AdmTmpl[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

AdmTmpl.dll
Size

418KB
MD5

f8cc20e2203a20d958234b5aea3a5cfa
SHA1

d995a9557c43ded63901b33e63090d8189ee5389
SHA256

453740b44714346d0a9e738001fff8eab77d1d36de3e47177f7765939bd626fb
SHA512

3ee6142c60f3e890be7c4d34cd7fb3d4b8f1aeb35d9c9dbe5d58af4774691862332adec72b5c91baf62caae7745d960e6e0eb10872bee0f4011128e4980f11e9
SSDEEP

6144:IADBRhB9QYCEMPyp34pOS1j37mX0TbtokY5bGJL+YGk55sbRMC25hMekl2Uc21Z/:bQpPyWp71jSEntEtYp5eX2Mecr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AdmTmpl.dll

Files

AdmTmpl.dll
.dll windows:10 windows x86 arch:x86

68dfe7e3940b56417490a34f50613464

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AdmTmpl.pdb

Imports

msvcrt

__CxxFrameHandler3
__RTDynamicCast
_ftol2_sse
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
??0exception@@QAE@ABQBD@Z
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
free
_callnewh
wcsrchr
_itow
wcschr
_vsnwprintf
_purecall
wcsnlen
_wtoi
_wtoi64
wcstoul
memset

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalAlloc
LocalReAlloc
GlobalFree
LocalFree

api-ms-win-core-file-l1-1-0

FindFirstFileW
FindClose
GetFileAttributesExW
ReadFile
CreateFileW
GetFileAttributesW
GetFileSize
CreateDirectoryW
SetFilePointer
FileTimeToLocalFileTime
FindNextFileW
WriteFile
CompareFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLangID
GetFileMUIPath
GetThreadPreferredUILanguages

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadStringW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
FreeLibraryAndExitThread
FreeLibrary
LoadResource
FindResourceExW
DisableThreadLibraryCalls
LockResource

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
WaitForSingleObject
CreateEventW
InitializeCriticalSectionEx
SetEvent

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA
LoadLibraryW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA
OutputDebugStringW

oleaut32

SysAllocString
SysFreeString
SysStringLen

api-ms-win-security-base-l1-1-0

GetLengthSid
AllocateAndInitializeSid
InitializeAcl
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
AddAccessAllowedAce

api-ms-win-core-registry-l1-1-0

RegQueryValueExA
RegOpenKeyExW
RegEnumKeyExW
RegOpenKeyExA
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExW
RegCloseKey
RegSetValueExW

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
CreateThread
GetCurrentProcessId
GetCurrentThreadId
SetThreadPriority

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoUninitialize
CLSIDFromString
CreateStreamOnHGlobal
StringFromGUID2

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

advapi32

RegCreateKeyW
IsTextUnicode
RegDeleteKeyW

gdi32

DeleteObject

kernel32

GlobalUnlock
lstrcmpiW
GlobalLock
LoadLibraryExA
ExpandEnvironmentStringsA
GlobalReAlloc

ole32

OleRun

shell32

SHFileOperationW

user32

DispatchMessageW
RegisterWindowMessageW
RegisterClassW
CreateWindowExW
CheckDlgButton
LoadImageW
EndDialog
GetKeyboardLayout
TranslateMessage
PostMessageW
GetMessagePos
MessageBeep
SetFocus
GetClientRect
DestroyIcon
DefWindowProcW
RegisterClipboardFormatW
SetCursor
LoadCursorW
SetWindowLongW
IsDlgButtonChecked
ScreenToClient
EnableWindow
MsgWaitForMultipleObjects
PeekMessageW
DestroyWindow
MessageBoxW
GetWindowLongW
SendMessageW
GetDlgItem
DialogBoxParamW

xmllite

CreateXmlWriter

Exports

Exports

CreateCmtStoreObject
CreateParserObject
DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 265KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68dfe7e3940b56417490a34f50613464

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-debug-l1-1-0

oleaut32

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-profile-l1-1-0

advapi32

gdi32

kernel32

ole32

shell32

user32

xmllite

Exports

Exports

Sections

.text Size: 265KB - Virtual size: 264KB

.data Size: 7KB - Virtual size: 9KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 120KB - Virtual size: 120KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 265KB - Virtual size: 264KB

.data
Size: 7KB - Virtual size: 9KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 120KB - Virtual size: 120KB

.reloc
Size: 18KB - Virtual size: 18KB