atlthunk[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

atlthunk.dll
Size

36KB
MD5

c2fc275a85e3d5a0bc60288fcd9a1dcd
SHA1

108ff68a09bd1997bdfa983959e261eb5d34fe6e
SHA256

9bfe69d1b1a6ba695e2e51ede9daa02a2cc825429e8ae32fb45a53cff2938818
SHA512

9e10e84a016232dcde1d1f66f1e15b6d3a0f05b7272f33b7f8523e210fc1e8f99fd1f0efbacd0396fda252ae738226cd0278b89bcc84ebbbf85e7cbd16d97cf9
SSDEEP

384:bx8MgAioSoI3gxq+s7b7AU0OOOEkDKZ5Czzzo8cGkxGAAvoFFsjDj0oouuuY4naD:bxN/XXCRrP8TGs8/WtS9W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
atlthunk.dll

Files

atlthunk.dll
.dll windows:10 windows x86 arch:x86

e60640221abf28fcf2f6ba5fc570c445

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

atlthunk.pdb

Imports

ntdll

NtClose
RtlAcquireSRWLockExclusive
LdrDisableThreadCalloutsForDll
RtlFreeHeap
NtAreMappedFilesTheSame
RtlReleaseSRWLockExclusive
RtlAllocateHeap

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
VirtualProtect
MapViewOfFile

api-ms-win-core-errorhandling-l1-1-0

SetLastError

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameW

api-ms-win-core-file-l1-1-0

CreateFileW

Exports

Exports

AtlThunk_AllocateData
AtlThunk_DataToCode
AtlThunk_FreeData
AtlThunk_InitData

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 754B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