EsdSip[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

EsdSip.dll
Size

16KB
MD5

71f5279ec890c3d9ba48510c52e98200
SHA1

386cb61348aaa309afcbf67f3aeb0ae1466da2b5
SHA256

5e8e213d956224e5ca7d270463caba3a98b98c5ab1d5434526100b00bcafba14
SHA512

a01bb1966e2d0f9359550b649fc3ef54575b6de7fa00a13af405386fa605dad34a8ae573ba1db09018e63e676c3325c171c5b2ed152a366f512a05b1e6c921b5
SSDEEP

384:uhqq3F7NcUMeNWlgXlaWEI4qnK+M65+0zmgCNBfqt1WhRW:0cUMeLWI4g7rcEq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EsdSip.dll

Files

EsdSip.dll
.dll regsvr32 windows:10 windows x86 arch:x86

5f1f89aef61c3fb48553a3038026f8c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

esdsip.pdb

Imports

msvcrt

_except_handler4_common
_initterm
malloc
free
_amsg_exit
memcmp
_wcsnicmp
wcschr
memcpy
_XcptFilter
memset

advapi32

CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash

crypt32

CryptSIPRemoveProvider
CryptEncodeObject
CryptSIPAddProvider
CryptFindOIDInfo
CryptDecodeObject

kernel32

GetCurrentProcess
SetLastError
GetModuleFileNameW
LocalAlloc
GetLastError
DisableThreadLibraryCalls
LocalFree
GetModuleHandleW
ReadFile
VirtualFree
WriteFile
VirtualAlloc
SetEndOfFile
CreateFileW
CloseHandle
SetFilePointerEx
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
HeapFree
GetFileAttributesW
HeapAlloc
GetProcessHeap
GetFullPathNameW

ntdll

RtlFreeHeap
RtlAllocateHeap

Exports

Exports

DllCanUnloadNow
DllMain
DllRegisterServer
DllUnregisterServer
EsdSipCreateHash
EsdSipDelSignature
EsdSipGetCaps
EsdSipGetSignature
EsdSipIsMyFileType
EsdSipPutSignature
EsdSipVerifyHash

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f1f89aef61c3fb48553a3038026f8c2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

crypt32

kernel32

ntdll

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 844B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 552B

.text
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 844B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 552B