dot3msm[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dot3msm.dll
Size

85KB
MD5

a1172712f5420b59753123b4271fc507
SHA1

5b96ad772e208b1c2f66c5b02b03fbeaff3975e6
SHA256

5bee91cc0e80b817ecefef5f85f9a08a750d0fedcbec486c6712f76c267c94ad
SHA512

c15a00ecbff6e81fb85564f5abd51b56ac9ed5b5c73f3771ec045b4c786d3f44729e0a7a8cabd496475ffe421efeed26d108e3d0c587b51d0935601b4de1b79e
SSDEEP

1536:96MiX6xfP7gNKpoOdqGL+gv3kUNbc1AwdXOeuGL3CB8aSSS+/hX/DRqgfZAYlG4d:96MiX6xH7gNKpoOdrL+gv0UbuAuXOeun

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dot3msm.dll

Files

dot3msm.dll
.dll windows:10 windows x86 arch:x86

28344950375c99ec15f1bbfb608f0d53

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dot3msm.pdb

Imports

msvcrt

free
malloc
_initterm
_amsg_exit
_except_handler4_common
_snwprintf_s
towupper
wcscpy_s
memmove
memcpy
_XcptFilter
memset

ntdll

RtlNtStatusToDosError
EtwEventWrite
EtwEventEnabled
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwEventWriteTransfer
NtOpenFile
EtwTraceMessage
RtlInitUnicodeString

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-synch-l1-1-0

SetEvent
EnterCriticalSection
WaitForSingleObject
LeaveCriticalSection
CreateEventW
DeleteCriticalSection
InitializeCriticalSection

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
DeleteTimerQueueEx
CreateTimerQueue
QueueUserWorkItem

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LoadStringW
FreeLibrary

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
GetTokenInformation

authz

AuthziFreeAuditEventType
AuthziLogAuditEvent
AuthzFreeAuditEvent
AuthziInitializeAuditParams
AuthziInitializeAuditEvent
AuthziInitializeAuditEventType

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-kernel32-legacy-l1-1-0

BindIoCompletionCallback

api-ms-win-core-file-l1-1-0

ReadFile
CreateFileA
WriteFile

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllMain
Dot3MsmConnect
Dot3MsmCreateDefaultProfile
Dot3MsmDeInit
Dot3MsmDeInitAdapter
Dot3MsmDisconnect
Dot3MsmFreeMemory
Dot3MsmFreeProfile
Dot3MsmIndicateSessionChange
Dot3MsmInit
Dot3MsmInitAdapter
Dot3MsmOnMediaStateChange
Dot3MsmQueryMediaState
Dot3MsmQueryPendingUIRequest
Dot3MsmQueryState
Dot3MsmReAuthenticate
Dot3MsmSetRuntimeState
Dot3MsmUIResponse
Dot3MsmValidateProfile
Dot3ReasonCodeMsmToString
Dot3SetPortAuthenticationState

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

28344950375c99ec15f1bbfb608f0d53

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-base-l1-1-0

authz

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 71KB

.data Size: 512B - Virtual size: 3KB

.idata Size: 3KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 112B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 72KB - Virtual size: 71KB

.data
Size: 512B - Virtual size: 3KB

.idata
Size: 3KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 112B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB