browcli[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

browcli.dll
Size

42KB
MD5

52c1869865209499b08360fd6cac5ce4
SHA1

e671c6c136ef247de4eee56e313720170e888a14
SHA256

55ff7266051318b287be1efdf29d79f46b35044c95fd157834263c317b8ce92c
SHA512

6d4981274a7c783fe2424ec5434bd2fcdd76f52dcbca99fee7af68e708fd9431663ff4a0ab21fb8ae652510ecf8526ec2b0935c4f56e0f0ca988e0abee78a709
SSDEEP

768:j52+Ns0dQXFEYgcn7tE9LQYYI/yAuIWyQhhCiyue9lo+J+jIGR:jNNs0uX5gcn7CVRyAuIYEx9lou+jIGR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
browcli.dll

Files

browcli.dll
.dll windows:10 windows x86 arch:x86

b8e81fa15afc02e922bf3ba0e990e504

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

browcli.pdb

Imports

msvcrt

__RTDynamicCast
strcpy_s
??3@YAXPAX@Z
??1type_info@@UAE@XZ
wcscat_s
strchr
wcsncpy_s
isdigit
qsort
_wcsnicmp
wcscpy_s
_itow_s
memcpy
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wcsicmp
memset

rpcrt4

NdrClientCall4
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingFree
I_RpcExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-1-0

CreateEventW
WaitForSingleObjectEx

api-ms-win-core-handle-l1-1-0

CloseHandle

ntdll

RtlInitializeResource
RtlGetLastNtStatus
RtlNtStatusToDosError
RtlInitAnsiString
RtlOemStringToUnicodeString
RtlUnicodeToOemN
RtlxUnicodeStringToOemSize
NtOpenThreadToken
NtImpersonateAnonymousToken
NtCreateFile
NtFsControlFile
NtSetInformationThread
RtlAcquireResourceExclusive
RtlReleaseResource
RtlDeleteResource
NtOpenFile
NtDeviceIoControlFile
RtlCopyUnicodeString
NtClose
RtlInitUnicodeString

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
LocalReAlloc

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

Exports

Exports

I_BrowserDebugCall
I_BrowserDebugTrace
I_BrowserQueryEmulatedDomains
I_BrowserQueryOtherDomains
I_BrowserQueryStatistics
I_BrowserResetNetlogonState
I_BrowserResetStatistics
I_BrowserServerEnum
I_BrowserSetNetlogonState
NetBrowserStatisticsGet
NetServerEnum
NetServerEnumEx

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8e81fa15afc02e922bf3ba0e990e504

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

ntdll

api-ms-win-core-heap-l2-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-timezone-l1-1-0

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 34KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 60B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 34KB - Virtual size: 34KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 60B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB