NPSM[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NPSM.dll
Size

154KB
MD5

72f13f7e25621791ff814c372bba30d7
SHA1

5cc3b2180ef0884885ad6812ed54e8da1d2ae023
SHA256

0ee5db4cbbaf5572704ce1694c4ac616d0a2fc696d1a7fb695bb428da0a4ba11
SHA512

92a9b1a85f0b50c9594b50d822d8ea161a41a2e219fe8d1504a81211fc1bf113c46344cb7fd267a10bb5b16416dd0f02644b400ebad746ce54514de7d0c68ac1
SSDEEP

3072:w+7+jQbLEiyB0CvS4vy6PAO8+Hm6Xf4n+WaOlMdjJZKRzf:wHwLEigLvSIu+GdaOlOuRj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NPSM.dll

Files

NPSM.dll
.dll windows:10 windows x86 arch:x86

a9112528b524107039f70dacb1f5f20a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

NPSM.pdb

Imports

msvcrt

_CxxThrowException
_amsg_exit
memcpy
malloc
memcmp
free
_onexit
__CxxFrameHandler3
?terminate@@YAXXZ
_initterm
_callnewh
_except_handler4_common
??1type_info@@UAE@XZ
_XcptFilter
_lock
_unlock
__dllonexit
memmove
??0exception@@QAE@ABQBDH@Z
??3@YAXPAX@Z
?what@exception@@UBEPBDXZ
_purecall
_vsnwprintf
??_V@YAXPAX@Z
memcpy_s
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
memmove_s
difftime
time
wcschr
??0exception@@QAE@ABQBD@Z
memset

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-eventing-obsolete-l1-1-0

RegisterTraceGuidsA

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError
RoOriginateErrorW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
SetEvent
CreateEventW
DeleteCriticalSection
CreateSemaphoreExW
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateMutexExW
AcquireSRWLockExclusive
ReleaseSRWLockShared
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
EnterCriticalSection
OpenSemaphoreW
AcquireSRWLockShared
InitializeCriticalSectionEx
InitializeSRWLock

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceComplete
Sleep
InitOnceExecuteOnce
WaitOnAddress
WakeByAddressSingle
InitOnceBeginInitialize

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
ProcessIdToSessionId
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
GetProcessId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-com-l1-1-0

CoEnableCallCancellation
CoCancelCall
CoDisableCallCancellation
CoGetCallContext
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoGetMalloc
CLSIDFromString
CoTaskMemRealloc
CoRevertToSelf
CoImpersonateClient
CoSetProxyBlanket
CoTaskMemFree
CoResumeClassObjects
CoRegisterClassObject
CoRevokeClassObject
CoDisconnectContext
CoUninitialize
CoDecrementMTAUsage
CoCreateInstance
CoIncrementMTAUsage
CoInitializeEx

ntdll

RtlFreeHeap
NtQueryInformationToken
RtlInitUnicodeString
RtlEqualSid
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlQueryPackageClaims
RtlPublishWnfStateData

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoRevokeActivationFactories
RoRegisterActivationFactories

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventRegister
EventActivityIdControl
EventWriteTransfer

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-processthreads-l1-1-1

OpenProcess

rpcrt4

I_RpcBindingInqLocalClientPID

api-ms-win-security-base-l1-1-0

CopySid
GetTokenInformation
GetLengthSid

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolTimer
CreateThreadpoolWait
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CloseThreadpoolWait

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-shcore-thread-l1-1-0

SHCreateThread

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

combase

ord66
ord67
ord68

propsys

PSCreateMemoryPropertyStore

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
RegisterNowPlayingSessionManagerFactory
ServiceMain
SvchostPushServiceGlobals
UnregisterNowPlayingSessionManagerFactory

Sections

.text
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9112528b524107039f70dacb1f5f20a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-eventing-obsolete-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

ntdll

api-ms-win-core-winrt-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-1

rpcrt4

api-ms-win-security-base-l1-1-0

api-ms-win-security-capability-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-heap-l2-1-0

combase

propsys

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 134KB - Virtual size: 134KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 64B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 134KB - Virtual size: 134KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 64B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB