SimCfg[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

SimCfg.dll
Size

81KB
MD5

0f500f392c9df9784a9a9e341682fc24
SHA1

57e39205395897055e37c53e2bf9cae40c847d10
SHA256

0fb2c764a02c108131864404335b69eafb87d6987247941a65fa541ecf3da602
SHA512

569092e01afcbdc84167f220483fea24cdb27412be6a1b51f01c9a3a8a54e412db7adafba3113bff679b36fca8c6836401531a530c689adbb8925932ebe59700
SSDEEP

1536:2+9XV58lGKYUU03SmdJAcr0pViWNMWnzRacC+D2ixnvo:2+9XVeA7qfAcoDXN1nzRacCc2onQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SimCfg.dll

Files

SimCfg.dll
.dll windows:10 windows x86 arch:x86

87620dbe770cc84cd8d200131148cc22

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SimCfg.pdb

Imports

msvcrt

free
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_amsg_exit
_callnewh
memmove
_onexit
malloc
__dllonexit
??1type_info@@UAE@XZ
_unlock
_CxxThrowException
memcpy
??3@YAXPAX@Z
_lock
_initterm
_except_handler4_common
wcscpy_s
_beginthreadex
memcmp
_wcsicmp
_endthreadex
?what@exception@@UBEPBDXZ
?terminate@@YAXXZ
_snwprintf_s
_purecall
__CxxFrameHandler3
_XcptFilter
memset

oleaut32

SysFreeString
SysStringByteLen
VariantClear
SysAllocStringByteLen
SafeArrayGetLBound
SafeArrayGetElement
SysAllocString
SafeArrayDestroy
SafeArrayGetUBound
VariantInit

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-com-l1-1-0

StringFromIID
CoTaskMemFree
IIDFromString
CoCreateInstance
CoUninitialize
CoInitializeEx

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSection
CreateEventW
DeleteCriticalSection
ResetEvent
EnterCriticalSection
WaitForSingleObject
SetEvent

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadStringW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

ntdll

WinSqmSetDWORD

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

EapPeerConfigBlob2Xml
EapPeerConfigXml2Blob
EapPeerCredentialsXml2Blob
EapPeerFreeErrorMemory
EapPeerFreeMemory
EapPeerGetConfigBlobAndUserBlob
EapPeerGetIdentityPageGuid
EapPeerInvokeConfigUI
EapPeerInvokeIdentityUI
EapPeerInvokeInteractiveUI
InternalFunction01
InternalFunction02

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87620dbe770cc84cd8d200131148cc22

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

ntdll

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 68KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 36B

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 68KB - Virtual size: 68KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 36B

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 5KB - Virtual size: 4KB