es[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

es.dll
Size

327KB
MD5

5e16ec414402e68b01f9ce8c3b63cd96
SHA1

fc58556e771120f3da2b87a08b4ebcf07e2d8b56
SHA256

5280491261486d0522d5e7cc22189f6e7c3049c17305d7df5dbcc8f7250ff67d
SHA512

430cbdbf2cb9b7d6fa8f90e4d020b77fa840d01c129f32597d3122607b713c9b54daf377ed1b96fc0353c418e8634d77c4abe0826f4cdfb96e673048c9072dc1
SSDEEP

6144:wFyqFbxNUE50FpFLyCg+GhD/DUgdsN3yEv2OIf/Ds34hOkYeNB:2Shu+GhD7Q2RA34hOkXP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
es.dll

Files

es.dll
.dll windows:10 windows x86 arch:x86

f34568e7f5e109a05a5e0d1d01eb4716

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ES.pdb

Imports

msvcrt

iswalnum
_wcsnicmp
_beginthreadex
_vsnprintf
_vsnwprintf
iswdigit
iswalpha
_wcsicmp
__CxxFrameHandler3
_purecall
_resetstkoflw
free
_waccess
malloc
wcsstr
wcsrchr
towupper
wcsncmp
_XcptFilter
_amsg_exit
_initterm
_except_handler4_common
_lock
_unlock
__dllonexit
_onexit
wcscpy_s
memcpy
memcmp
_local_unwind4
_ftol2_sse
_CIsqrt
_CIexp
_ultow
?terminate@@YAXXZ
_itow_s
memset

ntdll

RtlAllocateHeap
RtlDelete
RtlImageNtHeader
RtlDllShutdownInProgress
RtlDeleteCriticalSection
RtlInitializeCriticalSectionAndSpinCount
RtlCreateServiceSid
RtlSplay
NtQueryEvent
RtlNtStatusToDosError
RtlInitUnicodeString
NtOpenEvent
RtlApplicationVerifierStop
RtlFreeHeap

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
ResetEvent
DeleteCriticalSection
CreateEventW
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
InitializeCriticalSection
SetEvent

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
SetThreadStackGuarantee
SetThreadToken
CreateThread
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
CreateProcessW
SetThreadPriority
TerminateProcess
GetExitCodeProcess
GetCurrentProcessId
OpenProcessToken

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID
FormatMessageW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
GlobalAlloc
GlobalFree

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
LockResource
LoadLibraryExW
FindResourceExW
LoadResource
LoadStringW
FreeLibrary
GetModuleFileNameW
FreeLibraryAndExitThread

api-ms-win-core-file-l1-1-0

GetFileAttributesW
DeleteFileW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateDirectoryW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegGetValueW
RegLoadKeyW
RegNotifyChangeKeyValue
RegUnLoadKeyW
RegSetValueExW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegDeleteTreeW
RegQueryValueExW
RegEnumKeyExW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorDacl
CheckTokenMembership
FreeSid
AdjustTokenPrivileges
AllocateAndInitializeSid
EqualSid
GetTokenInformation
GetLengthSid

rpcrt4

IUnknown_QueryInterface_Proxy
I_RpcBindingInqLocalClientPID
I_RpcBindingInqTransportType
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrStubForwardingFunction
CStdStubBuffer_IsIIDSupported
NdrStubCall2
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Disconnect
NdrOleFree
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
I_RpcOpenClientProcess
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
SearchPathW

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient26
ObjectStublessClient17
ObjectStublessClient19
ObjectStublessClient10
ObjectStublessClient16
ObjectStublessClient5
ObjectStublessClient13
ObjectStublessClient7
CStdStubBuffer2_Disconnect
NdrProxyForwardingFunction6
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient28
ObjectStublessClient18
ObjectStublessClient27
ObjectStublessClient3
ObjectStublessClient22
ObjectStublessClient21
NdrProxyForwardingFunction3
CStdStubBuffer2_CountRefs
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient12
NdrProxyForwardingFunction10
CStdStubBuffer2_Connect
ObjectStublessClient24
ObjectStublessClient4
ObjectStublessClient25
NdrProxyForwardingFunction8
NdrProxyForwardingFunction11
NdrProxyForwardingFunction9
NdrProxyForwardingFunction12
NdrProxyForwardingFunction7
ObjectStublessClient9
CStdStubBuffer2_QueryInterface

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer
CreateTimerQueueTimer
UnregisterWaitEx
DeleteTimerQueueTimer

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
DebugBreak

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualAlloc
VirtualQuery

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

Exports

Exports

DllCanUnloadNow
DllGetClassObject
LCEControlServer
NotifyLogoffUser
NotifyLogonUser
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34568e7f5e109a05a5e0d1d01eb4716

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-security-base-l1-1-0

rpcrt4

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

Exports

Exports

Sections

.text Size: 276KB - Virtual size: 276KB

.data Size: 1KB - Virtual size: 10KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 320B

.rsrc Size: 22KB - Virtual size: 22KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 276KB - Virtual size: 276KB

.data
Size: 1KB - Virtual size: 10KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 320B

.rsrc
Size: 22KB - Virtual size: 22KB

.reloc
Size: 17KB - Virtual size: 16KB