dbgcore[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dbgcore.dll
Size

155KB
MD5

6be4c9831e74801ae2acb0205e124768
SHA1

45f5ce3e79b35500fa3bcafed4807da62940aeb9
SHA256

ac46ea88464ee41db2154246cfbd554438a7b671be78b584881d251e6a8964f8
SHA512

50db57df6493962c2f030e18a29f7a301fb33494fa6629fe9581ca292651df71076906780e19587f63cc88692b79500ec47bac0354f6ca9f0bd2ca6721291c1c
SSDEEP

3072:+aQASh0NdOEoQOxTcmmz3MMq2RruFw0Eyuuq2aTtivV9AnL3PleJmp2YLAo5j:gASh0NdOpn2Riuuq2iti99mPKmp2YLFj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dbgcore.dll

Files

dbgcore.dll
.dll windows:10 windows x86 arch:x86

55285c861081b372f475469fa2374059

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dbgcore.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
memmove_s

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__strlwr_s
_o__wcsicmp
_o__wcsnicmp
_o__wsplitpath_s
_o_free
_o_malloc
_o_memcpy_s
strstr
wcsrchr
_except_handler4_common
_o___std_type_info_destroy_list
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
__CxxFrameHandler3
memcmp
memcpy

ntdll

RtlReleasePrivilege
RtlNtStatusToDosError
NtDeviceIoControlFile
NtQuerySystemInformation
NtQueryVirtualMemory
NtClose
RtlRunOnceExecuteOnce
RtlAcquirePrivilege
NtCreateFile
NtGetNextThread

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExW
GetProcAddress
GetModuleFileNameA
GetModuleFileNameW
LoadResource
GetModuleHandleExW
LoadLibraryExA
GetModuleHandleW
FreeLibrary
LockResource
DisableThreadLibraryCalls

api-ms-win-core-misc-l1-1-0

FormatMessageW
Sleep
lstrcmpiW
IsWow64Process

api-ms-win-core-sysinfo-l1-1-0

GetVersionExA
GetVersionExW
GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapCreate
GetProcessHeap
HeapDestroy
HeapFree
HeapAlloc

api-ms-win-core-localregistry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey
RegQueryValueExA

api-ms-win-core-synch-l1-1-0

CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DeleteCriticalSection
ReleaseMutex
AcquireSRWLockShared
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection

api-ms-win-core-file-l1-1-0

GetFileSize
SetFilePointer
CreateFileA
WriteFile
CreateFileW

api-ms-win-core-threadpool-l1-1-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

SuspendThread
GetCurrentProcessId
GetThreadId
GetPriorityClass
GetCurrentProcess
GetCurrentThreadId
GetThreadPriority
ResumeThread
TerminateProcess

api-ms-win-core-memory-l1-1-0

MapViewOfFile
VirtualProtect
VirtualAlloc
ReadProcessMemory
VirtualFree
UnmapViewOfFile
VirtualQueryEx

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Exports

Exports

MiniDumpReadDumpStream
MiniDumpWriteDump

Sections

.text
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mrdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

55285c861081b372f475469fa2374059

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-threadpool-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

Exports

Exports

Sections

.text Size: 134KB - Virtual size: 134KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 4KB

.mrdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 134KB - Virtual size: 134KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 4KB

.mrdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB