atlthunk[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

atlthunk.dll
Size

36KB
MD5

165cb8aa68a774fef338a9ee4c0ef7b8
SHA1

e1a865a3d6d56901a37a8b016fc86878aa900951
SHA256

fc8a1b7850073f7ee8dc4fd0786d07a16b3ad9f74562570a9b77f469bef23877
SHA512

33ce479e0f069d063ffffbe0a917bfc8a718ad03776868ee3260aaadee94138245d4bd78576bbb8cd6676680e6f6a098f8bd9e9fe26534f40bea4f1e35e18908
SSDEEP

384:Hx8MgAioSoI3gxq+s7b7AU0OOOEkDKZ5Czzzo8cGkxGAAvoFFsjDj0oouuuY4na6:HxN/XXCRrP8TGs8VWtH9u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
atlthunk.dll

Files

atlthunk.dll
.dll windows:10 windows x86 arch:x86

e60640221abf28fcf2f6ba5fc570c445

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

atlthunk.pdb

Imports

ntdll

NtClose
RtlAcquireSRWLockExclusive
LdrDisableThreadCalloutsForDll
RtlFreeHeap
NtAreMappedFilesTheSame
RtlReleaseSRWLockExclusive
RtlAllocateHeap

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
VirtualProtect
MapViewOfFile

api-ms-win-core-errorhandling-l1-1-0

SetLastError

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameW

api-ms-win-core-file-l1-1-0

CreateFileW

Exports

Exports

AtlThunk_AllocateData
AtlThunk_DataToCode
AtlThunk_FreeData
AtlThunk_InitData

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 754B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