TapiMigPlugin[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

TapiMigPlugin.dll
Size

45KB
MD5

bfcee96eb7a4a786ebed0c6e77ed45a3
SHA1

07a9de6d1f74106cf619768fc8263918ed65cc44
SHA256

f3bbd07f0d11514490dd167161e4119b49d108b76cb5fe5f61a5a9ad098166cf
SHA512

8c1fb87e3c2c4ca6af279587b50f2f30bf6b48ff78cf656f2c5597481f2bfcf601de1cee18be7f131de8f3773d1b66b5c372878f8ab98a73f00cb8ad4543c1c0
SSDEEP

768:e1c605fXqFVLB5UM5SNhBDITnGVeFvdFsxBN3f6A+UDsYL:EcdUj5SNhBD0GVeFvdyyAHsY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TapiMigPlugin.dll

Files

TapiMigPlugin.dll
.dll regsvr32 windows:10 windows x86 arch:x86

a6a268350a7213b80cefbd818dd269b3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

TapiMigPlugin.pdb

Imports

msvcrt

_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
memset
_wcsnicmp
_vsnwprintf
wcsncpy_s
malloc
memmove_s
free
_purecall
wcscat_s
wcscpy_s
memcpy_s
memcmp

ole32

CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
StringFromCLSID
CoTaskMemRealloc

oleaut32

VarUI4FromStr
SysAllocString
RegisterTypeLi
SysFreeString
LoadTypeLi
GetErrorInfo
SysStringLen
UnRegisterTypeLi
LoadRegTypeLi

user32

UnregisterClassA
CharNextW

kernel32

GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
LocalFree
GetCurrentThreadId
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetPrivateProfileStringW
LoadLibraryExW
lstrcmpiW
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
FreeLibrary
WritePrivateProfileStringW
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
LoadResource
FindResourceExW
RaiseException
LockResource
GetLastError
MultiByteToWideChar
InitializeCriticalSection
LeaveCriticalSection
GetThreadLocale
GetModuleFileNameW
EnterCriticalSection
SetThreadLocale
SizeofResource
GetPrivateProfileIntW

advapi32

RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW

shell32

SHGetFileInfoW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6a268350a7213b80cefbd818dd269b3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ole32

oleaut32

user32

kernel32

advapi32

shell32

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 35KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 36KB - Virtual size: 35KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB