TSpkg[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

TSpkg.dll
Size

96KB
MD5

3f6f3aefc4e78a333f74e139a754aa4b
SHA1

d958b2818715160dd45fcf847d770aee6869524b
SHA256

ae965ec6f56421d503d9e7ba853e79c883df49f6e66e83ad6e0e925336729204
SHA512

5fc412947e2a6b7c92d05acd247b26fe664a2a71b13fa7669afccc9ac7e3bf6cd3b9824e9f7b34804579f16ff53e749ecad3dc44d8f03490d506547a8c86ec90
SSDEEP

3072:hyu63r+x2Vglwc5MU/YIINj39eUQP7WEFLP8cen9JnlD63J0p:u3r+x2JeY338JDv9klJP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TSpkg.dll

Files

TSpkg.dll
.dll windows:10 windows x86 arch:x86

700b4f0e019e465743acb7aaac50587f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

TSpkg.pdb

Imports

msvcrt

memcpy
wcschr
_initterm
wcsncat_s
wcsncpy_s
__CxxFrameHandler3
wcscat_s
wcscpy_s
_callnewh
malloc
_except_handler4_common
memcmp
_amsg_exit
_XcptFilter
free
_snwprintf_s
_wcsicmp
_wcsnicmp
memset

sspicli

SspiEncryptAuthIdentityEx
InitializeSecurityContextW
CompleteAuthToken
AcceptSecurityContext
FreeContextBuffer
QueryContextAttributesW
SspiPrepareForCredRead
SspiLocalFree
EncryptMessage
DecryptMessage
DeleteSecurityContext
SspiFreeAuthIdentity
SspiIsAuthIdentityEncrypted
FreeCredentialsHandle
AcquireCredentialsHandleW
SetCredentialsAttributesW
SspiUnmarshalAuthIdentity
SspiValidateAuthIdentity
SspiDecryptAuthIdentityEx
SspiEncodeAuthIdentityAsStrings
SspiCopyAuthIdentity
ImpersonateSecurityContext
GetUserNameExW

api-ms-win-security-base-l1-2-0

DuplicateToken
CheckTokenMembershipEx
FreeSid
CheckTokenMembership
RevertToSelf
AllocateAndInitializeSid

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
SetCurrentDirectoryW
GetCurrentDirectoryW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
RegNotifyChangeKeyValue
RegEnumValueW
RegSetValueExW

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

bcrypt

BCryptDestroyHash
BCryptFinishHash
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptHashData
BCryptCreateHash
BCryptGetProperty
BCryptOpenAlgorithmProvider

api-ms-win-core-synch-l1-2-0

CreateEventW
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
Sleep

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
SetThreadStackGuarantee

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemInfo
GetWindowsDirectoryW
GetTickCount
GetComputerNameExW
GetVersionExW
GetSystemTimeAsFileTime

msasn1

ASN1BERDecNotEndOfContents
ASN1_CreateDecoder
ASN1_CreateEncoder
ASN1_CreateModule
ASN1BERDecU32Val
ASN1BERDecOctetString2
ASN1DEREncOctetString
ASN1BERDecS32Val
ASN1BEREncOpenType
ASN1DecAlloc
ASN1Free
ASN1BERDecSkip
ASN1BEREncEndOfContents
ASN1BEREncS32
ASN1BERDecEndOfContents
ASN1BEREncExplicitTag
ASN1BERDecOctetString
ASN1BEREncU32
ASN1BERDecPeekTag
ASN1BERDecExplicitTag
ASN1octetstring_free
ASN1BERDecOpenType2
ASN1_CloseDecoder
ASN1_Decode
ASN1_FreeDecoded
ASN1_Encode
ASN1_FreeEncoded
ASN1_CloseEncoder

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

ntdll

NtWaitForSingleObject
RtlNtStatusToDosError
RtlFreeHeap
NtSetEvent
NtCreateEvent
NtClose
NtOpenEvent
NtQuerySystemInformation
RtlAllocateHeap
NtQuerySystemTime
RtlAvlRemoveNode
RtlAvlInsertNodeEx
RtlDuplicateUnicodeString
RtlCompareUnicodeString
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlEqualUnicodeString
RtlAllocateAndInitializeSid
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlInitUnicodeStringEx
NtQueryInformationToken
RtlMapSecurityErrorToNtStatus
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
RtlGetLastNtStatus
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlDeleteResource
RtlInitializeGenericTableAvl
RtlInitializeResource
RtlEnumerateGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlDeleteElementGenericTableAvl
RtlAcquireResourceExclusive
RtlInsertElementGenericTableAvl
RtlConvertSharedToExclusive
RtlReleaseResource
RtlLookupElementGenericTableAvl
RtlImageNtHeader
RtlAcquireResourceShared
EtwTraceMessage

api-ms-win-core-file-l1-2-1

CreateDirectoryW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-eventing-controller-l1-1-0

StartTraceW
EnableTraceEx2
ControlTraceW

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent

api-ms-win-core-memory-l1-1-2

VirtualProtect
OpenFileMappingW
VirtualQuery
MapViewOfFileEx
VirtualAlloc
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-file-l2-1-1

MoveFileExW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
UnregisterWaitEx
ChangeTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW
ReportEventW
DeregisterEventSource

Exports

Exports

SpLsaModeInitialize
SpUserModeInitialize

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

700b4f0e019e465743acb7aaac50587f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

sspicli

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

bcrypt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

msasn1

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-core-file-l1-2-1

api-ms-win-core-version-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-file-l2-1-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 79KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 168B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 80KB - Virtual size: 79KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 168B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 3KB