ErrorDetails[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

ErrorDetails.dll
Size

131KB
MD5

4f513d2133f558dfd9e26154c20b3be4
SHA1

bcc42071fcc7691ff85d1c46a354d74e690e24e2
SHA256

28a5017e8d6e63eb3718c4ffdd867aa953304873af78eb8803be7081cd06feb2
SHA512

d067e41cf71203136083b89f09e149e124c625f8c9fce810a70b189c6f7eb5a9296be735119bb3c86894aed57e02da49004dbc4c96b1815e126aea39305a1216
SSDEEP

1536:iQzOs2ZxrB46zODJ6HtpMyQzYEkVlR0O654gGKTUGGYFpz/7iAldotB6GUo:iQzObNj/MyQ9klR0OerTp9FNiidoWZo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ErrorDetails.dll

Files

ErrorDetails.dll
.dll windows:10 windows x86 arch:x86

a68fcaf47da665c8490079e6b31a2909

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ErrorDetails.pdb

Imports

msvcrt

_initterm
malloc
??3@YAXPAX@Z
free
_amsg_exit
_unlock
_lock
memcmp
__dllonexit
_onexit
__CxxFrameHandler3
_XcptFilter
_except_handler4_common
_purecall
_vsnwprintf
memmove
memcpy_s
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
sprintf_s
_towlower_l
_create_locale
_vsnprintf
wcschr
_callnewh
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
??1type_info@@UAE@XZ
memset

rpcrt4

CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Disconnect
NdrStubCall2
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
NdrStubForwardingFunction
CStdStubBuffer_CountRefs

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDeleteString
HSTRING_UserSize
WindowsCreateString
WindowsStringHasEmbeddedNull
HSTRING_UserUnmarshal
HSTRING_UserMarshal
HSTRING_UserFree
WindowsDuplicateString

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient8
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
CStdStubBuffer2_QueryInterface
ObjectStublessClient7
CStdStubBuffer2_Disconnect
ObjectStublessClient3
CStdStubBuffer2_CountRefs
NdrProxyForwardingFunction3
ObjectStublessClient6
CStdStubBuffer2_Connect

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameA
FreeLibraryAndExitThread
FreeLibrary

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-com-l1-1-1

CoReleaseMarshalData
CoCreateInstance
CoGetApartmentType
CoTaskMemFree
CoMarshalInterface
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoCreateGuid
CoWaitForMultipleHandles
RoGetAgileReference
CoGetInterfaceAndReleaseStream
CreateStreamOnHGlobal
CoCreateFreeThreadedMarshaler

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError
RoReportFailedDelegate
RoTransformError
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
RoOriginateErrorW
IsErrorPropagationEnabled

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSRWLockShared
CreateMutexExW
ReleaseMutex
CreateEventExW
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreExW
AcquireSRWLockExclusive
AcquireSRWLockShared
SetEvent
ReleaseSRWLockExclusive
Sleep
InitOnceExecuteOnce

api-ms-win-core-errorhandling-l1-1-1

GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processthreads-l1-1-2

TlsAlloc
TlsFree
TlsGetValue
TerminateProcess
GetCurrentProcess
CreateThread
OpenProcess
OpenProcessToken
TlsSetValue
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegGetValueW

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetLocaleInfoW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-path-l1-1-0

PathCchCombineEx

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
CallbackMayRunLong
FreeLibraryWhenCallbackReturns

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-file-l1-2-1

CreateFile2
GetFileSizeEx
ReadFile

api-ms-win-rtcore-ntuser-window-l1-1-0

TranslateMessage
PeekMessageW
PostThreadMessageW
DispatchMessageW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-shcore-thread-l1-1-0

SHGetThreadRef
SHSetThreadRef
SHCreateThreadRef

api-ms-win-shell-shellfolders-l1-1-0

SHGetKnownFolderPath

ntdll

RtlPublishWnfStateData

api-ms-win-core-url-l1-1-0

UrlEscapeW
GetAcceptLanguagesW

api-ms-win-core-localization-obsolete-l1-3-0

GetSystemDefaultUILanguage

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
FreeErrorDetails
GetErrorDetails

Sections

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a68fcaf47da665c8490079e6b31a2909

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-shcore-thread-l1-1-0

api-ms-win-shell-shellfolders-l1-1-0

ntdll

api-ms-win-core-url-l1-1-0

api-ms-win-core-localization-obsolete-l1-3-0

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 112KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 7KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 112KB - Virtual size: 112KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 7KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB