console[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

console.dll
Size

141KB
MD5

e3cf46dc8065578fd0ca6e56f31b5f15
SHA1

0743d668930231d757c78981be5ea37d5ff84811
SHA256

0c297cf0080d4acab4309b0ef786f03dee012ecfe0f67b7c05a8b057f756f099
SHA512

50382556086a5a8c5841477a2c4be72ec5ab9af37e35bd726ba3c828c2b0f0c528c147b74159cb583c49e2181ab8b08ac78f055794d2a2ff1e4317ec0fcd09b6
SSDEEP

3072:IB07RZYX8cXkuNnvl55Tyv4mPAYkYLH3BSjyGpmn:IB0j9cXkuFtUAY/H3gmj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
console.dll

Files

console.dll
.dll windows:10 windows x86 arch:x86

fd8f7f8178a7a678c0af9b2ee87d1f2c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

console.pdb

Imports

msvcp_win

?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__callnewh
memmove
_o_free
_o_iswdigit
_o_malloc
_except_handler4_common
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
_o__cexit
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
FreeLibrary
GetModuleHandleA
LoadStringW

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
WaitForSingleObject
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSemaphore
ReleaseSRWLockShared
WaitForSingleObjectEx
SetEvent
CreateEventExW
ReleaseMutex
InitializeCriticalSectionEx
LeaveCriticalSection
CreateMutexExW
ReleaseSRWLockExclusive
EnterCriticalSection
DeleteCriticalSection
OpenSemaphoreW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetStartupInfoW
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

GetCPInfoExW
GetOEMCP
FormatMessageW
IsValidCodePage

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-com-l1-1-0

PropVariantClear
CoCreateFreeThreadedMarshaler
StringFromCLSID
CoTaskMemFree
CoWaitForMultipleHandles
IIDFromString
CoInitializeEx
CoUninitialize

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCloseKey
RegQueryValueExW
RegOpenCurrentUser

api-ms-win-shcore-registry-l1-1-0

SHSetValueW

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-ntuser-sysparams-l1-1-0

GetMonitorInfoW
GetSystemMetrics

api-ms-win-shell-namespace-l1-1-0

ILFree
SHCreateItemFromIDList

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFileInfoW

api-ms-win-core-registryuserspecific-l1-1-0

SHRegGetBoolUSValueW

api-ms-win-rtcore-ntuser-window-l1-1-0

GetWindowTextW
SetWindowTextW
DefWindowProcW
ScreenToClient
GetClientRect
MoveWindow
SetWindowPos
IsWindow
GetWindowLongW
ShowWindow
IsWindowVisible
IsChild
GetFocus
SetFocus
EnableWindow
UnregisterClassW
GetWindowRect
SendMessageW
GetParent
SetWindowLongW
CreateWindowExW
RegisterClassW

api-ms-win-ntuser-rectangle-l1-1-0

SetRect
InflateRect

ext-ms-win-gdi-dc-l1-2-0

GetObjectW
GetStockObject
SelectObject

ext-ms-win-gdi-dc-create-l1-1-0

CreateCompatibleDC
DeleteDC

ext-ms-win-gdi-draw-l1-1-1

PatBlt
SetBkColor

ext-ms-win-gdi-draw-l1-1-0

CreateSolidBrush
CreateCompatibleBitmap
BitBlt

ext-ms-win-gdi-font-l1-1-0

CreateFontIndirectW
EnumFontFamiliesExW
GetTextMetricsW
TranslateCharsetInfo

ext-ms-win-gdi-font-l1-1-1

SetTextColor
GetTextFaceW

ext-ms-win-gdi-font-l1-1-2

GetTextExtentPoint32W

ext-ms-win-ntuser-dialogbox-l1-1-2

SetDlgItemInt
GetNextDlgTabItem
CheckRadioButton
GetDlgItemInt

ext-ms-win-ntuser-dialogbox-l1-1-0

GetDlgCtrlID
SendDlgItemMessageW
MessageBoxW
GetDlgItem
CheckDlgButton
IsDlgButtonChecked
SetDlgItemTextW
GetDlgItemTextW

