dskquota[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

dskquota.dll
Size

100KB
MD5

0b34dedcfe29ee0a24e97359e60b3fe3
SHA1

5a57b33f8994e4a56b6f027ef87c815f832d583a
SHA256

288de692e1434649f28f3a3046caeeaa9d7343b9389365d87274461c627f9814
SHA512

c1202d77ddaa3d6225d2098012d9ed0633240cb9cf05d3cdc97888b13aad5a80bb55e0cdc23cf05f362666030842a81b8eef6979f65d91700529b65f4bc6edef
SSDEEP

1536:J3DR3OmiEWG9vctu4DyFFFHMzwGo3WaS/IkhIcfyR/u0LM/KLuYnzlBdZ+jl:JUmDWVXDyFH0wGCoI2sMC6YvIl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dskquota.dll

Files

dskquota.dll
.dll windows:10 windows x86 arch:x86

8a332e1ce75f89e513ca8cbe8587d3a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dskquota.pdb

Imports

msvcrt

memcpy
memcmp
_ftol2
_CxxThrowException
memmove
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__CxxFrameHandler3
_unlock
_lock
?terminate@@YAXXZ
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
__dllonexit
memset

shell32

SHGetKnownFolderPath

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockExclusive
CreateEventW
ReleaseSemaphore
ReleaseMutex
CreateSemaphoreExW
CreateMutexW
SetEvent
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
CreateThread
TerminateProcess
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
FormatMessageW
GetThreadLocale

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

oleaut32

DispGetIDsOfNames
SysAllocString
VariantInit
LoadRegTypeLi

api-ms-win-security-base-l1-1-0

EqualSid
CopySid
GetLengthSid
IsValidSid

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-core-file-l1-1-0

CreateDirectoryW
GetDriveTypeW
GetVolumeInformationW
CreateFileW
GetFileAttributesW
SetFileAttributesW
GetLogicalDriveStringsW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-com-l1-1-0

CoCreateGuid
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTime
GetSystemTimeAsFileTime

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

logoncli

NetGetDCName

samcli

NetUserGetInfo

netutils

NetApiBufferFree

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW
LookupAccountSidW

advapi32

ReportEventW
DeregisterEventSource
RegisterEventSourceW

kernel32

lstrcmpiW
lstrcmpW
lstrlenW

ntdll

NtSetVolumeInformationFile
NtSetQuotaInformationFile
NtQueryQuotaInformationFile
NtQueryVolumeInformationFile

secur32

TranslateNameW

shlwapi

PathAddBackslashW
PathSkipRootW
PathAppendW
StrChrW

user32

MsgWaitForMultipleObjectsEx
DispatchMessageW
TranslateMessage
PostThreadMessageW
PeekMessageW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
ProcessGroupPolicy

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8a332e1ce75f89e513ca8cbe8587d3a2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shell32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

oleaut32

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

logoncli

samcli

netutils

api-ms-win-security-lsalookup-l2-1-0

advapi32

kernel32

ntdll

secur32

shlwapi

user32

Exports

Exports

Sections

.text Size: 77KB - Virtual size: 77KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 77KB - Virtual size: 77KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 5KB - Virtual size: 5KB