ConsoleLogon[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ConsoleLogon.dll
Size

248KB
MD5

0bbcc2d04eee6857068e16f8b3e20bf0
SHA1

6be1409944e2c926e1a6b0a1173b1ed4b65dda78
SHA256

a3c6cefa2aae6973f7b998e36261b83a317420a5a98a1081733dc2577072f0cb
SHA512

24ceb2ed4f325b183f08726308483668bf622abe20d1cfa6c100263f8b32cf5636607bbaed78eec2d56b9d7b71173ed2d73c18af35bb6f21252740d88b2df921
SSDEEP

6144:KnFxYeZQLVOOSeEgSwA8AHsKRKChHjDLQm9h4fV7Ev6OExGZ9TguDyrBM8iy:K7YeZQLbSpgSFJQm9h4fV5OExGzTgPBC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ConsoleLogon.dll

Files

ConsoleLogon.dll
.dll windows:10 windows x86 arch:x86

4feef5e88b0f4de8d45e4ff8537d4093

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ConsoleLogon.pdb

Imports

msvcrt

__dllonexit
_onexit
_except_handler4_common
memmove
_purecall
_vsnwprintf
memcpy_s
memmove_s
_set_errno
_get_errno
realloc
__CxxFrameHandler3
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
_callnewh
memcmp
memset

api-ms-win-core-libraryloader-l1-2-0

LoadResource
LockResource
DisableThreadLibraryCalls
FindResourceExW
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo
RoOriginateErrorW
RoTransformError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockExclusive
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockShared
ResetEvent
LeaveCriticalSection
SetEvent
CreateEventExW
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateMutexExW
CreateSemaphoreExW
InitializeSRWLock

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
WindowsConcatString
WindowsIsStringEmpty
WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringLen

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceComplete
Sleep
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
CoCreateInstance
CoGetMalloc
CoTaskMemFree
CoTaskMemRealloc
CoGetInterfaceAndReleaseStream
CoCreateFreeThreadedMarshaler
CoReleaseMarshalData
CoMarshalInterface
CoTaskMemAlloc
CreateStreamOnHGlobal

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-localization-l1-2-0

SetThreadUILanguage
GetLocaleInfoEx
GetThreadUILanguage
FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-console-l2-1-0

FillConsoleOutputAttribute
SetConsoleCursorPosition
WriteConsoleOutputCharacterW
GetConsoleScreenBufferInfo
CreateConsoleScreenBuffer
SetConsoleOutputCP
ReadConsoleOutputA
ScrollConsoleScreenBufferW
SetConsoleCursorInfo
FillConsoleOutputCharacterW
SetConsoleActiveScreenBuffer

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle

api-ms-win-core-console-l1-2-0

PeekConsoleInputW
FreeConsole

api-ms-win-core-console-l1-1-0

AllocConsole
ReadConsoleInputW

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation

api-ms-win-rtcore-ntuser-window-l1-1-0

IsGUIThread

api-ms-win-shcore-thread-l1-1-0

SHCreateThreadWithHandle

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4feef5e88b0f4de8d45e4ff8537d4093

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-shcore-thread-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 222KB - Virtual size: 221KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 36B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 222KB - Virtual size: 221KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 36B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 16KB