devobj[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

devobj.dll
Size

63KB
MD5

cc4ed8bea78b0dca6f217e014c3291a7
SHA1

9b24895fb1cb54a7e2a24109bf3366ec4865c7d6
SHA256

01104182e4e6fb3cf6397936d30b2ce3486967586d1b94187b59a8232dae39ff
SHA512

30d88e627987e9f2ac8558393ba267a435600c0dc26c04a98fbdc678ec6235ef5c6dfa323d3816689a4c758992bd040f20e42e70c6a36948d3eb40bc20bfbddd
SSDEEP

768:CMJe3ixyXiNzUTgbxcs1LmbHpEz0FSPcuV6gj8BRRLIReJ7DsWl:CMsSZFjpLCp18cVgwBRseJ7Dso

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
devobj.dll

Files

devobj.dll
.dll windows:6 windows x86 arch:x86

44b79a447697715c64ead179c9ade7ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

devobj.pdb

Imports

msvcrt

wcschr
_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
memcpy
_wcsicmp
_resetstkoflw
memset
wcsrchr

ntdll

EtwTraceMessage
RtlNtStatusToDosError
RtlGUIDFromString
RtlInitUnicodeString

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-interlocked-l1-1-0

InterlockedExchange
InterlockedCompareExchange

api-ms-win-core-libraryloader-l1-1-0

FreeLibrary
LoadLibraryExA
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-localregistry-l1-1-0

RegEnumKeyExW
RegCloseKey

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-misc-l1-1-0

Sleep
lstrlenW
lstrcmpiW

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx
ReleaseMutex

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

cfgmgr32

CM_Get_DevNode_Registry_Property_ExW
CM_Set_DevNode_Registry_Property_ExW
CM_Delete_Device_Interface_Key_ExW
CM_Open_Device_Interface_Key_ExW
CM_Get_DevNode_Property_ExW
CM_Delete_DevNode_Key_Ex
CM_Get_Class_Property_ExW
CM_Set_Class_Property_ExW
CM_Get_Device_Interface_Property_Keys_ExW
CM_Get_Device_Interface_Property_ExW
CM_Set_Device_Interface_Property_ExW
CM_Get_DevNode_Property_Keys_Ex
CM_Set_Class_Registry_PropertyW
CM_Set_DevNode_Property_ExW
CM_Get_Class_Registry_PropertyW
CM_Disconnect_Machine
CM_Get_Class_Name_ExW
CM_Enumerate_Classes_Ex
CM_Connect_MachineW
CM_Locate_DevNode_ExW
CM_Uninstall_DevNode_Ex
CM_Create_DevNode_ExW
CM_Get_Device_ID_List_Size_ExW
CM_Get_Device_Interface_List_Size_ExW
CM_Get_Device_ID_List_ExW
CM_Get_Device_Interface_List_ExW
CM_Free_Log_Conf_Handle
CM_Free_Res_Des_Handle
CM_Get_Res_Des_Data_Ex
CM_Get_Next_Res_Des_Ex
CM_Get_First_Log_Conf_Ex
CM_Get_Device_ID_ExW
CM_Get_Device_ID_Size_Ex
CM_Register_Device_Interface_ExW
CM_Unregister_Device_Interface_ExW
CM_Open_Class_Key_ExW
CM_Get_Parent_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Device_Interface_Alias_ExW
CM_Open_DevNode_Key_Ex
CM_Get_Class_Property_Keys_Ex

kernel32

MapViewOfFile
CreateFileMappingW
SetEndOfFile
CreateDirectoryW
GetFileAttributesW
GetFullPathNameW
DelayLoadFailureHook
CloseHandle
WaitForSingleObjectEx
CreateEventW
SetEvent
RaiseException
GetSystemWindowsDirectoryW
LCMapStringW
CompareStringW
UnmapViewOfFile
GetThreadLocale
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
CreateMutexW
SetFilePointer

Exports

Exports

DevObjBuildClassInfoList
DevObjClassGuidsFromName
DevObjClassNameFromGuid
DevObjCreateDevRegKey
DevObjCreateDeviceInfo
DevObjCreateDeviceInfoList
DevObjCreateDeviceInterface
DevObjCreateDeviceInterfaceRegKey
DevObjDeleteAllInterfacesForDevice
DevObjDeleteDevRegKey
DevObjDeleteDevice
DevObjDeleteDeviceInfo
DevObjDeleteDeviceInterfaceData
DevObjDeleteDeviceInterfaceRegKey
DevObjDestroyDeviceInfoList
DevObjEnumDeviceInfo
DevObjEnumDeviceInterfaces
DevObjGetClassDescription
DevObjGetClassDevs
DevObjGetClassProperty
DevObjGetClassPropertyKeys
DevObjGetClassRegistryProperty
DevObjGetDeviceInfoDetail
DevObjGetDeviceInfoListClass
DevObjGetDeviceInfoListDetail
DevObjGetDeviceInstanceId
DevObjGetDeviceInterfaceAlias
DevObjGetDeviceInterfaceDetail
DevObjGetDeviceInterfaceProperty
DevObjGetDeviceInterfacePropertyKeys
DevObjGetDeviceProperty
DevObjGetDevicePropertyKeys
DevObjGetDeviceRegistryProperty
DevObjLocateDevice
DevObjOpenClassRegKey
DevObjOpenDevRegKey
DevObjOpenDeviceInfo
DevObjOpenDeviceInterface
DevObjOpenDeviceInterfaceRegKey
DevObjRegisterDeviceInfo
DevObjRemoveDeviceInterface
DevObjSetClassProperty
DevObjSetClassRegistryProperty
DevObjSetDeviceInfoDetail
DevObjSetDeviceInterfaceDefault
DevObjSetDeviceInterfaceProperty
DevObjSetDeviceProperty
DevObjSetDeviceRegistryProperty

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44b79a447697715c64ead179c9ade7ac

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

cfgmgr32

kernel32

Exports

Exports

Sections

.text Size: 55KB - Virtual size: 55KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 55KB - Virtual size: 55KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB