Microsoft[.]Terminal[.]Settings[.]Model[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Microsoft.Terminal.Settings.Model.dll
Size

2.2MB
MD5

936fe9bc58371dab9694552f0ee34ed1
SHA1

6546fa349223f101e14c1b3af1a6249ac9ccac63
SHA256

e73baeddb1d9985197bcab59193d70c9a406d3ed74d2b984d11a2a0ec6a92b29
SHA512

e70e6c2f87a913a360222409d17a753e808e213973480296326e8041d1bf94096d95aa1dcea207f5cd880b36e4b320a416728cf1c2c74d63acf0d21104990afe
SSDEEP

49152:ZwZtEGRsq5TcKU8okSNIXMsAqF9RZ5Zyk4Wc1bgGwU+27d2oY92Oivqd/tP3mGfy:u8A0gJF2N

Score

1^/10

Malware Config

Signatures

Files

Microsoft.Terminal.Settings.Model.dll
.dll windows:6 windows x64 arch:x64

47339aa88ad8634acd24102147dd359e

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:b9:81:4e:19:b9:ef:cd:f3:04:6a:52:05:bd:fd:0a:20:97:98:ca:75:4f:f8:82:9b:6d:66:9b:7d:36:a3:26
Signer

Actual PE Digest

e0:b9:81:4e:19:b9:ef:cd:f3:04:6a:52:05:bd:fd:0a:20:97:98:ca:75:4f:f8:82:9b:6d:66:9b:7d:36:a3:26

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\bin\x64\Release\Microsoft.Terminal.Settings.Model\Microsoft.Terminal.Settings.Model.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_errno
_initterm
_initterm_e
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
abort
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsncmp
strncmp
isupper
wcsnlen
__strncnt
tolower
isspace
strcspn
islower
iswspace
_wcsdup

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
__stdio_common_vswprintf
__stdio_common_vsprintf_s

kernel32

DisableThreadLibraryCalls
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
CreateEventExW
LCMapStringEx
InitializeCriticalSectionEx
SwitchToThread
Sleep
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
WakeAllConditionVariable
GetFileInformationByHandleEx
MoveFileExW
AreFileApisANSI
GetFinalPathNameByHandleW
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
GetLocaleInfoEx
GetStringTypeW
FormatMessageA
SetEvent
GetSystemDirectoryW
WriteFile
GetFileTime
ReadFile
GetFileSize
CreateFileW
GetModuleFileNameW
K32GetModuleFileNameExW
LocalFree
SearchPathW
ExpandEnvironmentStringsW
GetFileAttributesW
CompareStringOrdinal
VerifyVersionInfoW
VerSetConditionMask
SetThreadpoolTimerEx
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
DeleteFileW
MultiByteToWideChar
AcquireSRWLockShared
DecodePointer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitOnceExecuteOnce
ReleaseSRWLockShared

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlPcToFileHeader

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InterlockedPushEntrySList

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-errorhandling-l1-1-0

RaiseException

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-processthreads-l1-1-0

TlsFree
TlsSetValue
TlsAlloc
TlsGetValue

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW

api-ms-win-crt-heap-l1-1-0

calloc
_callnewh
free
malloc

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
strtof
wcstol
strtod

api-ms-win-crt-locale-l1-1-0

_unlock_locales
_lock_locales
setlocale
___lc_locale_name_func
___lc_codepage_func
___mb_cur_max_func
localeconv
__pctype_func

api-ms-win-crt-math-l1-1-0

_fdsign
frexp
modf
_dsign
_ldclass
ceilf
round
_fdclass
_dclass
_ldsign

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoGetApartmentType
CoGetObjectContext

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegOpenCurrentUser
RegCloseKey

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetKnownFolderPath

api-ms-win-security-provider-l1-1-0

GetSecurityInfo

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

api-ms-win-security-base-l1-1-0

EqualSid
CheckTokenMembership

api-ms-win-ntuser-sysparams-l1-1-0

SystemParametersInfoW

oleaut32

SysStringLen
VariantInit
SysAllocString
SetErrorInfo
GetErrorInfo
SysFreeString
VariantClear

user32

DestroyIcon
MapVirtualKeyW
VkKeyScanW

shell32

ord6

ole32

CoInitializeEx
CoWaitForMultipleHandles
CoUninitialize
CoCreateFreeThreadedMarshaler
IIDFromString
StringFromCLSID

bcrypt

BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-registry-l2-1-0

RegOpenKeyW
RegCreateKeyW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 740KB - Virtual size: 740KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47339aa88ad8634acd24102147dd359e

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:afCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

e0:b9:81:4e:19:b9:ef:cd:f3:04:6a:52:05:bd:fd:0a:20:97:98:ca:75:4f:f8:82:9b:6d:66:9b:7d:36:a3:26Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

kernel32

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-registry-l1-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

oleaut32

user32

shell32

ole32

bcrypt

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-threadpool-l1-2-0

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 740KB - Virtual size: 740KB

.data Size: 8KB - Virtual size: 32KB

.pdata Size: 117KB - Virtual size: 116KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 16KB

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

e0:b9:81:4e:19:b9:ef:cd:f3:04:6a:52:05:bd:fd:0a:20:97:98:ca:75:4f:f8:82:9b:6d:66:9b:7d:36:a3:26
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 740KB - Virtual size: 740KB

.data
Size: 8KB - Virtual size: 32KB

.pdata
Size: 117KB - Virtual size: 116KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 16KB