dsdmo[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dsdmo.dll
Size

179KB
MD5

dc46d4a4bf3b12dda1b678e246295184
SHA1

2ecc72805b1cd47f1ec8a22db5ed348fb3e5d253
SHA256

8d4102fbb5900acdcc78b65ae16f2a06fe3db49c427c1868f21ad29a26bd0239
SHA512

fb124a8c51e7b6fc466e7600804065eaa48c5de6e19e9a0248b26c3f647e9e81758b6155128160a333e216e09514d1124d367b9fd15694a9c033c153d4fe72c1
SSDEEP

3072:TUY078dw9007RY+5C9fFITtHZQyZrjUBexafMcqpHU78pgtyqr2e4/TzjLZr:4Y078dw9007RY+5C9fFI7jlafEUsgtyt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dsdmo.dll

Files

dsdmo.dll
.dll regsvr32 windows:10 windows x86 arch:x86

c04881281f01d62582b6996cb9cee399

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dsdmo.pdb

Imports

msvcrt

_XcptFilter
free
_amsg_exit
malloc
_vsnwprintf
_initterm
_except_handler4_common
modf
_purecall
wcstombs
_callnewh
_CItan
_CIcos
_CIpow
_CIsqrt
_ftol2_sse
memset
memcpy
floor
__CxxFrameHandler3
_CIlog
_CIsin
_CIsinh
ceil

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
DisableThreadLibraryCalls

api-ms-win-core-com-l1-1-0

StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc

api-ms-win-core-registry-l1-1-0

RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA

api-ms-win-core-registry-l2-1-0

RegDeleteKeyA
RegEnumKeyA

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

msdmo

DMORegister
MoFreeMediaType
MoInitMediaType
MoCopyMediaType
DMOUnregister

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c04881281f01d62582b6996cb9cee399

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

msdmo

Exports

Exports

Sections

.text Size: 159KB - Virtual size: 158KB

.data Size: 9KB - Virtual size: 9KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 159KB - Virtual size: 158KB

.data
Size: 9KB - Virtual size: 9KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 7KB - Virtual size: 6KB