ext-ms-win-ntuser-draw-l1-1-1

LoadBitmapW

ext-ms-win-ntuser-draw-l1-1-0

DrawFocusRect
EndPaint
InvalidateRect
BeginPaint

ext-ms-win-ntuser-keyboard-l1-1-0

GetKeyState

ext-ms-win-ntuser-gui-l1-1-0

LoadIconW
FillRect

ext-ms-win-ntuser-gui-l1-1-1

FrameRect

ext-ms-win-ntuser-misc-l1-1-0

DrawTextW
TabbedTextOutW

ext-ms-win-ntuser-window-l1-1-1

SetLayeredWindowAttributes

ext-ms-win-ntuser-window-l1-1-4

AdjustWindowRect

ext-ms-win-rtcore-gdi-object-l1-1-0

DeleteObject

ext-ms-win-rtcore-ntuser-cursor-l1-1-0

LoadCursorW

ext-ms-win-rtcore-ntuser-dc-access-l1-1-0

ReleaseDC
GetDC

ext-ms-win-rtcore-ntuser-syscolors-l1-1-0

GetSysColor

ext-ms-win-rtcore-ntuser-sysparams-l1-1-0

MonitorFromWindow
MonitorFromRect

ext-ms-win-shell-shell32-l1-2-0

ShellExecuteW

ext-ms-win-shell-shell32-l1-2-2

SHCreateShellItemArrayFromDataObject

ext-ms-win-gdi-internal-desktop-l1-1-0

GetNearestColor

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-registry-l2-1-0

RegCreateKeyW
RegOpenKeyW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

propsys

PropVariantToBoolean
PropVariantToInt16
PropVariantToUInt32

api-ms-win-shell-shellcom-l1-1-0

SHCoCreateInstance

Exports

Exports

CPlApplet
DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd8f7f8178a7a678c0af9b2ee87d1f2c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-com-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-shcore-registry-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-shell-namespace-l1-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-registryuserspecific-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-ntuser-rectangle-l1-1-0

ext-ms-win-gdi-dc-l1-2-0

ext-ms-win-gdi-dc-create-l1-1-0

ext-ms-win-gdi-draw-l1-1-1

ext-ms-win-gdi-draw-l1-1-0

ext-ms-win-gdi-font-l1-1-0

ext-ms-win-gdi-font-l1-1-1

ext-ms-win-gdi-font-l1-1-2

ext-ms-win-ntuser-dialogbox-l1-1-2

ext-ms-win-ntuser-dialogbox-l1-1-0

ext-ms-win-ntuser-draw-l1-1-1

ext-ms-win-ntuser-draw-l1-1-0

ext-ms-win-ntuser-keyboard-l1-1-0

ext-ms-win-ntuser-gui-l1-1-0

ext-ms-win-ntuser-gui-l1-1-1

ext-ms-win-ntuser-misc-l1-1-0

ext-ms-win-ntuser-window-l1-1-1

ext-ms-win-ntuser-window-l1-1-4

ext-ms-win-rtcore-gdi-object-l1-1-0

ext-ms-win-rtcore-ntuser-cursor-l1-1-0

ext-ms-win-rtcore-ntuser-dc-access-l1-1-0

ext-ms-win-rtcore-ntuser-syscolors-l1-1-0

ext-ms-win-rtcore-ntuser-sysparams-l1-1-0

ext-ms-win-shell-shell32-l1-2-0

ext-ms-win-shell-shell32-l1-2-2

ext-ms-win-gdi-internal-desktop-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-registry-l1-1-1

propsys

api-ms-win-shell-shellcom-l1-1-0

Exports

.text
Size: 89KB - Virtual size: 89KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 34KB - Virtual size: 33KB

.reloc
Size: 6KB - Virtual size: 6KB