combase[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

combase.dll
Size

2.5MB
MD5

0b01d72e6468cd9c88273b71ea49ce21
SHA1

b951a2a244188e213ab69bc9742164999c31d503
SHA256

004c5cf0f832c59aa17b107bb6df4023b1599558a86072111172f9f43d3883d1
SHA512

94e31197d9423448e37596a15e64c973015e545be032ad4205e70641b8dbaca03e082e47a5fc25193cfd410913be0a1c2fba19c3ce1f9fb9cd0847f19bc5b801
SSDEEP

49152:1XxPzCle+CMVKXP7pIsVKvdnFY9kyhoWrd/SYDu:nz0CMYP7K/d6J2Wrw

Score

1^/10

Malware Config

Signatures

Files

combase.dll
.dll windows:10 windows x86 arch:x86

0e7dbcdd9169f88354984e1c8b8310bd

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:f9:c0:37:e1:cd:01:63:a2:0d:48:1a:ea:2f:41:94:24:ba:c3:04:81:cd:cd:b1:a7:45:ac:4a:a2:95:4d:46
Signer

Actual PE Digest

77:f9:c0:37:e1:cd:01:63:a2:0d:48:1a:ea:2f:41:94:24:ba:c3:04:81:cd:cd:b1:a7:45:ac:4a:a2:95:4d:46

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

combase.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
strnlen
wcsncmp
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__stricmp
_o__strnicmp
_o__ui64tow_s
_o__wcsicmp
_o__wcslwr
_o__wcsnicmp
_o__wcstoui64
_o__wtoi
_o__wtol
memmove
_o_free
_o_malloc
_o_qsort
_o_rand_s
_o_realloc
_o_toupper
_o_wcsncpy_s
_o_wcstok
_o_wcstoul
_o_wmemcpy_s
wcsstr
wcsrchr
__CxxFrameHandler3
_except_handler4_common
_o__itow_s
_o__itoa_s
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
__std_terminate
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_CxxThrowException
_local_unwind4
memcmp
memcpy

rpcrt4

RpcErrorEndEnumeration
RpcBindingInqObject
RpcRaiseException
RpcAsyncInitializeHandle
RpcAsyncGetCallStatus
RpcServerTestCancel
RpcAsyncCancelCall
RpcServerSubscribeForNotification
RpcServerUnsubscribeForNotification
RpcMgmtSetCancelTimeout
RpcCancelThreadEx
I_RpcFreeBuffer
I_RpcGetBufferWithObject
I_RpcGetBuffer
I_RpcSendReceive
I_RpcAsyncSetHandle
I_RpcSend
I_RpcReceive
I_RpcAsyncAbortCall
RpcStringBindingParseW
RpcServerInqBindingHandle
RpcBindingToStringBindingW
RpcServerInqCallAttributesW
RpcBindingInqAuthInfoExW
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcRevertToSelfEx
RpcImpersonateClient
I_RpcBindingInqCurrentModifiedId
I_RpcSetDCOMAppId
RpcBindingInqAuthClientW
I_RpcOpenClientProcess
RpcCertGeneratePrincipalNameW
RpcServerRegisterAuthInfoW
RpcImpersonateClient2
RpcServerRegisterIf3
RpcServerUnregisterIf
I_RpcExceptionFilter
UuidFromStringW
RpcServerUseProtseqEpW
RpcServerInqBindings
RpcBindingVectorFree
RpcServerUseProtseqExW
RpcServerUseProtseqEpExW
RpcServerUseProtseqW
RpcAsyncCompleteCall
I_RpcMgmtEnableDedicatedThreadPool
I_RpcSystemHandleTypeSpecificWork
I_RpcServerGetAssociationID
I_RpcServerSubscribeForDisconnectNotification2
I_RpcServerUnsubscribeForDisconnectNotification
RpcBindingFromStringBindingW
RpcErrorStartEnumeration
RpcMgmtSetComTimeout
RpcMgmtInqComTimeout
MesEncodeFixedBufferHandleCreate
MesHandleFree
I_RpcSetSystemHandle
MesBufferHandleReset
NdrMesTypeEncode2
NdrMesTypeDecode2
NdrMesTypeFree2
NdrMesTypeAlignSize2
NdrGetUserMarshalInfo
NdrDllGetClassObject
NdrOleFree
NdrClientCall4
NdrOleAllocate
NdrDcomAsyncClientCall2
NdrStubCall2
RpcBindingServerFromClient
NdrStubCall
NdrServerInitialize
I_RpcRequestMutex
I_RpcFree
I_RpcAllocate
I_RpcClearMutex
NdrClientInitializeNew
I_RpcBCacheAllocate
NdrGetTypeFlags
SimpleTypeAlignment
NdrClearOutParameters
NdrFullPointerXlatFree
NdrFullPointerXlatInit
NdrCorrelationFree
NdrCorrelationInitialize
SimpleTypeMemorySize
I_RpcBCacheFree
SimpleTypeBufferSize
NdrConvert2
NdrClientCall2
NdrClientCall
NdrAsyncServerCall
NdrServerCall2
RpcExceptionFilter
MesDecodeIncrementalHandleCreate
MesEncodeIncrementalHandleCreate
I_RpcGetSystemHandle
RpcBindingBind
RpcBindingCreateW
I_RpcFreeSystemHandleCollection
I_RpcFreeSystemHandle
RpcErrorGetNextRecord
I_RpcBindingInqLocalClientPID
I_RpcBindingInqTransportType
I_RpcMgmtQueryDedicatedThreadPool
I_RpcBindingSetPrivateOption
RpcBindingFree
RpcBindingSetOption
RpcBindingUnbind
RpcBindingCopy
RpcSmDestroyClientContext
UuidCreate
RpcErrorAddRecord
MesDecodeBufferHandleCreate
ord1000

ntdll

RtlImageDirectoryEntryToData
RtlGetDeviceFamilyInfoEnum
RtlUpcaseUnicodeChar
RtlCopySid
RtlLengthSid
NtQueryInformationToken
RtlWow64IsWowGuestMachineSupported
RtlWow64GetEquivalentMachineCHPE
RtlSetThreadSubProcessTag
RtlDelete
RtlApplicationVerifierStop
RtlRealSuccessor
RtlCheckForOrphanedCriticalSections
NtQueryInformationThread
NtSetInformationObject
NtQueryObject
NtQueryVolumeInformationFile
RtlCaptureStackBackTrace
EtwEventWrite
EtwEventActivityIdControl
RtlInitializeCriticalSectionAndSpinCount
NtApphelpCacheControl
RtlSetThreadWorkOnBehalfTicket
RtlInitUnicodeStringEx
RtlGetAppContainerNamedObjectPath
NtQueryTimerResolution
NtTerminateProcess
RtlReportException
RtlInitializeConditionVariable
RtlCompareMemory
EtwEventSetInformation
RtlIsMultiSessionSku
EvtIntReportEventAndSourceAsync
NtQuerySystemInformation
RtlQueryPackageClaims
DbgPrint
EtwEventRegister
EtwEventUnregister
RtlCheckTokenCapability
RtlInitializeCriticalSection
RtlInitializeSidEx
RtlImageNtHeader
WinSqmSetDWORD
RtlIsCriticalSectionLockedByThread
RtlPcToFileHeader
RtlDllShutdownInProgress
EtwEventWriteTransfer
NtQueryValueKey
NtOpenKey
RtlEqualUnicodeString
NtQueryKey
RtlNtStatusToDosError
NtCreateKey
NtLoadKeyEx
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
RtlAdjustPrivilege
NtUnloadKey2
RtlInitUnicodeString
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlFreeUnicodeString
RtlAppendUnicodeToString
RtlLoadString
NtQueryInformationProcess
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
EtwTraceMessage
RtlGetAppContainerSidType
RtlSidDominates
RtlWakeAllConditionVariable
RtlSleepConditionVariableCS
EtwRegisterTraceGuidsW
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
RtlDeleteCriticalSection
NtDeleteKey
RtlRealPredecessor
RtlCaptureContext
NtQuerySecurityAttributesToken
LdrStandardizeSystemPath
RtlDeleteNoSplay
RtlIsStateSeparationEnabled
RtlValidRelativeSecurityDescriptor
RtlSplay
RtlFreeHeap
RtlQueryPackageIdentity
wcschr
RtlGetThreadWorkOnBehalfTicket

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsAlloc
FlsSetValue

api-ms-win-core-fibers-l1-1-1

IsThreadAFiber

api-ms-win-core-file-l1-1-0

FindNextFileW
RemoveDirectoryW
SetFileAttributesW
GetFinalPathNameByHandleW
FindClose
FindFirstFileW
CreateDirectoryW
GetFileSizeEx
GetFileType
DeleteFileW
GetFileAttributesW
CreateFileW
SetFileInformationByHandle

