wbhstipm[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

wbhstipm.dll
Size

31KB
MD5

425d0e4f552fb6c3bdb093faa2afc30e
SHA1

509ca8f23f5c9f9234dee52d302c38ef8e933a72
SHA256

d1f5047df5ae53b6e29d34b89a4d01101fb127d9a254ab4e06b969335a75b2e7
SHA512

96de77b0a8a02849b7e9d6cc2c5c1fafab19beb20c21b7325bf7861780ad385290623b1e040e5a9132e1147cd001043a896289d4bc5d92360b9e60a64b7e5842
SSDEEP

768:t/meOm7kHmExLlTZT7YY+HyBSwiywsNcFLWzpA:nKv7YYSwfws+ZW9A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wbhstipm.dll

Files

wbhstipm.dll
.dll windows:10 windows x64 arch:x64

a7212aefbcde8e4b394b2e2cc3797c72

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wbhstipm.pdb

Imports

msvcrt

free
malloc
_callnewh
_XcptFilter
_amsg_exit
__C_specific_handler
_initterm
memcpy
memset

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
CreateEventW
ResetEvent
SetEvent
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCloseKey

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
CreateThread
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-2-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

iisutil

?Copy@STRU@@QEAAJPEBG@Z
?Append@STRU@@QEAAJAEBV1@@Z
??1BUFFER@@QEAA@XZ
ReadStringParameterValueFromAnyService
?Resize@BUFFER@@QEAA_NK@Z
??0BUFFER@@QEAA@XZ
?CreateIpmMessagePipe@IPM_MESSAGE_PIPE@@SAJPEAVIPM_MESSAGE_ACCEPTOR@@PEBGHPEAU_SECURITY_ATTRIBUTES@@PEAPEAV1@@Z
?WriteMessage@IPM_MESSAGE_PIPE@@QEAAJW4IPM_OPCODE@@KPEAX@Z
?LogEvent@EVENT_LOG@@QEAAXKGQEAPEBGK@Z
?DestroyIpmMessagePipe@IPM_MESSAGE_PIPE@@QEAAXXZ
?Append@STRU@@QEAAJPEBG@Z
??1IPM_MESSAGE_PIPE@@EEAA@XZ
PuCreateDebugPrintsObject
PuLoadDebugFlagsFromRegStr
PuDbgPrint
PuDbgPrintError
??0EVENT_LOG@@QEAA@PEBG@Z
PuDeleteDebugPrintsObject
??1STRU@@QEAA@XZ
??0STRU@@QEAA@XZ
IsStringEqualOrdinalIgnoreCase

Exports

Exports

??0IPM_MESSAGE_PIPE@@QEAA@AEBV0@@Z
??4IPM_MESSAGE_PIPE@@QEAAAEAV0@AEBV0@@Z
??_7IPM_MESSAGE_PIPE@@6B@
WebhostCloseAllListenerChannelInstances
WebhostGetVersion
WebhostOpenListenerChannelInstance
WebhostRegisterProtocol
WebhostUnregisterProtocol

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a7212aefbcde8e4b394b2e2cc3797c72

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-debug-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-rtlsupport-l1-2-0

iisutil

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 708B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 40B

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 708B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 40B