MsCtfMonitor[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MsCtfMonitor.dll
Size

68KB
MD5

c3ac3f3f607cb216368db6d5630c09a2
SHA1

5e1585f26bcc9e1a5ce1a327174021aa316b006f
SHA256

dfaf3de86e1a2ab9822ff5e3ef4d19595d2803eda429c4f6fa677a3919e4e6bc
SHA512

58d3d8422ba8083bd707a0a621b8535f2a1b5f9b6a1090454c671084dd3dc2589e4bdfaad4fb4ac6cffe2145a190b10431cf2ea032ec0d9ab7cefe02c5e3a8ba
SSDEEP

1536:+T5YS8K5pxcUEg6YJlMAGmCeCDDUgLpLvfbWet0:7S8KBTWAG4CHJVLvfbWe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MsCtfMonitor.dll

Files

MsCtfMonitor.dll
.dll regsvr32 windows:10 windows x86 arch:x86

2bf09104a2861ed02f94095cbb326965

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MsCtfMonitor.pdb

Imports

msvcrt

malloc
_initterm
_lock
_amsg_exit
memcpy_s
_XcptFilter
memmove_s
__dllonexit
_onexit
_except_handler4_common
memcmp
free
_vsnwprintf
_unlock
memset

msctf

TF_CreateCicLoadWinStaMutex
TF_CreateCTFWatchdogMutex
TF_CreateCicLoadMutex
TF_UninitSystem
TF_InitSystem
TF_PostAllThreadMsg

msutb

ClosePopupTipbar
GetPopupTipbar

ntdll

RtlUnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegQueryValueExW
RegDeleteKeyExW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegEnumKeyExW

api-ms-win-core-processthreads-l1-1-0

CreateThread
SetProcessShutdownParameters
GetCurrentProcessId
TlsAlloc
TlsSetValue
TerminateProcess
GetCurrentProcess
TlsGetValue
TerminateThread
GetCurrentThreadId
TlsFree

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD
SetSecurityDescriptorDacl

kernel32

EnterCriticalSection
LoadLibraryExW
LocalFree
LocalAlloc
lstrlenW
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
ResetEvent
GetProductInfo
GetVersionExW
LoadLibraryW
WaitForMultipleObjects
CreateMutexW
DelayLoadFailureHook
ResolveDelayLoadedAPI
RaiseFailFastException
GetSystemDirectoryW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
CreateSemaphoreExW
LeaveCriticalSection
CreateMutexExW
InitOnceComplete
InitOnceBeginInitialize
FreeLibraryAndExitThread
FreeLibrary
CreateEventW
CreateThreadpoolTimer
OpenSemaphoreW
WaitForSingleObject
InitializeCriticalSectionEx
WaitForSingleObjectEx
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
ReleaseMutex
ReleaseSemaphore
SetLastError
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OutputDebugStringW
IsDebuggerPresent
GetProcAddress
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapAlloc
DeleteCriticalSection
OpenEventW
SetEvent
CloseHandle
GetLastError
GetModuleHandleW
FormatMessageW
HeapFree
GetProcessHeap

user32

PostQuitMessage
CreateWindowExW
UnregisterClassW
RegisterClassExW
LoadCursorW
DestroyWindow
DefWindowProcW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
SetWindowPos
LoadStringW
SetThreadDesktop
GetKeyboardLayoutList
GetThreadDesktop
KillTimer
SetTimer
FindWindowW
PostMessageW
DispatchMessageW

imm32

ImmDisableIME

api-ms-win-core-com-l1-1-0

StringFromCLSID
CoTaskMemFree

winsta

WinStationQueryInformationW

api-ms-win-service-management-l1-1-0

StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DoMsCtfMonitor
InitLocalMsCtfMonitor
UninitLocalMsCtfMonitor

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2bf09104a2861ed02f94095cbb326965

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

msctf

msutb

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

kernel32

user32

imm32

api-ms-win-core-com-l1-1-0

winsta

api-ms-win-service-management-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-sddl-l1-1-0

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 55KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 12B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 56KB - Virtual size: 55KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 12B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB