DataExchange[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

DataExchange.dll
Size

251KB
MD5

d238a301ae8efabd029ce5c9b7777bf0
SHA1

2c715dfe19fbbd5e29412991b009de09042f97f2
SHA256

fbb2b864831d5f0f71e1d0167b4edd4facb62bfd7913c465f4e291b868120163
SHA512

760776c18d57fb144a73c9b908e640de19128eed3a3e35f8d33f4283f6e2862e0c84daa934a295e75dbbbbfa7a056c35936fcf0104739748a8ec12d72f26bd2c
SSDEEP

3072:wtFQAQD/oQmmJQxQb36ev4r0/9KuWWmHiRnnD9GX8ezvI11rV6DObgHH2+Vzccnd:IF6DgQmmm2bKevIPWmCdO7I17qf2+Vg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DataExchange.dll

Files

DataExchange.dll
.dll windows:10 windows x86 arch:x86

d87e30b18f53fe55c5b018af0882adc7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DataExchange.pdb

Imports

msvcrt

_lock
_unlock
_onexit
_vsnwprintf
_purecall
memcpy_s
__CxxFrameHandler3
_initterm
malloc
free
_amsg_exit
_XcptFilter
_except_handler4_common
??3@YAXPAX@Z
__dllonexit
memcmp
_ftol2_sse
??1type_info@@UAE@XZ
_callnewh
memmove
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memset

shcore

CreateStreamOverRandomAccessStream
SHCreateThreadRef
SHSetThreadRef
GetScaleFactorForMonitor
GetProcessDpiAwareness
SHGetThreadRef
ord244
ord270

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsIsStringEmpty
WindowsDuplicateString
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError
RoGetMatchingRestrictedErrorInfo
RoTransformError
IsErrorPropagationEnabled
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoReportFailedDelegate
RoOriginateErrorW

api-ms-win-core-synch-l1-2-0

CreateEventW
LeaveCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
InitializeSRWLock
Sleep
InitOnceExecuteOnce
WaitForSingleObject
SetEvent
AcquireSRWLockShared
CreateMutexExW
InitializeCriticalSectionEx
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSemaphore
DeleteCriticalSection
CreateEventExW
CreateSemaphoreExW
InitializeCriticalSection
EnterCriticalSection

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetProcAddress
SizeofResource
FreeLibraryAndExitThread
LoadResource
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
LockResource

api-ms-win-core-processthreads-l1-1-2

TlsSetValue
TlsFree
TlsAlloc
CreateThread
GetCurrentProcessId
GetCurrentThreadId
TlsGetValue
GetCurrentProcess
OpenProcessToken
TerminateProcess
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-1

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
RoGetAgileReference
CoMarshalInterface
CreateStreamOnHGlobal
CoWaitForMultipleHandles
CoUninitialize
CoReleaseMarshalData
CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoCreateInstance
PropVariantClear

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
FreeLibraryWhenCallbackReturns
CallbackMayRunLong

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-libraryloader-l1-2-2

FindResourceW

api-ms-win-core-kernel32-legacy-l1-1-1

MulDiv

combase

ord90

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice2

ntdll

ZwQueryWnfStateData
RtlNtStatusToDosError

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d87e30b18f53fe55c5b018af0882adc7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shcore

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-kernel32-legacy-l1-1-1

combase

api-ms-win-core-delayload-l1-1-1

d3d11

dcomp

ntdll

Exports

Exports

Sections

.text Size: 115KB - Virtual size: 114KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 108B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 118KB - Virtual size: 118KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 115KB - Virtual size: 114KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 108B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 118KB - Virtual size: 118KB

.reloc
Size: 9KB - Virtual size: 8KB