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle
SetHandleInformation

api-ms-win-core-heap-l1-1-0

HeapValidate
HeapCompact
HeapReAlloc
HeapSize
HeapDestroy
HeapCreate
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalAlloc
GlobalFree
LocalAlloc

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedPopEntrySList
QueryDepthSList
InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA
FreeLibrary
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryExA
LoadLibraryExW
FreeLibraryAndExitThread
GetModuleHandleA

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-memory-l1-1-0

VirtualQuery
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
OpenFileMappingW
VirtualProtect
VirtualFree
VirtualAlloc

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
FreeEnvironmentStringsW
ExpandEnvironmentStringsW
GetCommandLineW
GetEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
OpenProcessToken
GetCurrentThread
GetCurrentThreadId
SwitchToThread
GetThreadPriority
GetProcessId
SetThreadToken
SetThreadStackGuarantee
GetCurrentProcess
OpenThreadToken
GetCurrentProcessId
ProcessIdToSessionId
CreateThread

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
GetProcessMitigationPolicy
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegOpenKeyExA
RegQueryInfoKeyW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegEnumKeyExW
RegGetValueA
RegCreateKeyExA
RegDeleteKeyExA
RegSetValueExA
RegOpenUserClassesRoot
RegLoadMUIStringW
RegOpenCurrentUser
RegDeleteTreeW
RegQueryValueExA
RegOpenKeyExW
RegSaveKeyExW
RegSetKeySecurity
RegCloseKey
RegLoadAppKeyW
RegQueryValueExW
RegEnumValueW
RegGetValueW
RegSetValueExW

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
InitializeSRWLock
TryAcquireSRWLockExclusive
CreateSemaphoreExW
SetWaitableTimerEx
OpenEventW
CreateEventW
SetEvent
ResetEvent
OpenEventA
CreateWaitableTimerExW
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
SleepEx

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
InitOnceBeginInitialize
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
InitOnceExecuteOnce

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemWindowsDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryW
GetTickCount
GetComputerNameExW

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
SetEventWhenCallbackReturns
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolWork
CreateThreadpoolWait
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWaitCallbacks

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-wow64-l1-1-1

GetSystemWow64Directory2W
Wow64SetThreadDefaultGuestMachine

api-ms-win-security-base-l1-1-0

GetLengthSid
CopySid
GetSecurityDescriptorLength
GetSecurityDescriptorDacl
AccessCheckByType
ImpersonateAnonymousToken
MakeSelfRelativeSD
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
DuplicateToken
GetSidSubAuthorityCount
EqualSid
InitializeAcl
GetSecurityDescriptorSacl
RevertToSelf
InitializeSid
AddAccessAllowedAce
ImpersonateLoggedOnUser
CheckTokenMembership
IsValidSid
AccessCheck
GetAce
MapGenericMask
GetKernelObjectSecurity
PrivilegeCheck
SetSecurityDescriptorOwner
GetSecurityDescriptorRMControl
GetSidSubAuthority
CreateWellKnownSid
ImpersonateSelf
IsValidSecurityDescriptor
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorRMControl
SetSecurityDescriptorSacl
AddAce
SetSecurityDescriptorGroup
GetSidLengthRequired
GetTokenInformation

api-ms-win-security-base-l1-2-0

GetAppContainerAce

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteEx
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
EventProviderEnabled

api-ms-win-core-heap-obsolete-l1-1-0

GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalSize

api-ms-win-core-privateprofile-l1-1-0

GetProfileStringW

api-ms-win-core-sidebyside-l1-1-0

FindActCtxSectionGuid
AddRefActCtx
ActivateActCtx
ReleaseActCtx
DeactivateActCtx
CreateActCtxW
GetCurrentActCtx
FindActCtxSectionStringW

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock
WerUnregisterMemoryBlock

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled
QuirkIsEnabledForProcess

kernelbase

ParseApplicationUserModelId
VerifyPackageFullName
OpenPackageInfoByFullNameForUser
GetStagedPackagePathByFullName2
OpenPackageInfoByFullNameForMachine
FindPackagesByPackageFamily
IsDeveloperModeEnabled
GetCurrentPackageInfo3
GetApplicationUserModelId
GetCurrentApplicationUserModelId
GetCurrentPackageFamilyName
GetSystemMetadataPathForPackage

