AdmTmpl[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

AdmTmpl.dll
Size

419KB
MD5

b99938b853a069b7021cf0509d5a87ee
SHA1

fa056f779ec534c7eba19893253fc9ea1d00dc7c
SHA256

3ec642e91bda0e39a44cd905beef70c5ce03a5cfce804940a624e1d89b05fda1
SHA512

a64407abdea2aaa227d6853bda92f7eb63c8503da4883bdf4a62cd0c0faae78aab6bf9a549c6d5d412764541d7ab4b12a64812b9993b7f466c9eb967f936ae4e
SSDEEP

6144:toLkyzMTZyEb76SUHn7YQ7wUCwDHcJ3lqt7R8j85hMekl2Uc21ZZZ/ZZZfJ21Dg:toIyoZNbuN7/7uLlE7uAMecR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AdmTmpl.dll

Files

AdmTmpl.dll
.dll windows:10 windows x86 arch:x86

72c0691fb97f90ec46126d9b0ec28e54

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AdmTmpl.pdb

Imports

msvcrt

__CxxFrameHandler3
__RTDynamicCast
_ftol2_sse
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
??0exception@@QAE@ABQBD@Z
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
free
_callnewh
wcsrchr
_itow
wcschr
_vsnwprintf
_purecall
wcsnlen
_wtoi
_wtoi64
wcstoul
memset

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalFree
GlobalAlloc
LocalReAlloc
LocalAlloc

api-ms-win-core-file-l1-1-0

GetFileSize
FindFirstFileW
ReadFile
SetFilePointer
FindClose
FindNextFileW
CreateDirectoryW
GetFileAttributesExW
FileTimeToLocalFileTime
GetFileAttributesW
CreateFileW
CompareFileTime
WriteFile

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW

api-ms-win-core-localization-l1-2-0

GetFileMUIPath
GetUserDefaultLangID
FormatMessageW
GetThreadPreferredUILanguages

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
LoadResource
LockResource
GetModuleHandleA
LoadStringW
DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
FreeLibraryAndExitThread

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
CreateEventW
InitializeCriticalSectionEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetEvent
ResetEvent

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA
LoadLibraryW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA
OutputDebugStringW

oleaut32

SysStringLen
SysFreeString
SysAllocString

api-ms-win-security-base-l1-1-0

GetLengthSid
AddAccessAllowedAce
GetAce
InitializeAcl
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
RegEnumValueW
RegSetValueExW
RegOpenKeyExA
RegCloseKey

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
GetCurrentProcess
TerminateProcess
CreateThread
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CreateStreamOnHGlobal
CLSIDFromString

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

advapi32

RegCreateKeyW
IsTextUnicode
RegDeleteKeyW

gdi32

DeleteObject

kernel32

lstrcmpiW
GlobalUnlock
GlobalLock
LoadLibraryExA
ExpandEnvironmentStringsA
GlobalReAlloc

ole32

OleRun

shell32

SHFileOperationW

user32

ScreenToClient
CheckDlgButton
LoadImageW
RegisterClipboardFormatW
GetKeyboardLayout
GetWindowLongW
PostMessageW
SendMessageW
GetMessagePos
GetDlgItem
LoadCursorW
EnableWindow
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
RegisterWindowMessageW
RegisterClassW
CreateWindowExW
DestroyWindow
DefWindowProcW
SetCursor
MessageBeep
SetFocus
GetClientRect
EndDialog
IsDlgButtonChecked
SetWindowLongW
DialogBoxParamW
MessageBoxW
DestroyIcon

xmllite

CreateXmlWriter

Exports

Exports

CreateCmtStoreObject
CreateParserObject
DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 266KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72c0691fb97f90ec46126d9b0ec28e54

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-debug-l1-1-0

oleaut32

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-profile-l1-1-0

advapi32

gdi32

kernel32

ole32

shell32

user32

xmllite

Exports

Exports

Sections

.text Size: 266KB - Virtual size: 265KB

.data Size: 7KB - Virtual size: 9KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 120KB - Virtual size: 120KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 266KB - Virtual size: 265KB

.data
Size: 7KB - Virtual size: 9KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 120KB - Virtual size: 120KB

.reloc
Size: 18KB - Virtual size: 18KB