InkObjCore[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

InkObjCore.dll
Size

706KB
MD5

1aead0c3fc7c438af92f4df862971aac
SHA1

559253cd163af4286361fa4286b5463ce5c31a54
SHA256

9d03e6ab92b64e4e1ba07a5637f2ba45fb905ebe6f4cb5e91e4338bb4d8a4a15
SHA512

502367deeaced0ff1552257503ae5a19254fccb53d66cf1b705d29ff4f45ef11e75b375785e5b75f84f9d114692639c7d05bcbbee8b5e73280c0d5a8b05c1ccc
SSDEEP

12288:SyEXb+V8oe/K7F2gI7c4DvnO+MiI8BK4:SyEXb+VHe/mkgI7c4LnvMiI8B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InkObjCore.dll

Files

InkObjCore.dll
.dll regsvr32 windows:10 windows x86 arch:x86

a82d5aa42a89dbf4918ad5e45e48d71e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

InkObjCore.pdb

Imports

msvcrt

_onexit
_vsnprintf
memmove
wcsncmp
_endthreadex
_CIsqrt
_CIsin
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
_purecall
??0exception@@QAE@XZ
memmove_s
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
memcpy_s
??0exception@@QAE@ABV0@@Z
wcscpy_s
_beginthreadex
realloc
wcscat_s
malloc
memcpy
memcmp
floor
ceil
_ftol2_sse
_ftol2
__RTDynamicCast
free
??1type_info@@UAE@XZ
_CIatan2
_CIcos
memset

ntdll

EtwTraceMessage
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlReportException

api-ms-win-core-errorhandling-l1-1-1

RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-2-0

InitializeSRWLock
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjectsEx
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
Sleep
WaitForSingleObject
CreateWaitableTimerExW
CreateEventW
SetEvent
CreateMutexW
ReleaseMutex
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
DeleteCriticalSection
ResetEvent
TryEnterCriticalSection
SetWaitableTimer

api-ms-win-core-processthreads-l1-1-2

GetCurrentThread
GetCurrentProcess
SetThreadPriority
TerminateProcess
QueueUserAPC
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
DisableThreadLibraryCalls
LoadStringW
SizeofResource
LoadResource
GetProcAddress
FindResourceExW
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW

api-ms-win-core-string-l2-1-0

CharPrevW
CharNextW

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegGetValueW
RegCloseKey
RegEnumKeyExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumValueW

api-ms-win-core-memory-l1-1-2

VirtualQuery
VirtualProtect
VirtualAlloc

api-ms-win-core-sysinfo-l1-2-1

GetSystemInfo
GetSystemTimeAsFileTime
GetVersionExW
GetTickCount

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-heap-l1-2-0

HeapDestroy
HeapFree
HeapAlloc
HeapReAlloc
HeapCreate

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcpyW
lstrcpynW
lstrcmpiW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-ntuser-rectangle-l1-1-0

EqualRect
SetRect
InflateRect
IntersectRect
OffsetRect
UnionRect
SetRectEmpty
IsRectEmpty

api-ms-win-core-com-private-l1-1-0

CoRegisterMessageFilter

api-ms-win-core-localization-l1-2-1

IsValidLocale

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-kernel32-legacy-l1-1-1

MulDiv

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

RegisterClipboardFormatW

Exports

Exports

AddStroke
AddWordsToWordList
AdviseInkChange
CreateContext
CreateRecognizer
DestroyContext
DestroyRecognizer
DestroyWordList
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EndInkInput
GetAllRecognizers
GetBestResultString
GetLatticePtr
GetLeftSeparator
GetRecoAttributes
GetResultPropertyList
GetRightSeparator
GetUnicodeRanges
InvokeIDispatch
IsStringSupported
LoadCachedAttributes
MakeWordList
Process
SetEnabledUnicodeRanges
SetFactoid
SetFlags
SetGuide
SetTextContext
SetWordList

Sections

.text
Size: 544KB - Virtual size: 543KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a82d5aa42a89dbf4918ad5e45e48d71e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-ntuser-rectangle-l1-1-0

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

Exports

Exports

Sections

.text Size: 544KB - Virtual size: 543KB

.data Size: 20KB - Virtual size: 23KB

.idata Size: 5KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 228B

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 34KB - Virtual size: 34KB

.text
Size: 544KB - Virtual size: 543KB

.data
Size: 20KB - Virtual size: 23KB

.idata
Size: 5KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 228B

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 34KB - Virtual size: 34KB