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

api-ms-win-core-processsnapshot-l1-1-0

PssCaptureSnapshot
PssFreeSnapshot
PssQuerySnapshot
PssDuplicateSnapshot

api-ms-win-core-string-l2-1-0

CharPrevW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CLIPFORMAT_UserFree
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserUnmarshal
CLSIDFromOle1Class
CLSIDFromProgID
CLSIDFromProgIDEx
CLSIDFromString
CStdAsyncStubBuffer2_Connect
CStdAsyncStubBuffer2_Disconnect
CStdAsyncStubBuffer2_Release
CStdAsyncStubBuffer_AddRef
CStdAsyncStubBuffer_Connect
CStdAsyncStubBuffer_Disconnect
CStdAsyncStubBuffer_Invoke
CStdAsyncStubBuffer_QueryInterface
CStdAsyncStubBuffer_Release
CStdStubBuffer2_Connect
CStdStubBuffer2_CountRefs
CStdStubBuffer2_Disconnect
CStdStubBuffer2_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_QueryInterface
CleanupComl2StateInAllTls
CleanupOleStateInAllTls
CleanupTlsComl2State
CleanupTlsOleState
ClearCleanupFlag
CoAddRefServerProcess
CoAllowUnmarshalerCLSID
CoCancelCall
CoCopyProxy
CoCreateErrorInfo
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoCreateInstanceEx
CoCreateInstanceFromApp
CoCreateObjectInContext
CoDeactivateObject
CoDecodeProxy
CoDecrementMTAUsage
CoDisableCallCancellation
CoDisconnectContext
CoDisconnectObject
CoEnableCallCancellation
CoFileTimeNow
CoFreeUnusedLibraries
CoFreeUnusedLibrariesEx
CoGetActivationState
CoGetApartmentID
CoGetApartmentType
CoGetCallContext
CoGetCallState
CoGetCallerTID
CoGetCancelObject
CoGetClassObject
CoGetClassVersion
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCurrentProcess
CoGetDefaultContext
CoGetErrorInfo
CoGetInstanceFromFile
CoGetInstanceFromIStorage
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoGetMarshalSizeMax
CoGetModuleArchitecture
CoGetModuleType
CoGetObjectContext
CoGetPSClsid
CoGetProcessIdentifier
CoGetStandardMarshal
CoGetStdMarshalEx
CoGetSystemSecurityPermissions
CoGetTreatAsClass
CoImpersonateClient
CoIncrementMTAUsage
CoInitializeEx
CoInitializeSecurity
CoInitializeWOW
CoInvalidateRemoteMachineBindings
CoIsHandlerConnected
CoLockObjectExternal
CoMarshalHresult
CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoPopServiceDomain
CoPushServiceDomain
CoQueryAuthenticationServices
CoQueryClientBlanket
CoQueryProxyBlanket
CoReactivateObject
CoRegisterActivationFilter
CoRegisterClassObject
CoRegisterConsoleHandles
CoRegisterDeviceCatalog
CoRegisterInitializeSpy
CoRegisterMallocSpy
CoRegisterMessageFilter
CoRegisterPSClsid
CoRegisterRacActivationToken
CoRegisterSurrogate
CoRegisterSurrogateEx
CoReleaseMarshalData
CoReleaseServerProcess
CoResumeClassObjects
CoRetireServer
CoRevertToSelf
CoRevokeClassObject
CoRevokeConsoleHandles
CoRevokeDeviceCatalog
CoRevokeInitializeSpy
CoRevokeMallocSpy
CoRevokeRacActivationToken
CoSetCancelObject
CoSetErrorInfo
CoSetProxyBlanket
CoSuspendClassObjects
CoSwitchCallContext
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoTestCancel
CoUninitialize
CoUnloadingWOW
CoUnmarshalHresult
CoUnmarshalInterface
CoVrfCheckThreadState
CoVrfGetThreadState
CoVrfReleaseThreadState
CoWaitForMultipleHandles
CoWaitForMultipleObjects
CreateErrorInfo
CreateStreamOnHGlobal
DcomChannelSetHResult
DllDebugObjectRPCHook
DllGetActivationFactory
DllGetClassObject
EnableHookObject
FreePropVariantArray
FreePropVariantArrayWorker
GetCatalogHelper
GetErrorInfo
GetFuncDescs
GetHGlobalFromStream
GetHookInterface
GetRestrictedErrorInfo
HACCEL_UserFree
HACCEL_UserMarshal
HACCEL_UserSize
HACCEL_UserUnmarshal
HBITMAP_UserFree
HBITMAP_UserMarshal
HBITMAP_UserSize
HBITMAP_UserUnmarshal
HBRUSH_UserFree
HBRUSH_UserMarshal
HBRUSH_UserSize
HBRUSH_UserUnmarshal
HDC_UserFree
HDC_UserMarshal
HDC_UserSize
HDC_UserUnmarshal
HGLOBAL_UserFree
HGLOBAL_UserMarshal
HGLOBAL_UserSize
HGLOBAL_UserUnmarshal
HICON_UserFree
HICON_UserMarshal
HICON_UserSize
HICON_UserUnmarshal
HMENU_UserFree
HMENU_UserMarshal
HMENU_UserSize
HMENU_UserUnmarshal
HMONITOR_UserFree
HMONITOR_UserMarshal
HMONITOR_UserSize
HMONITOR_UserUnmarshal
HPALETTE_UserFree
HPALETTE_UserMarshal
HPALETTE_UserSize
HPALETTE_UserUnmarshal
HRGN_UserFree
HRGN_UserMarshal
HRGN_UserSize
HRGN_UserUnmarshal
HSTRING_UserFree
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserUnmarshal
HWND_UserFree
HWND_UserMarshal
HWND_UserSize
HWND_UserUnmarshal
HkOleRegisterObject
IIDFromString
InternalAppInvokeExceptionFilter
InternalCAggIdRelease
InternalCAggIdSetHandler
InternalCCFreeUnused
InternalCCGetClassInformationForDde
InternalCCGetClassInformationFromKey
InternalCCSetDdeServerWindow
