duser[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

duser.dll
Size

459KB
MD5

2308da9ae0e0843ca3f3e339bcb779d3
SHA1

7fb70692d9e1d90700822d0253b2363c77d49f8c
SHA256

9044fe243cdc58a56e36543f6e4757464ec8b6a0b6862ee37755ca6899c7b4a9
SHA512

9288dc012e1d2e209d4855e7d6907c372cc15ed78cea1b41a8de85ff89ae5029eeeac425c3f109ae788491d47bd14d45cabc1d0281b53d7441cd0741781b0acb
SSDEEP

6144:b+6uw7D0mOVDGH7eHZWyNhAbfVKYW5Jv8Ue8AyorwOAYphV+OU1HJYQU9SeP7pe6:tuNVMX6Ezw4XOZYSe0LFfcTS7F/W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
duser.dll

Files

duser.dll
.dll windows:10 windows x86 arch:x86

be93a1386b6eff3079bcbeaa9daf19ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DUser.pdb

Imports

msvcrt

_purecall
memcpy
memcmp
floor
ceil
_ftol2_sse
_ftol2
_CxxThrowException
_wcsicmp
_beginthreadex
_wcsnicmp
memmove
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
__CxxFrameHandler3
??1type_info@@UAE@XZ
_XcptFilter
?terminate@@YAXXZ
_isnan
_finite
realloc
_CIsqrt
_CIsin
_CIpow
_CIlog10
_CIlog
_CIfmod
_CIcos
_CIatan2
qsort
_resetstkoflw
memset

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExA
GetTickCount
GetSystemInfo

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
GetModuleFileNameA
LoadLibraryExW
FreeLibrary
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
RegGetValueW
RegCloseKey

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TlsFree
TlsAlloc
TerminateProcess
TlsSetValue
GetCurrentProcess
GetExitCodeThread
TlsGetValue
GetCurrentThreadId

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-com-l1-1-0

CoCreateInstance

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
ResetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSection
EnterCriticalSection
WaitForSingleObject
WaitForMultipleObjectsEx
DeleteCriticalSection
SetEvent
InitializeCriticalSectionAndSpinCount
CreateEventA

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
InitOnceExecuteOnce
SleepConditionVariableSRW

api-ms-win-core-atoms-l1-1-0

DeleteAtom
FindAtomW
AddAtomW
GetAtomNameW

ntdll

NtQueryInformationThread
NtSetInformationVirtualMemory
EtwLogTraceEvent
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsA
EtwGetTraceEnableLevel

user32

TranslateMessage
DispatchMessageA
IsWindow
GetClientRect
ClientToScreen
GetMonitorInfoW
SystemParametersInfoA
SendMessageA
SetRectEmpty
GetMessageA
GetMessageW
PeekMessageA
PeekMessageW
WaitMessage
GetWindowLongA
SetWindowLongW
DefWindowProcA
CallWindowProcW
GetKeyboardState
PostThreadMessageA
DrawTextW
SystemParametersInfoW
GetPointerDeviceRects
WindowFromDC
IsThreadDesktopComposited
FillRect
MsgWaitForMultipleObjectsEx
GetQueueStatus
GetMessageTime
IntersectRect
IsRectEmpty
UnionRect
OffsetRect
GetSystemMetrics
GetKeyState
PtInRect
GetDoubleClickTime
ReleaseDC
GetWindowRect
GetFocus
SetFocus
GetCursorPos
ScreenToClient
GetCapture
ChildWindowFromPointEx
ReleaseCapture
GetWindowDC
RegisterWindowMessageA
SetWindowLongA
CallWindowProcA
GetWindowLongW
GetDC
InvalidateRect
SetCapture
TrackMouseEvent
GetCursorInfo
GetMessagePos
PostMessageA
GetPointerType
BeginPaint
EndPaint
SendMessageW
GetParent

gdi32

CreatePolygonRgn
CombineRgn
CreateCompatibleBitmap
CreateCompatibleDC
GetPixel
GetSystemPaletteEntries
GetDIBits
GetObjectType
CreateDCA
CreateRectRgn
SetWindowOrgEx
SelectClipRgn
StretchDIBits
SetViewportOrgEx
GetObjectA
OffsetRgn
SelectObject
PatBlt
GetViewportOrgEx
GetRandomRgn
CreatePen
SetBrushOrgEx
GetBrushOrgEx
GetCurrentObject
GetDeviceCaps
RestoreDC
SaveDC
ModifyWorldTransform
GetTextExtentExPointW
GetTextExtentPoint32W
CreateFontIndirectW
ExtTextOutW
TextOutW
D3DKMTDestroyDCFromMemory
D3DKMTCreateDCFromMemory
CreateDCW
CreateSolidBrush
SetGraphicsMode
GdiFlush
CreateDIBSection
GetClipBox
SetRectRgn
BitBlt
ExtSelectClipRgn
DeleteObject
GdiAlphaBlend
IntersectClipRect
GetClipRgn
GetWorldTransform
DeleteDC
GetViewportExtEx
RealizePalette
SelectPalette
SetWorldTransform
GetWindowExtEx

