPrinterA
EnumPrintersA

advapi32

RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueA
RegSetValueExA

shell32

SHGetSpecialFolderPathA
ShellExecuteA

ole32

CoCreateInstance
CoUninitialize
PropVariantClear
CoInitializeEx

Exports

Exports

ENCreateDeviceHandle
ENCreateMIMEUtil
ENCreateStream
ENDeleteBuffer
ENDeleteDeviceHandle
ENDeleteMIMEUtil
ENDeleteStream
ENGetDeviceCapability
ENGetDeviceHandleSetting
ENGetRecvDataSize
ENGetRecvStatus
ENInitialize
ENMIMEAdd
ENMIMEClear
ENMIMEDecode
ENMIMEDelete
ENMIMEDeleteBuffer
ENMIMEEncode
ENMIMEGetCount
ENMIMEGetData
ENMIMEGetIDName
ENMIMEJoinData
ENMIMESplitData
ENProbe
ENRecvCancel
ENRecvStream
ENSendRecvStream
ENSendStream
ENSetDeviceHandleSetting
ENSetProbeMode
ENStopProbe
ENTerminate

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a24745521ac62c248ff14d46824feb02

Headers

DLL Characteristics

File Characteristics

Imports

winmm

ws2_32

iphlpapi

kernel32

winspool.drv

advapi32

shell32

ole32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 264KB - Virtual size: 260KB

.data Size: 128KB - Virtual size: 138KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 80KB - Virtual size: 77KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 264KB - Virtual size: 260KB

.data
Size: 128KB - Virtual size: 138KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 80KB - Virtual size: 77KB