InternalCMLSendReceive
InternalCMLSendReceive2
InternalCStdIdentityGetIProxyManager
InternalCStdIdentityGetInternalUnk
InternalCStdIdentityUpdateFlags
InternalCallAsProxyExceptionFilter
InternalCallFrameExceptionFilter
InternalCallerIsAppContainer
InternalCanMakeOutCall
InternalCanMakeOutCall2
InternalCoIsSurrogateProcess
InternalCoRegisterDisconnectCallback
InternalCoRegisterSurrogatedObject
InternalCoStdMarshalObject
InternalCoUnregisterDisconnectCallback
InternalCompleteObjRef
InternalCreateCAggId
InternalCreateIdentityHandler
InternalDoATClassCreate
InternalFillLocalOXIDInfo
InternalFreeObjRef
InternalGetWindowPropInterface
InternalGetWindowPropInterface2
InternalIrotEnumRunning
InternalIrotEnumRunning2
InternalIrotGetObject
InternalIrotGetObject2
InternalIrotGetObject3
InternalIrotGetTimeOfLastChange
InternalIrotGetTimeOfLastChange2
InternalIrotIsRunning
InternalIrotIsRunning2
InternalIrotNoteChangeTime
InternalIrotRegister
InternalIrotRevoke
InternalIsApartmentInitialized
InternalIsProcessInitialized
InternalMarshalObjRef
InternalNotifyDDStartOrStop
InternalOleModalLoopBlockFn
InternalRegisterWindowPropInterface
InternalRegisterWindowPropInterface2
InternalReleaseMarshalObjRef
InternalRevokeWindowPropInterface
InternalSTAInvoke
InternalServerExceptionFilter
InternalSetAptCallCtrlOnTlsIfRequired
InternalSetOleThunkWowPtr
InternalStubInvoke
InternalTlsAllocData
InternalUnmarshalObjRef
IsErrorPropagationEnabled
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrExtStubInitialize
NdrOleDllGetClassObject
NdrOleInitializeExtension
NdrProxyForwardingFunction10
NdrProxyForwardingFunction11
NdrProxyForwardingFunction12
NdrProxyForwardingFunction13
NdrProxyForwardingFunction14
NdrProxyForwardingFunction15
NdrProxyForwardingFunction16
NdrProxyForwardingFunction17
NdrProxyForwardingFunction18
NdrProxyForwardingFunction19
NdrProxyForwardingFunction20
NdrProxyForwardingFunction21
NdrProxyForwardingFunction22
NdrProxyForwardingFunction23
NdrProxyForwardingFunction24
NdrProxyForwardingFunction25
NdrProxyForwardingFunction26
NdrProxyForwardingFunction27
NdrProxyForwardingFunction28
NdrProxyForwardingFunction29
NdrProxyForwardingFunction3
NdrProxyForwardingFunction30
NdrProxyForwardingFunction31
NdrProxyForwardingFunction32
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction6
NdrProxyForwardingFunction7
NdrProxyForwardingFunction8
NdrProxyForwardingFunction9
NdrpFindInterface
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient17
ObjectStublessClient18
ObjectStublessClient19
ObjectStublessClient20
ObjectStublessClient21
ObjectStublessClient22
ObjectStublessClient23
ObjectStublessClient24
ObjectStublessClient25
ObjectStublessClient26
ObjectStublessClient27
ObjectStublessClient28
ObjectStublessClient29
ObjectStublessClient3
ObjectStublessClient30
ObjectStublessClient31
ObjectStublessClient32
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient9
ProgIDFromCLSID
PropVariantClear
PropVariantCopy
ReleaseFuncDescs
RoActivateInstance
RoCaptureErrorContext
RoClearError
RoFailFastWithErrorContext
RoFailFastWithErrorContextInternal
RoFailFastWithErrorContextInternal2
RoFreeParameterizedTypeExtra
RoGetActivatableClassRegistration
RoGetActivationFactory
RoGetAgileReference
RoGetApartmentIdentifier
RoGetErrorReportingFlags
RoGetMatchingRestrictedErrorInfo
RoGetParameterizedTypeInstanceIID
RoGetServerActivatableClasses
RoInitialize
RoInspectCapturedStackBackTrace
RoInspectThreadErrorInfo
RoOriginateError
RoOriginateErrorW
RoOriginateLanguageException
RoParameterizedTypeExtraGetTypeSignature
RoRegisterActivationFactories
RoRegisterForApartmentShutdown
RoReportCapabilityCheckFailure
RoReportFailedDelegate
RoReportUnhandledError
RoResolveRestrictedErrorInfoReference
RoRevokeActivationFactories
RoSetErrorReportingFlags
RoTransformError
RoTransformErrorW
RoUninitialize
RoUnregisterForApartmentShutdown
SetCleanupFlag
SetErrorInfo
SetRestrictedErrorInfo
StringFromCLSID
StringFromGUID2
StringFromIID
UpdateDCOMSettings
UpdateProcessTracing
WdtpInterfacePointer_UserFree
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserUnmarshal
WindowsCompareStringOrdinal
WindowsConcatString
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsDuplicateString
WindowsGetStringLen
WindowsGetStringRawBuffer
WindowsInspectString
WindowsInspectString2
WindowsIsStringEmpty
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsReplaceString
WindowsStringHasEmbeddedNull
WindowsSubstring
WindowsSubstringWithSpecifiedLength
WindowsTrimStringEnd
WindowsTrimStringStart