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-interlocked-l1-1-0

QueryDepthSList
InterlockedPushEntrySList
InitializeSListHead
InterlockedPopEntrySList
InterlockedFlushSList

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
FlushInstructionCache

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

api-ms-win-core-memory-l1-1-1

VirtualUnlock

api-ms-win-core-rtlsupport-l1-2-0

RtlRaiseException

Exports

Exports

AddGadgetMessageHandler
AddLayeredRef
AdjustClipInsideRef
AttachWndProcA
AttachWndProcW
AutoTrace
BeginHideInputPaneAnimation
BeginShowInputPaneAnimation
BuildAnimation
BuildDropTarget
BuildInterpolation
CacheDWriteRenderTarget
ChangeCurrentAnimationScenario
ClearPushedOpacitiesFromGadgetTree
ClearTopmostVisual
CreateAction
CreateGadget
CustomGadgetHitTestQuery
DUserBuildGadget
DUserCastClass
DUserCastDirect
DUserCastHandle
DUserDeleteGadget
DUserFindClass
DUserFlushDeferredMessages
DUserFlushMessages
DUserGetAlphaPRID
DUserGetGutsData
DUserGetRectPRID
DUserGetRotatePRID
DUserGetScalePRID
DUserInstanceOf
DUserPostEvent
DUserPostMethod
DUserRegisterGuts
DUserRegisterStub
DUserRegisterSuper
DUserSendEvent
DUserSendMethod
DUserStopAnimation
DUserStopPVLAnimation
DeleteHandle
DestroyPendingDCVisuals
DetachGadgetVisuals
DetachWndProc
DisableContainerHwnd
DllMain
DrawGadgetTree
EndInputPaneAnimation
EnsureAnimationsEnabled
EnsureGadgetTransInitialized
EnumGadgets
FindGadgetFromPoint
FindGadgetMessages
FindGadgetTargetingInfo
FindStdColor
FireGadgetMessages
ForwardGadgetMessage
FreeGdiDxInteropStagingBuffer
GadgetTransCompositionChanged
GadgetTransSettingChanged
GetActionTimeslice
GetCachedDWriteRenderTarget
GetDUserModule
GetDebug
GetFinalAnimatingPosition
GetGadget
GetGadgetAnimation
GetGadgetBitmap
GetGadgetBufferInfo
GetGadgetCenterPoint
GetGadgetFlags
GetGadgetFocus
GetGadgetLayerInfo
GetGadgetMessageFilter
GetGadgetProperty
GetGadgetRect
GetGadgetRgn
GetGadgetRootInfo
GetGadgetRotation
GetGadgetScale
GetGadgetSize
GetGadgetStyle
GetGadgetTicket
GetGadgetVisual
GetMessageExA
GetMessageExW
GetStdColorBrushF
GetStdColorBrushI
GetStdColorF
GetStdColorI
GetStdColorName
GetStdColorPenF
GetStdColorPenI
GetStdPalette
InitGadgetComponent
InitGadgets
InvalidateGadget
InvalidateLayeredDescendants
IsGadgetParentChainStyle
IsInsideContext
IsStartDelete
LookupGadgetTicket
MapGadgetPoints
PeekMessageExA
PeekMessageExW
RegisterGadgetMessage
RegisterGadgetMessageString
RegisterGadgetProperty
ReleaseDetachedObjects
ReleaseLayeredRef
ReleaseMouseCapture
RemoveClippingImmunityFromVisual
RemoveGadgetMessageHandler
RemoveGadgetProperty
ResetDUserDevice
ScheduleGadgetTransitions
SetActionTimeslice
SetAtlasingHints
SetGadgetBufferInfo
SetGadgetCenterPoint
SetGadgetFillF
SetGadgetFillI
SetGadgetFlags
SetGadgetFocus
SetGadgetFocusEx
SetGadgetLayerInfo
SetGadgetMessageFilter
SetGadgetOrder
SetGadgetParent
SetGadgetProperty
SetGadgetRect
SetGadgetRootInfo
SetGadgetRotation
SetGadgetScale
SetGadgetStyle
SetHardwareDeviceUsage
SetMinimumDCompVersion
SetRestoreCachedLayeredRefFlag
SetTransitionVisualProperties
SetWindowResizeFlag
UnregisterGadgetMessage
UnregisterGadgetMessageString
UnregisterGadgetProperty
UtilBuildFont
UtilDrawBlendRect
UtilDrawOutlineRect
UtilGetColor
UtilSetBackground
WaitMessageEx

Sections

.text
Size: 391KB - Virtual size: 391KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be93a1386b6eff3079bcbeaa9daf19ea

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-atoms-l1-1-0

ntdll

user32

gdi32

api-ms-win-core-heap-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-rtlsupport-l1-2-0

Exports

Exports

Sections

.text Size: 391KB - Virtual size: 391KB

.data Size: 6KB - Virtual size: 9KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 220B

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 391KB - Virtual size: 391KB

.data
Size: 6KB - Virtual size: 9KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 220B

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 18KB - Virtual size: 18KB