ELSCore[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ELSCore.dll
Size

38KB
MD5

8444a7364d6877922049e99bf4b78c5c
SHA1

be26aec3cefcc6b5610770571617dbf7c0eac194
SHA256

8ba2eee84d61743caa6286d59839963c5ed9ab7c857a4b9926eb640bbe43c425
SHA512

adaf84b2986309a5bf627fef7b27aa8277d59a2bd5d37c0d9f926077205bcef96f626cd314c18913111bd3fa0bc08a4f77310dc4a77dca8302ecb9b0a14659cb
SSDEEP

768:Okivp/ciOKsTX+uCaqJdu9iYYR6/Cjl6FeVRN4jH0:Ok0/OR8dZYYR6/Cjl64Vr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ELSCore.dll

Files

ELSCore.dll
.dll windows:6 windows x86 arch:x86

d09b21b190d95ad3e1764b3f15194a72

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ElsCore.pdb

Imports

msvcrt

memset
_fileno
_read
__pioinfo
__badioinfo
realloc
wcstombs
iswctype
wctomb
localeconv
isxdigit
isleadbyte
__mb_cur_max
mbtowc
isdigit
calloc
memcpy
_amsg_exit
_initterm
free
malloc
_XcptFilter
_errno
ungetc

ntdll

RtlInitUnicodeString
RtlGUIDFromString
RtlUnwind

kernel32

LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
OutputDebugStringA
InterlockedCompareExchange
Sleep
InterlockedExchange
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
GetModuleHandleExW
LeaveCriticalSection
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
HeapCreate
LoadLibraryW
ReadFile
CreateFileW
CloseHandle
GetProcAddress
FindFirstFileW
FindClose
GetModuleHandleW
GetModuleFileNameW
GetCurrentProcess
IsWow64Process
GetSystemWow64DirectoryW
GetSystemDirectoryW
QueueUserWorkItem
GetLastError
DisableThreadLibraryCalls
GetProcessHeap

advapi32

RegCloseKey
RegEnumKeyW
RegOpenKeyExW
RegQueryValueExW

Exports

Exports

MappingDoAction
MappingFreePropertyBag
MappingFreeServices
MappingGetServices
MappingRecognizeText

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d09b21b190d95ad3e1764b3f15194a72

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 31KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 952B

.text
Size: 32KB - Virtual size: 31KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 952B