ExSMime[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ExSMime.dll
Size

209KB
MD5

af629a47f2e5e8d6bd2ce7a715001ce9
SHA1

8c4dbc4e18f9a1beb1b7684bb9d2e1c605c9c2fd
SHA256

d6a934c2afffad9a246a1e3f502c505dc246bbf976ff9d44317d0229b778f04f
SHA512

8de4f31e14b36bbdf9ecaa0df3080373480a55bd21a1340e7326e736f584eb334aac15ca3ce7677a0f54dfde33bb011c6d21d04bce79da8d3eb733a5d629be54
SSDEEP

6144:qUAlOrND2w7PWdd3yQzUug/bEBCg3eGbV4EZ1:qUYs9a5UugTEBCzCVN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExSMime.dll

Files

ExSMime.dll
.dll regsvr32 windows:10 windows x86 arch:x86

7a1ca0f2d4ddff1a89f1bd5c6323c035

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

exsmime.pdb

Imports

msvcrt

wcsncpy_s
wcscat_s
_snprintf_s
strchr
realloc
_errno
_ultoa_s
_callnewh
_except_handler4_common
_initterm
_unlock
_amsg_exit
__dllonexit
_XcptFilter
_onexit
memcmp
free
strcpy_s
_lock
malloc
wcscpy_s
_purecall
memcpy_s
memchr
memset

oleaut32

VariantChangeType
VariantInit
SysAllocString
VariantCopy
VarCmp
VarUI4FromStr
VariantClear
SysStringLen
SysFreeString

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

api-ms-win-core-url-l1-1-0

PathIsURLW
UrlIsW
PathCreateFromUrlW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
FindResourceExW
FreeLibrary
LoadResource
SizeofResource
GetProcAddress
LoadLibraryExW
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyExA
RegCreateKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegQueryValueExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-file-l1-1-0

GetFileInformationByHandle
FlushFileBuffers
SetEndOfFile
WriteFile
CreateFileW
FileTimeToLocalFileTime
SetFilePointerEx
GetTempFileNameW
ReadFile

api-ms-win-core-localization-l1-2-0

IsDBCSLeadByteEx

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNA
StrCmpNIA

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a1ca0f2d4ddff1a89f1bd5c6323c035

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 192KB - Virtual size: 191KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 192B

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 192KB - Virtual size: 191KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 192B

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 10KB - Virtual size: 9KB