capisp[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

capisp.dll
Size

20KB
MD5

75a603d846a301bc80db16dd0b5ef187
SHA1

2cf5c64444d8f21cdb161b79d90c2d3d2fb9bcd1
SHA256

7396e18969490bd0786a48a6f50056c6e0cd42dd7d98d0eefc8eaca10d21c087
SHA512

0b7e6f4537fe606fcae3f81b42dfc91a8268ff1f00a3d590675e2a5d6526e00f9000073495e86c33b3d61725a7f995cb8b53007300d65da69cf7852011775a59
SSDEEP

384:NfbjK+tBNmwV8J7e+JDla2axkOS3Ch4AV+ZfKySqfTAR0ZZ0WcWghW2:x7ala2axvONHrSeTHZZcT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
capisp.dll

Files

capisp.dll
.dll windows:10 windows x86 arch:x86

5533cb9574ce75d3ac71fa3b540f95c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

capisp.pdb

Imports

msvcrt

_wcsicmp
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
swprintf_s
memset

api-ms-win-core-file-l1-1-0

FindFirstFileW
FindClose
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
FindNextFileW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegGetValueW

rpcrt4

UuidFromStringW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-string-l2-1-0

CharNextW
CharPrevW

userenv

GetProfilesDirectoryW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetVersionExW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
FreeLibrary
GetProcAddress

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
SetCurrentDirectoryW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

wdscore

WdsSetupLogMessageW
CurrentIP
ConstructPartialMsgVW

dpapi

CryptResetMachineCredentials

advapi32

LsaOpenPolicy
LsaQueryInformationPolicy
LsaClose
LsaFreeMemory

kernel32

lstrcmpW

ntdll

RtlInitUnicodeString
NtClose
NtOpenFile

samlib

SamCloseHandle
SamFreeMemory
SamConnect
SamSetInformationUser
SamQueryInformationUser
SamOpenDomain
SamOpenUser

syssetup

WaitForSamService

Exports

Exports

CAPISysPrep_Generalize
CryptoSysPrep_Clean
CryptoSysPrep_Specialize
CryptoSysPrep_Specialize_Clone
CryptoSysPrep_Specialize_Offline

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5533cb9574ce75d3ac71fa3b540f95c9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

rpcrt4

api-ms-win-core-io-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-string-l2-1-0

userenv

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

wdscore

dpapi

advapi32

kernel32

ntdll

samlib

syssetup

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 844B

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 936B

.text
Size: 13KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 844B

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 936B