audiosrv[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

audiosrv.dll
Size

463KB
MD5

54b1d6429dd26cc434dbcca5c39f56a2
SHA1

e7aa8da3586fe63c725b7b6bba6a288e3400fe61
SHA256

a0b59e1d28eb5a5bb7e62f80f741891150f223aaf7fad383da22564ceadf232e
SHA512

fad18e14faf6f0be9c7383a96282b06837d2e0bf931c8628badbd4eb9ac5b3bd8d242badfdd0add20f7b939065575efe6962ebd57b979ac7d1cbeeedcf15c58d
SSDEEP

6144:/GLW3FqPlFYlVf6CUDs5Em/gUIi6zJ90VrR9fkv4C+Pt2+nVzyEiXNM:8T9mfF76+gUQzgn9fkv4iIGM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
audiosrv.dll

Files

audiosrv.dll
.dll windows:6 windows x86 arch:x86

666ac2807971525a4342a4c91d053d14

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AudioSrv.pdb

Imports

msvcrt

wcschr
_ftol2
_wtoi
_wcsicoll
wcsstr
wcsspn
wcscspn
_wcsupr_s
wcstoul
_CIpow
wcsncpy_s
floor
swprintf_s
towlower
vswprintf_s
_vscwprintf
_errno
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
??1type_info@@UAE@XZ
_amsg_exit
_initterm
_XcptFilter
_resetstkoflw
calloc
memmove_s
memcpy_s
memset
_vsnwprintf
memcpy
__CxxFrameHandler3
_purecall
_wcsicmp
_CxxThrowException
free
_CIlog10
realloc
malloc

ntdll

EtwLogTraceEvent
NtQueryInformationProcess
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
EtwTraceMessage
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwEventRegister
EtwEventUnregister
EtwEventWrite
ShipAssert
WinSqmAddToStreamEx
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlInitializeResource
ShipAssertMsgW

api-ms-win-core-localregistry-l1-1-0

RegSetValueExW
RegQueryValueExW
RegGetValueW

api-ms-win-core-processthreads-l1-1-0

CreateProcessW
GetCurrentProcess
ProcessIdToSessionId
TerminateProcess
GetExitCodeProcess
GetCurrentThreadId
GetCurrentProcessId
CreateThread
OpenThreadToken

api-ms-win-security-base-l1-1-0

GetTokenInformation
GetAce
AddAccessAllowedAceEx
SetSecurityDescriptorSacl
CheckTokenMembership
SetKernelObjectSecurity
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
MakeAbsoluteSD
MakeSelfRelativeSD
GetAclInformation
InitializeAcl
AddAce
CopySid
IsValidSid
GetLengthSid
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
FreeSid
AddAccessAllowedAce
AllocateAndInitializeSid
GetKernelObjectSecurity
GetSecurityDescriptorLength
GetSecurityDescriptorOwner

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

powrprof

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

cfgmgr32

CMP_RegisterNotification
CM_MapCrToWin32Err
CMP_UnregisterNotification

oleaut32

SafeArrayGetVartype
SysAllocString
SafeArrayDestroy
SafeArrayCreate
SafeArrayGetElement
SafeArrayLock
SafeArrayUnlock
VariantTimeToSystemTime
SafeArrayGetLBound
SafeArrayCopy
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserMarshal
SystemTimeToVariantTime
LPSAFEARRAY_UserSize
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
SysFreeString
BSTR_UserSize
SafeArrayGetUBound

rpcrt4

RpcRevertToSelf
I_RpcExceptionFilter
RpcBindingFree
RpcStringBindingComposeW
RpcImpersonateClient
UuidEqual
RpcServerUseProtseqEpW
I_RpcBindingInqLocalClientPID
NdrServerCall2
UuidCreate
RpcBindingFromStringBindingW
NdrClientCall2
I_RpcBindingInqTransportType
RpcBindingVectorFree
RpcStringBindingParseW
RpcServerRegisterIfEx
RpcServerUnregisterIfEx
RpcBindingToStringBindingW
RpcServerInqBindings
RpcStringFreeW

mmdevapi

ord7
ord9
ord12
ord15
ord2
ord4

avrt

AvSetMmThreadPriority
AvQuerySystemResponsiveness
AvSetMmThreadCharacteristicsA
AvRevertMmThreadCharacteristics

kernel32

RegEnumKeyExW
InitializeCriticalSectionAndSpinCount
RegDeleteValueW
OpenProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
WerRegisterMemoryBlock
GetSystemPowerStatus
SetEventWhenCallbackReturns
RegQueryInfoKeyW
RegDeleteTreeW
RegEnumValueW
RegCreateKeyExW
RegOpenKeyExW
RegGetKeySecurity
GetCurrentThread
OutputDebugStringA
RegCloseKey
LoadLibraryExW
RegSetKeySecurity
SetThreadPriority
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
MultiByteToWideChar
InterlockedExchange
GetVersionExA
HeapSize
HeapDestroy
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
DelayLoadFailureHook
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
LeaveCriticalSection
HeapAlloc
GetProcessHeap
HeapFree
SetEvent
WaitForSingleObject
CloseHandle
UnregisterWait
CreateEventW
GetLastError
DeleteCriticalSection
RaiseException
InitializeCriticalSection
PostQueuedCompletionStatus
GetQueuedCompletionStatus
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
LocalFree
CreateEventExW
CreateIoCompletionPort
CompareStringW
GetComputerNameW
GetSystemTime
GetVersionExW
EnterCriticalSection
WaitForMultipleObjects
ResetEvent
Sleep
GetTickCount
GetSystemDirectoryW
OutputDebugStringW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolWaitCallbacks
SubmitThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
HeapReAlloc
lstrlenW
CompareStringOrdinal

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 358KB - Virtual size: 357KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 512B - Virtual size: 489B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

666ac2807971525a4342a4c91d053d14

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-service-core-l1-1-0

powrprof

cfgmgr32

oleaut32

rpcrt4

mmdevapi

avrt

kernel32

Exports

Exports

Sections

.text Size: 358KB - Virtual size: 357KB

RT_CODE Size: 512B - Virtual size: 489B

RT_BSS Size: - Virtual size: 40B

.data Size: 4KB - Virtual size: 4KB

RT_DATA Size: 512B - Virtual size: 80B

.rsrc Size: 78KB - Virtual size: 77KB

.reloc Size: 21KB - Virtual size: 20KB

.text
Size: 358KB - Virtual size: 357KB

RT_CODE
Size: 512B - Virtual size: 489B

RT_BSS
Size: - Virtual size: 40B

.data
Size: 4KB - Virtual size: 4KB

RT_DATA
Size: 512B - Virtual size: 80B

.rsrc
Size: 78KB - Virtual size: 77KB

.reloc
Size: 21KB - Virtual size: 20KB