es[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

es.dll
Size

265KB
MD5

f6916efc29d9953d5d0df06882ae8e16
SHA1

afe957644bc24294fa34d6ff040e5a4a6296b6a0
SHA256

ed41893960018d5ec2f7829b1de4b6967d9fd074d60b11b9eb854e3e0948ec24
SHA512

ff80ad4a0216ccae3d63e5ef83e62175cd6c18c10133e2ffcb3818b522cc4d470e9a49fa5b03c8773546febb4e122d610382151c0646a351b6919c2318888008
SSDEEP

6144:shH1+94iPgg0nfA5s2TPf5Yu24PqXN/D:s91Lhg0nfJmPRYu5PI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
es.dll

Files

es.dll
.dll windows:6 windows x86 arch:x86

db94aa40dc2250bdebbac369e0c4d614

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ES.pdb

Imports

msvcrt

_vsnwprintf
_resetstkoflw
_wcsicmp
memset
_local_unwind4
_itow
free
malloc
_ultow
wcscpy_s
__CxxFrameHandler3
_wstrdate
_wstrtime
_waccess
wcsrchr
_vsnprintf
_beginthreadex
_CIexp
_ftol2
_CIsqrt
_ftol2_sse
iswalnum
iswdigit
_wcsnicmp
iswalpha
towupper
wcsncmp
_XcptFilter
_initterm
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
memcpy

ntdll

NtOpenEvent
RtlInitUnicodeString
NtQueryEvent
RtlImageNtHeader
RtlAllocateHeap
RtlFreeHeap
RtlDelete
RtlSplay
RtlDllShutdownInProgress
RtlInitializeCriticalSectionAndSpinCount
RtlDeleteCriticalSection
RtlCreateServiceSid
RtlNtStatusToDosError

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-file-l1-1-0

GetFileAttributesW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-interlocked-l1-1-0

InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
InterlockedIncrement

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExW
GetProcAddress
LoadLibraryExA
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-localization-l1-1-0

GetUserDefaultLCID

api-ms-win-core-localregistry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegLoadKeyW
RegUnLoadKeyW
RegCreateKeyExW
RegGetValueW
RegQueryValueExW

api-ms-win-core-misc-l1-1-0

FormatMessageW
Sleep
LocalFree
lstrlenW

api-ms-win-core-processenvironment-l1-1-0

SearchPathW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
OpenProcessToken
SetThreadToken
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
CreateThread

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
ResetEvent
CreateEventW
SetEvent
InitializeCriticalSectionAndSpinCount

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-threadpool-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
GetSecurityDescriptorDacl
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
GetTokenInformation
EqualSid
GetLengthSid

ole32

CoUnmarshalInterface
CoCreateGuid
CoDisconnectContext
CoUninitialize
PropVariantClear
FreePropVariantArray
CoRegisterClassObject
CoGetObjectContext
StringFromCLSID
CoGetMalloc
CoRevokeClassObject
IIDFromString
CoGetInterceptorFromTypeInfo
CLSIDFromString
CoGetObject
StringFromGUID2
CoCreateInstance
CoEnableCallCancellation
CoDisableCallCancellation
CoSetProxyBlanket
CoCancelCall
CoTaskMemFree
CoTaskMemAlloc
CoRevertToSelf
CoImpersonateClient
CoMarshalInterface
CreateStreamOnHGlobal
PropVariantCopy
CoCopyProxy
CoGetClassObject
CoInitializeEx

oleaut32

VARIANT_UserFree
VARIANT_UserUnmarshal
VARIANT_UserMarshal
VARIANT_UserSize
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserSize
SysStringByteLen
LoadRegTypeLi
VariantCopy
SysFreeString
VariantClear
VariantInit
LoadTypeLi
SysAllocString
CreateErrorInfo
SysStringLen
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SetErrorInfo

rpcrt4

CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
NdrStubCall2
NdrStubForwardingFunction
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_Disconnect

user32

OpenWindowStationW
GetThreadDesktop
GetProcessWindowStation
CloseDesktop
CloseWindowStation
SetDlgItemTextW
EndDialog
DialogBoxParamW
SetProcessWindowStation
OpenDesktopW
SetThreadDesktop
GetDesktopWindow
GetWindowRect
GetClientRect
MapWindowPoints
SetWindowPos
LoadStringW
PeekMessageW
MsgWaitForMultipleObjectsEx
PostThreadMessageW

kernel32

OutputDebugStringW
RegNotifyChangeKeyValue
RegisterWaitForSingleObject
GetModuleHandleExW
InitializeCriticalSection
VirtualProtect
VirtualAlloc
VirtualQuery
GetVersion
IsDebuggerPresent
GetThreadContext
GetLocalTime
CreateDirectoryW
CreateProcessW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
SetFileAttributesW
DeleteFileW
FindClose
GetModuleHandleW
FindResourceW
LoadResource
LockResource
OutputDebugStringA
SetThreadPriority
GetQueuedCompletionStatus
FreeLibraryAndExitThread
CreateIoCompletionPort
QueryPerformanceFrequency
InterlockedExchangeAdd
PostQueuedCompletionStatus
ChangeTimerQueueTimer
LoadLibraryW
InterlockedCompareExchange64
LocalAlloc
ReleaseSemaphore
CreateSemaphoreW
GetSystemInfo
GetModuleFileNameW
RaiseException
DelayLoadFailureHook
UnregisterWait
RegDeleteTreeW
RegEnumKeyExW
RegDeleteValueW
GetComputerNameW
RegEnumValueW
RegSetValueExW
ExpandEnvironmentStringsW
RegQueryInfoKeyW
DebugBreak
InitOnceExecuteOnce

Exports

Exports

DllCanUnloadNow
DllGetClassObject
LCEControlServer
NotifyLogoffUser
NotifyLogonUser
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db94aa40dc2250bdebbac369e0c4d614

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localization-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-1-0

api-ms-win-security-base-l1-1-0

ole32

oleaut32

rpcrt4

user32

kernel32

Exports

Exports

Sections

.text Size: 221KB - Virtual size: 220KB

.orpc Size: 1KB - Virtual size: 1KB

.data Size: 6KB - Virtual size: 12KB

.rsrc Size: 22KB - Virtual size: 22KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 221KB - Virtual size: 220KB

.orpc
Size: 1KB - Virtual size: 1KB

.data
Size: 6KB - Virtual size: 12KB

.rsrc
Size: 22KB - Virtual size: 22KB

.reloc
Size: 12KB - Virtual size: 11KB