AudioEng[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AudioEng.dll
Size

364KB
MD5

7a0b93b80930a23e8add9d4b3416352f
SHA1

65c0f9ddfd73836b8905c0356e93d30492373ba2
SHA256

1faa96c893b979f422dc31c130ea20d8ee83af7e49928ff9e983e9a9324c12a2
SHA512

8d28cf69bb91e185bcbf1990444a256cb2ac568190754fd1079d88456999d2db1a1aef33fdf6d0024037bbcb8e47dc1fb58474ad4bb825b0d23ec7b144180189
SSDEEP

6144:JoxPub0NaJ1xBFa3D2Au7qbUxkU8d5SfulGhD1oQvcpsMmbXP1R2uMeW8m+1:JZ0Q/azNQO15sqjB62uM5c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AudioEng.dll

Files

AudioEng.dll
.dll regsvr32 windows:6 windows x86 arch:x86

853aa319622b88f8ef8155ef7a72d74d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AUDIOENG.pdb

Imports

msvcrt

_finite
ceil
_CIexp
_CIsqrt
_CIcos
??_V@YAXPAX@Z
malloc
free
memcpy_s
_CxxThrowException
_CIpow
_CIsin
floor
wcscpy_s
_ftol2_sse
wcscat_s
__CxxFrameHandler3
_purecall
_ftol2
??2@YAPAXI@Z
??_U@YAPAXI@Z
memset
memmove_s
calloc
_resetstkoflw
_XcptFilter
_initterm
_amsg_exit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_isnan
_vsnwprintf
memcpy
wcsncpy_s
??3@YAXPAX@Z
_except_handler4_common
realloc
_errno
_unlock
__dllonexit
_lock
_onexit

ntdll

NtSetTimerResolution
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwLogTraceEvent
RtlNtStatusToDosError
NtQueryInformationProcess
RtlCreateMemoryBlockLookaside
RtlUnlockCurrentThread
RtlLockCurrentThread
RtlUnlockModuleSection
RtlLockModuleSection
RtlUnlockMemoryBlockLookaside
RtlLockMemoryBlockLookaside
RtlFreeMemoryBlockLookaside
RtlAllocateMemoryBlockLookaside
RtlDestroyMemoryBlockLookaside
RtlExtendMemoryBlockLookaside

kernel32

WaitForSingleObject
ResetEvent
InterlockedCompareExchange64
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
CloseHandle
GetModuleFileNameW
QueryPerformanceFrequency
DisableThreadLibraryCalls
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
CreateEventA
LoadLibraryExW
SetThreadLocale
GetThreadLocale
GetVersionExA
InterlockedExchange
SetWaitableTimer
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringA
SetEvent
SetProcessWorkingSetSize
CancelWaitableTimer
GetCurrentThread
WaitForMultipleObjects
SetThreadPriority
CreateThread
CreateWaitableTimerA
FindResourceW

ole32

CoDisconnectObject
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

VarUI4FromStr
SysFreeString
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi

advapi32

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
RegGetValueA
RegQueryValueExW
RegDeleteKeyExW
TraceEvent
RegEnumKeyExW
RegQueryInfoKeyW

user32

UnregisterClassA
CharNextW

avrt

AvQuerySystemResponsiveness
AvSetMmThreadPriority
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsA

Exports

Exports

AERT_Allocate
AERT_Free
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_CONST
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

853aa319622b88f8ef8155ef7a72d74d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

ole32

oleaut32

advapi32

user32

avrt

Exports

Exports

Sections

.text Size: 276KB - Virtual size: 275KB

RT_CODE Size: 20KB - Virtual size: 20KB

RT_BSS Size: - Virtual size: 40B

.data Size: 46KB - Virtual size: 45KB

RT_DATA Size: 3KB - Virtual size: 3KB

RT_CONST Size: 2KB - Virtual size: 1KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 276KB - Virtual size: 275KB

RT_CODE
Size: 20KB - Virtual size: 20KB

RT_BSS
Size: - Virtual size: 40B

.data
Size: 46KB - Virtual size: 45KB

RT_DATA
Size: 3KB - Virtual size: 3KB

RT_CONST
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 8KB - Virtual size: 8KB