InkEd[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

InkEd.dll
Size

225KB
MD5

89c498b67ef3c6e1815bed09e6e9648b
SHA1

373997458e1531ea2705e6ba1a257ac80d527974
SHA256

0a7148aa88709644ede177086058d195e685f89526b4f05a9c5a0e8eb30fca57
SHA512

4523aa5c5ed62bf801c8ff1ae8a3f5fd59d7f19dac2f60fcba7589dbba8e4933bad7d38b99da58d1983f896385a61e0d671e020f1298f7380b6d92444a49535b
SSDEEP

3072:hItgqOrhiTdX6Yo0L09EoTDXdrRI/+jMv3w5aNwfjXPvc2f1o3iW4OeFi3P3+3vE:hAg8RNolS/48ZeVDcqSr23zJYnbzoI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InkEd.dll

Files

InkEd.dll
.dll regsvr32 windows:10 windows x86 arch:x86

bb74f2726b453956e21624ddc3e2edba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

InkEd.pdb

Imports

msvcrt

realloc
memcmp
memcpy
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
_callnewh
memmove_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
memcpy_s
malloc
free
_purecall
wcscat_s
wcscpy_s
_ftol2_sse
memset

oleaut32

SafeArrayCopy
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
OleCreateFontIndirect
OleCreatePictureIndirect
SysReAllocStringLen
OleTranslateColor
VariantInit
SysStringLen
SysAllocStringLen
OleLoadPicture
VariantChangeType
SafeArrayAccessData
SafeArrayCreate
SafeArrayUnaccessData
DispCallFunc
SafeArrayPutElement
OleCreatePropertyFrame
SafeArrayGetVartype
SysAllocString
LoadRegTypeLi
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayCreateVector
RegisterTypeLi
LoadTypeLi
SafeArrayDestroy
VarUI4FromStr
SafeArrayGetUBound

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExA
FindResourceExW
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
SizeofResource
GetModuleFileNameW
LoadResource

api-ms-win-core-memory-l1-1-2

VirtualFree
VirtualQuery
VirtualProtect
VirtualAlloc

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteValueW

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
Sleep

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
GetHGlobalFromStream
CreateStreamOnHGlobal

api-ms-win-core-string-l2-1-0

CharPrevW
CharNextW

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryW
GetTickCount
GetVersionExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-1

RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapDestroy
HeapFree
HeapAlloc

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
IsProcessorFeaturePresent

api-ms-win-core-localization-l1-2-1

GetUserDefaultLangID

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-interlocked-l1-2-0

InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

gdi32

SetWindowExtEx
SetMapMode
LPtoDP
RestoreDC
SetViewportOrgEx
DeleteDC
GetDeviceCaps
SetWindowOrgEx
CreateDCW
SaveDC
GetObjectType
CreateEnhMetaFileW
GetMapMode
CreateSolidBrush
DeleteObject
GetClipBox
SetViewportExtEx
CloseEnhMetaFile
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
PatBlt
StretchBlt
CreateRectRgnIndirect

kernel32

lstrcmpiW
GlobalLock
lstrcpyW
lstrcpynW
GlobalUnlock

ole32

OleRegEnumVerbs
StgCreateDocfileOnILockBytes
CreateDataAdviseHolder
CreateOleAdviseHolder
CreateILockBytesOnHGlobal
OleRegGetMiscStatus
OleRegGetUserType

user32

EnableWindow
GetMessageExtraInfo
PostMessageW
ScreenToClient
GetCapture
SetTimer
UpdateWindow
GetCursorInfo
ReleaseDC
SendMessageW
InvalidateRect
PtInRect
SetWindowLongW
IsChild
DestroyAcceleratorTable
IsWindow
ShowWindow
UnionRect
GetDC
DestroyWindow
GetFocus
CallWindowProcW
GetKeyState
GetParent
GetClassInfoExW
SetRect
GetClientRect
wsprintfW
SetParent
LoadCursorW
TranslateMessage
SetFocus
IntersectRect
GetSysColor
ValidateRect
WindowFromDC
IsWindowEnabled
GetSystemMetrics
DispatchMessageW
OffsetRect
MessageBeep
CreateWindowExW
FillRect
SetWindowRgn
EqualRect
SetWindowPos
IsWindowVisible
UnregisterClassW
InflateRect
RegisterClassExW
GetCursorPos
ShowCursor
ReleaseCapture
KillTimer
SetCapture
GetDoubleClickTime
RegisterClassW
GetWindowLongW
GetClassInfoW
DefWindowProcW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb74f2726b453956e21624ddc3e2edba

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-profile-l1-1-0

gdi32

kernel32

ole32

user32

Exports

Exports

Sections

.text Size: 106KB - Virtual size: 106KB

.data Size: 1KB - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 102KB - Virtual size: 102KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 106KB - Virtual size: 106KB

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 102KB - Virtual size: 102KB

.reloc
Size: 7KB - Virtual size: 6KB