IdCtrls[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

IdCtrls.dll
Size

92KB
MD5

2cf730676218975671b0c8f6a8db4ac3
SHA1

05e0431d0880282d4a0473907c2aa6ddab48df92
SHA256

f657f408ed99d0f98e29ead832a505694da7b85e4bc53758be2dfbed4bf79147
SHA512

2966c46010a1b74f8adbd210aa714ed237eb61a879b1cc593c2bc9495651b6c9baa9d7e82adc38f1995c5d599cf380253a77a256318241087d08faa62b2a8fac
SSDEEP

1536:YmOVpln2LkRwhWJTQDevqgoxO1PmQpJ8BHSqn5a6ByPh0L83aJ/YV1yA2vavh163:YjVpln2LmwhWxGevVoxO1PmxZSyaLCOy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IdCtrls.dll

Files

IdCtrls.dll
.dll windows:10 windows x86 arch:x86

63dae5c471dfe85e817dc8ce7bf27f9c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

IdCtrls.pdb

Imports

msvcrt

_vsnwprintf
memmove
memcpy
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
wcsrchr
wcschr
wcsstr
_purecall
_get_errno
_set_errno
_callnewh
memcpy_s
__CxxFrameHandler3
memset

shlwapi

SHStrDupW
ord219
ord487
ord204
ord165
ord172
StrChrW
ord437
UrlEscapeW
ord199
ord176

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
GetModuleHandleW
GetModuleHandleA
LockResource
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryExW
LoadResource
DisableThreadLibraryCalls
FindResourceExW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
CreateSemaphoreExW
DeleteCriticalSection
WaitForSingleObjectEx
ResetEvent
SetEvent
CreateEventW
ReleaseMutex
WaitForSingleObject
OpenSemaphoreW
InitializeCriticalSection
WaitForMultipleObjectsEx
CreateMutexExW
ReleaseSemaphore
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapReAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-localization-l1-2-0

GetUserGeoID
GetThreadPreferredUILanguages
GetGeoInfoW
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExW
GetTickCount

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-com-l1-1-0

CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoTaskMemRealloc
CoCreateInstance
PropVariantClear
CoWaitForMultipleHandles
CoTaskMemAlloc
CoGetApartmentType
StringFromGUID2
CoGetMalloc
CoTaskMemFree

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegCloseKey

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
InitOnceBeginInitialize

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlGetSuiteMask
NtPowerInformation
WinSqmAddToStream

wininet

InternetCrackUrlW

dui70

?SetVisible@Element@DirectUI@@QAEJ_N@Z
CreateTouchTooltip
?SetWidth@Element@DirectUI@@QAEJH@Z
?SetHeight@Element@DirectUI@@QAEJH@Z
?SetBackgroundColor@Element@DirectUI@@QAEJK@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?SetAccRole@Element@DirectUI@@QAEJH@Z
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
UnInitThread
StrToID
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?EndDefer@Element@DirectUI@@QAEXK@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
InitThread
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?Add@Element@DirectUI@@QAEJPAV12@@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?Create@FillLayout@DirectUI@@SGJPAPAVLayout@2@@Z
InitProcessPriv
UnInitProcessPriv
?Create@TouchHWNDElement@DirectUI@@SGJPAUHWND__@@_NIPAVElement@2@PAKPAPAV42@@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z

gdi32

CreateSolidBrush
DeleteObject

user32

IsWindowVisible
SetWindowLongW
GetWindowLongW
IsWindowUnicode
DefWindowProcW
DefWindowProcA
EnableWindow
ShowWindow
GetClientRect
UpdateWindow
SetTimer
GetKeyState
DispatchMessageW
LoadCursorW
SetCursor
GetParent
CreateWindowExW
RegisterClassW
SetWindowPos
TranslateMessage
PostQuitMessage
PeekMessageW
DestroyWindow
KillTimer
GetFocus
SetFocus
MsgWaitForMultipleObjectsEx

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63dae5c471dfe85e817dc8ce7bf27f9c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shlwapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-profile-l1-1-0

ntdll

wininet

dui70

gdi32

user32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 67KB - Virtual size: 67KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 172B

.rsrc Size: 11KB - Virtual size: 10KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 67KB - Virtual size: 67KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 172B

.rsrc
Size: 11KB - Virtual size: 10KB

.reloc
Size: 4KB - Virtual size: 4KB