Microsoft[.]Terminal[.]Control[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

Microsoft.Terminal.Control.dll
Size

2.0MB
MD5

2af7322017ba47fc7ec73b6d770621a7
SHA1

5d3276b53d69f29c43d4ba53d5290b908ded9b9f
SHA256

810a9b16695ae1f37b7a47fd64a1151251d495bdccd85f945437e8ba9d0b8ce1
SHA512

acf97e1561e3369c9c6befcf2c7810c9de86e02f1f9a6a2dcca653b9674054e6aa5f2968e5340ff44997617f360faf3db46306167a2c2d948352517e69ca7dd2
SSDEEP

49152:Dsy+rDjI9N/+gz6jp1qX3SkmsM8TelEd7tzSu+zoTDCzcw+Vsd5g23oEdsiYiMiJ:fMjMNw/Nx

Score

1^/10

Malware Config

Signatures

Files

Microsoft.Terminal.Control.dll
.dll windows:6 windows x64 arch:x64

d4e12c833e9ff35d6c4c79e8f4c42cb6

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-11-2023 19:09

Not After

14-11-2024 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:b7:7b:fc:6f:a9:18:f4:99:bf:67:c3:ae:48:b1:c9:a0:54:0e:38:3e:82:d1:ff:8a:8c:02:38:5a:bf:1a:95
Signer

Actual PE Digest

83:b7:7b:fc:6f:a9:18:f4:99:bf:67:c3:ae:48:b1:c9:a0:54:0e:38:3e:82:d1:ff:8a:8c:02:38:5a:bf:1a:95

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\bin\x64\Release\Microsoft.Terminal.Control\Microsoft.Terminal.Control.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
abort
_errno
_invalid_parameter_noinfo_noreturn
_initterm
_initterm_e
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit

api-ms-win-crt-string-l1-1-0

_wcsdup
towlower
strcspn
islower
iswspace
wcsncmp
__strncnt
isupper
wcsnlen
strcpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vsnprintf_s

kernel32

VerifyVersionInfoW
SetThreadpoolTimerEx
DisableThreadLibraryCalls
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
VerSetConditionMask
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
VirtualAlloc
VirtualFree
SwitchToThread
CompareStringEx
LCMapStringEx
DecodePointer
AreFileApisANSI
SignalObjectAndWait
FindNextFileW
CreateEventW
CreateThread
FindFirstFileExW
LoadLibraryExA
VirtualQuery
SetUnhandledExceptionFilter
GetStringTypeW
FindClose
QueryUnbiasedInterruptTime
VirtualProtect
GetSystemInfo
ResetEvent
GetLocaleInfoEx
LocalFree
DuplicateHandle
SetEvent
FormatMessageA
MultiByteToWideChar
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceFrequency
InitializeCriticalSectionEx
InitOnceExecuteOnce
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
Sleep
CreateFileW
GetFileSize
ReadFile
GetModuleFileNameW
K32GetModuleFileNameExW
GetUserDefaultLocaleName

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlPcToFileHeader

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InterlockedPushEntrySList

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-errorhandling-l1-1-0

RaiseException

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount

api-ms-win-core-processthreads-l1-1-0

TlsAlloc
TlsSetValue
TlsFree
TlsGetValue

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary

api-ms-win-crt-heap-l1-1-0

_aligned_free
free
realloc
malloc
_aligned_malloc
_callnewh
calloc

api-ms-win-crt-convert-l1-1-0

wcstof
wcstol
wcstod

icu

uregex_open
uregex_close
utext_setup
uregex_start64
uregex_setTimeLimit
uregex_setStackLimit
uregex_findNext
uregex_find
uregex_setUText
uregex_end64
uregex_clone