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.proxy
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e7dbcdd9169f88354984e1c8b8310bd

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

77:f9:c0:37:e1:cd:01:63:a2:0d:48:1a:ea:2f:41:94:24:ba:c3:04:81:cd:cd:b1:a7:45:ac:4a:a2:95:4d:46Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

rpcrt4

ntdll

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-quirks-l1-1-0

kernelbase

api-ms-win-core-path-l1-1-0

api-ms-win-core-processsnapshot-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.proxy Size: 15KB - Virtual size: 14KB

.data Size: 6KB - Virtual size: 15KB

.idata Size: 19KB - Virtual size: 19KB

.didat Size: 1024B - Virtual size: 796B

.rsrc Size: 79KB - Virtual size: 79KB

.reloc Size: 144KB - Virtual size: 143KB

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

77:f9:c0:37:e1:cd:01:63:a2:0d:48:1a:ea:2f:41:94:24:ba:c3:04:81:cd:cd:b1:a7:45:ac:4a:a2:95:4d:46
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.proxy
Size: 15KB - Virtual size: 14KB

.data
Size: 6KB - Virtual size: 15KB

.idata
Size: 19KB - Virtual size: 19KB

.didat
Size: 1024B - Virtual size: 796B

.rsrc
Size: 79KB - Virtual size: 79KB

.reloc
Size: 144KB - Virtual size: 143KB