CompPkgSup[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CompPkgSup.dll
Size

161KB
MD5

baed1f4e6b94df35b0c5f93337a43e46
SHA1

aef72e90d528836d90ef05499a166d24bfb50cb6
SHA256

3fdde314476d48c629f85012dc61977f4b9d149ac12805b70a1b67aa302a282f
SHA512

e2046e8c543d6b67dd6bf1776bd05352bb2a0f6f888f3d506df2d6f511f2f40e76d6acd2624c7ea3b193f4d0515009590fef81cdc5c522245a2c68ded423c359
SSDEEP

3072:6R4koxxjkz67vW42/JgyVS7lOown95dGgGtTbTfinsyjTzuJfjRZET:zO42/qwSBOowRGdXinhj2Z

Score

1^/10

Malware Config

Signatures

Files

CompPkgSup.dll
.dll windows:10 windows x86 arch:x86

0066b1709e2a0b195fcc3edd8b6ccf2f

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

56:d9:7f:c0:65:c8:7e:40:2d:c5:ae:48:cb:92:21:de:d0:b8:73:82:57:db:02:20:5c:a3:5d:79:29:01:e5:45
Signer

Actual PE Digest

56:d9:7f:c0:65:c8:7e:40:2d:c5:ae:48:cb:92:21:de:d0:b8:73:82:57:db:02:20:5c:a3:5d:79:29:01:e5:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CompPkgSup.pdb

Imports

msvcrt

__dllonexit
_except_handler4_common
_initterm
_onexit
memcpy
_lock
_unlock
_wcsicmp
memcmp
_vsnprintf
_purecall
memmove_s
wcsncmp
atoi
wcstombs_s
wcsrchr
_vsnwprintf
swscanf
memcpy_s
wcschr
qsort
strncpy_s
strnlen
_callnewh
__CxxFrameHandler3
_ftol2
malloc
free
_amsg_exit
_XcptFilter
realloc
memset

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableLevel
GetTraceLoggerHandle
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcess
TlsGetValue
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
TlsSetValue

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionEx
EnterCriticalSection
CreateSemaphoreExW
DeleteCriticalSection
ReleaseSemaphore
InitializeCriticalSection
LeaveCriticalSection
CreateMutexExW
OpenSemaphoreW
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringLen
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsDuplicateString
WindowsDeleteString
WindowsConcatString
WindowsGetStringRawBuffer
WindowsCreateString
WindowsIsStringEmpty

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoGetMalloc
CoTaskMemAlloc
CoGetApartmentType
CoCreateInstance
CoTaskMemFree

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegEnumKeyExW
RegGetValueW
RegCloseKey

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-security-base-l1-1-0

EqualSid

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

ntdll

NtQueryInformationToken
RtlInitUnicodeString
RtlFreeHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlIsMultiUsersInSessionSku
RtlDeriveCapabilitySidsFromName
RtlAllocateHeap

api-ms-win-appmodel-runtime-l1-1-0

PackageFamilyNameFromFullName

api-ms-win-appmodel-runtime-internal-l1-1-1

GetPackageStatusForUser

combase

ord135
ord139

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AreDvdCodecsEnabled
GetMediaComponentPackageInfo
GetMediaExtensionCommunicationFactory
GetNetworkRequestCount
GetServerForPMP
InstantiateComponentFromPackage
IsMediaBehaviorEnabled
RegisterServerForPMP
RequireNetworkDuringMediaTaskCompletion
UnregisterServerForPMP

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0066b1709e2a0b195fcc3edd8b6ccf2f

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

56:d9:7f:c0:65:c8:7e:40:2d:c5:ae:48:cb:92:21:de:d0:b8:73:82:57:db:02:20:5c:a3:5d:79:29:01:e5:45Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

ntdll

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-appmodel-runtime-internal-l1-1-1

combase

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 131KB - Virtual size: 130KB

.data Size: 1024B - Virtual size: 4KB

.idata Size: 5KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 10KB

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

56:d9:7f:c0:65:c8:7e:40:2d:c5:ae:48:cb:92:21:de:d0:b8:73:82:57:db:02:20:5c:a3:5d:79:29:01:e5:45
Signer

.text
Size: 131KB - Virtual size: 130KB

.data
Size: 1024B - Virtual size: 4KB

.idata
Size: 5KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 10KB