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress

ext-ms-win-uiacore-l1-1-0

UiaHostProviderFromHwnd
UiaReturnRawElementProvider

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoGetObjectContext
CoGetApartmentType

oleaut32

SafeArrayCreateVector
SafeArrayDestroy
SafeArrayGetDim
SysAllocString
SafeArrayGetLBound
SysFreeString
SafeArrayGetUBound
VariantClear
SysStringLen
SafeArrayAccessData
VariantInit
GetErrorInfo
SetErrorInfo
SafeArrayPutElement

ext-ms-win-uiacore-l1-1-1

UiaRaiseAutomationEvent
UiaGetReservedMixedAttributeValue
UiaGetReservedNotSupportedValue

user32

DefWindowProcW
GetWindowLongPtrW
SetCapture
ReleaseCapture
GetClassInfoW
VkKeyScanW
RegisterClassW
CreateWindowExW
GetWindowRect
SetWindowLongPtrW
DestroyWindow
SetWindowPos
ScreenToClient
CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
RegisterClipboardFormatW
GetClipboardData
GetKeyState
GetDoubleClickTime
MapVirtualKeyW
GetSystemMetricsForDpi
ToUnicodeEx
GetKeyboardState
GetCaretBlinkTime
PostMessageW
IsRectEmpty
LoadCursorW
GetClientRect

api-ms-win-crt-math-l1-1-0

ceilf
_dclass
_ldclass
_fdclass
round
lround
frexp
_fdsign
_dsign
floor
floorf
_ldsign
lroundf
powf
log10
lrint
lrintf
pow
roundf

api-ms-win-crt-locale-l1-1-0

localeconv
_unlock_locales
__pctype_func
___lc_collate_cp_func
_lock_locales
setlocale
___lc_codepage_func
___lc_locale_name_func
___mb_cur_max_func

d2d1

ord1

dwrite

DWriteCreateFactory

d3dcompiler_47

D3DCompileFromFile
D3DReflect
D3DCompile

dxgi

CreateDXGIFactory2
CreateDXGIFactory1

d3d11

D3D11CreateDevice

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull

api-ms-win-ntuser-sysparams-l1-1-0

SystemParametersInfoW

shell32

DragQueryFileW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback

Exports

Exports

CreateTerminal
DestroyTerminal
DllCanUnloadNow
DllGetActivationFactory
TerminalBlinkCursor
TerminalCalculateResize
TerminalClearSelection
TerminalDpiChanged
TerminalGetSelection
TerminalIsSelectionActive
TerminalKillFocus
TerminalRegisterScrollCallback
TerminalRegisterWriteCallback
TerminalSendCharEvent
TerminalSendKeyEvent
TerminalSendOutput
TerminalSetCursorVisible
TerminalSetFocus
TerminalSetTheme
TerminalTriggerResize
TerminalTriggerResizeWithDimension
TerminalUserScroll

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 626KB - Virtual size: 625KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d4e12c833e9ff35d6c4c79e8f4c42cb6

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:afCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

83:b7:7b:fc:6f:a9:18:f4:99:bf:67:c3:ae:48:b1:c9:a0:54:0e:38:3e:82:d1:ff:8a:8c:02:38:5a:bf:1a:95Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

kernel32

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

icu

api-ms-win-core-synch-l1-2-0

ext-ms-win-uiacore-l1-1-0

api-ms-win-core-com-l1-1-0

oleaut32

ext-ms-win-uiacore-l1-1-1

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

d2d1

dwrite

d3dcompiler_47

dxgi

d3d11

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

shell32

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-threadpool-l1-2-0

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 626KB - Virtual size: 625KB

.data Size: 14KB - Virtual size: 21KB

.pdata Size: 105KB - Virtual size: 105KB

.didat Size: 512B - Virtual size: 16B

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 11KB - Virtual size: 10KB

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

83:b7:7b:fc:6f:a9:18:f4:99:bf:67:c3:ae:48:b1:c9:a0:54:0e:38:3e:82:d1:ff:8a:8c:02:38:5a:bf:1a:95
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 626KB - Virtual size: 625KB

.data
Size: 14KB - Virtual size: 21KB

.pdata
Size: 105KB - Virtual size: 105KB

.didat
Size: 512B - Virtual size: 16B

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 11KB - Virtual size: 10KB