iashlpr[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

iashlpr.dll
Size

73KB
MD5

afd07b5b23958793d3addd62b351c19a
SHA1

dd0dc618fc0782eef580ef02a59f5b9e9fffc91a
SHA256

4aa57f65392c7f77a3e483ef5bc7fce79e0defa4eb1d5d7088ff2d2da9b8a74e
SHA512

c6705bdf001f64a9c7647c2955ccb20ea71f266b640a7e5a315e5a84f173fa506023333e1b502cd1a5fb186cc2e5b78edd8ea393484cb237e5f9a5b99010fe9d
SSDEEP

768:lse7lWf3D9/Ba18OxTdCEXphhBdRwqGqhKaLhra2UR2MYTY9V5LXeIMof0LBmefW:2SWCOW08phhXFGfrV1SIz8tf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
iashlpr.dll

Files

iashlpr.dll
.dll regsvr32 windows:10 windows x86 arch:x86

7e3c98d300777d33c84005567d7eaaa9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

iashlpr.pdb

Imports

msvcrt

?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
_XcptFilter
_amsg_exit
??1exception@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
??1type_info@@UAE@XZ
memcpy
??0exception@@QAE@ABV0@@Z
_callnewh
malloc
free
_purecall
_CxxThrowException
_initterm
__CxxFrameHandler3
wcscpy_s
wcscspn
wcscat_s
_snprintf_s
_wcsupr_s
wcsrchr
swprintf_s
_wcsicmp
wcschr
_strnicmp
vsprintf_s
memset

atl

ord32
ord21
ord15
ord18
ord22
ord16

iasrad

?initialize@VSAFilter@@QAEJXZ
?radiusToIAS@VSAFilter@@QBEJPAUIAttributesRaw@@@Z
?radiusFromIAS@VSAFilter@@QBEJPAUIAttributesRaw@@H@Z
?shutdown@VSAFilter@@QAEJXZ

iassvcs

IASReportSecurityEvent
IASRegisterComponent
IASReportEvent

advapi32

CreateWellKnownSid
OpenSCManagerA
QueryServiceStatusEx
OpenServiceA
FreeSid
LookupAccountSidW
AllocateAndInitializeSid
StartServiceW
QueryServiceStatus
TraceMessage
OpenSCManagerW
OpenServiceW
CloseServiceHandle
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

kernel32

LocalFree
UnhandledExceptionFilter
GetCurrentProcess
SetUnhandledExceptionFilter
GetModuleHandleW
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetComputerNameExW
InitializeCriticalSectionAndSpinCount
SetThreadStackGuarantee
GetLastError
FileTimeToSystemTime
FormatMessageW
InitializeCriticalSection
DeleteCriticalSection
Sleep
SetEvent
CreateEventW
WaitForSingleObjectEx
CloseHandle
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
DisableThreadLibraryCalls
CreateTimerQueue
DeleteTimerQueueEx
SleepEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
WideCharToMultiByte
VirtualProtect
VirtualAlloc
VirtualQuery
GetSystemInfo
GetModuleFileNameW
GetCurrentThreadId

oleaut32

VariantInit
SetErrorInfo
LoadRegTypeLi
SysAllocStringByteLen
SysAllocString
SysStringLen
SysFreeString
VariantClear

rtutils

TraceDumpExA
TraceVprintfExA
TraceDeregisterW
TraceRegisterExW

ws2_32

GetNameInfoW
WSACleanup
WSAStartup
GetAddrInfoW
FreeAddrInfoW
WSAGetLastError

rpcrt4

RpcStringFreeW
RpcBindingSetOption
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcAsyncInitializeHandle
I_RpcExceptionFilter
RpcBindingFree
NdrAsyncClientCall2
NdrClientCall4
RpcAsyncCompleteCall
RpcAsyncCancelCall

api-ms-win-core-com-l1-1-0

CLSIDFromProgID
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoGetClassObject

ntdll

RtlFreeHeap
RtlImageNtHeader
RtlAllocateHeap

Exports

Exports

AllocateAttributes
ConfigureIas
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DoRequest
DoRequestAsync
FreeAttributes
GetOptionIas
InitializeIas
MemAllocIas
MemFreeIas
MemReallocIas
SetOptionIas
ShutdownIas

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e3c98d300777d33c84005567d7eaaa9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

atl

iasrad

iassvcs

advapi32

kernel32

oleaut32

rtutils

ws2_32

rpcrt4

api-ms-win-core-com-l1-1-0

ntdll

Exports

Exports

Sections

.text Size: 51KB - Virtual size: 51KB

.data Size: 512B - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 11KB - Virtual size: 11KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 51KB - Virtual size: 51KB

.data
Size: 512B - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 11KB - Virtual size: 11KB

.reloc
Size: 4KB - Virtual size: 4KB