vaultcli[.]dll_E31BA6FAB776E7F917A5B4FD54853F70[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

vaultcli.dll_E31BA6FAB776E7F917A5B4FD54853F70.zip
Size

122KB
MD5

91d0c8616bb75dbe6776eec63d141644
SHA1

6e2bd29984aeccd57108b94b70323b0a16815645
SHA256

ef80de14e031b15d802568237435f9c5b6aa300205d0e42f9b813b09d7cd0a98
SHA512

88fd00f6e643a719978e28aef7c6456fff941ddaa67864ac648841934906c772df1cf0459c4ba1d49fdba70ffda0c6c52009e7db7b68da69a1e965e20324a08c
SSDEEP

3072:TOfdP6lMVGkpbeaYWYh45AJWelojHnX4IuaG+AkSx2o3/:SVCq0QNYWYh1JB63JuasWov

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/vaultcli.dll

Files

vaultcli.dll_E31BA6FAB776E7F917A5B4FD54853F70.zip
.zip

Password: infected
vaultcli.dll
.dll windows:10 windows x64 arch:x64

Password: infected

d74c340a21d3a0792e913ba12f081859

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

vaultcli.pdb

Imports

msvcrt

__dllonexit
_unlock
memcmp
_vsnwprintf
memcpy_s
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
realloc
memmove_s
wcsncmp
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
??1type_info@@UEAA@XZ
??_V@YAXPEAX@Z
__CxxFrameHandler3
?terminate@@YAXXZ
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
??3@YAXPEAX@Z
__C_specific_handler
_onexit
_lock
memset

rpcrt4

NdrStubCall3
NdrClientCall3
RpcBindingUnbind
RpcBindingFree
CStdStubBuffer_IsIIDSupported
NdrCStdStubBuffer2_Release
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
NdrDllGetClassObject
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
RpcBindingCreateW
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
RpcBindingBind
I_RpcExceptionFilter
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrDllCanUnloadNow

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc
HeapSize

api-ms-win-service-management-l1-1-0

CloseServiceHandle
StartServiceW
OpenSCManagerW
OpenServiceW

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
InitOnceBeginInitialize
InitOnceExecuteOnce

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceEnableFlags
GetTraceLoggerHandle

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventActivityIdControl
EventRegister
EventUnregister

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
CreateSemaphoreExW
InitializeSRWLock
ReleaseSemaphore
CreateMutexExW
WaitForSingleObjectEx
WaitForSingleObject
OpenSemaphoreW
AcquireSRWLockShared
ReleaseSRWLockShared

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringLen
WindowsCreateStringReference
HSTRING_UserUnmarshal64
WindowsCompareStringOrdinal
HSTRING_UserFree64
HSTRING_UserUnmarshal
HSTRING_UserMarshal64
HSTRING_UserMarshal
HSTRING_UserFree
WindowsDeleteString
WindowsDuplicateString
WindowsIsStringEmpty
HSTRING_UserSize64
WindowsCreateString
WindowsGetStringRawBuffer
HSTRING_UserSize
WindowsStringHasEmbeddedNull

api-ms-win-core-com-l1-1-0

CoReleaseMarshalData
CoGetCallContext
CoMarshalInterface
CoIncrementMTAUsage
CoTaskMemFree
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoSetProxyBlanket
CoTaskMemAlloc
CreateStreamOnHGlobal
CoDecrementMTAUsage

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo
RoTransformError

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
GetCurrentThread
SetThreadToken
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

bcrypt

BCryptGenRandom

api-ms-win-security-base-l1-1-0

DuplicateToken
RevertToSelf
GetTokenInformation

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
LoadStringW

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-security-base-l1-2-0

CheckTokenCapability

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient15
CStdStubBuffer2_Disconnect
ObjectStublessClient7
CStdStubBuffer2_Connect
ObjectStublessClient11
NdrProxyForwardingFunction3
ObjectStublessClient16
CStdStubBuffer2_QueryInterface
ObjectStublessClient12
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient9
NdrProxyForwardingFunction4
CStdStubBuffer2_CountRefs
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
CloseThreadpool
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpool

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoActivateInstance
RoGetActivationFactory
RoUninitialize

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
VaultAddItem
VaultCloseVault
VaultCreateItemType
VaultDeleteItemType
VaultEnumerateItemTypes
VaultEnumerateItems
VaultEnumerateVaults
VaultFindItems
VaultFree
VaultGetInformation
VaultGetItem
VaultGetItemType
VaultOpenVault
VaultRemoveItem

Sections

.text
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

d74c340a21d3a0792e913ba12f081859

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

api-ms-win-core-heap-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

bcrypt

api-ms-win-security-base-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-winrt-propertysetprivate-l1-1-1

Exports

Exports

Sections

.text Size: 190KB - Virtual size: 190KB

.rdata Size: 98KB - Virtual size: 98KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 12KB - Virtual size: 11KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 190KB - Virtual size: 190KB

.rdata
Size: 98KB - Virtual size: 98KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 7KB