InkEd[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

InkEd.dll
Size

225KB
MD5

8918b61ae5a85bbdde9cb6eec59b20fb
SHA1

2473c44989e4cff0ae32a70cff9fb4f6d1586b27
SHA256

d8748b50a0d24284f8193d6274f2b51925bd5eb92f4a5f878ee46b0e6691576c
SHA512

946a919827391aea12719cc63237057a166686056d0a010315cf1a7e78f7cea5eedea9d8fef96db4c4ba1ae694583c5b0110d435a88f8391bcbb0ebf194adcdd
SSDEEP

3072:sfLBBNR9g+irUXohfowjLsXZEjCE4EF79eLgoJhgEH50rGQEp6miorC6rT6rl0qq:sfdLgXoN2Ju6djvQoSr23zJYnbzoI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InkEd.dll

Files

InkEd.dll
.dll regsvr32 windows:10 windows x86 arch:x86

23d6c311da247ca1261f2554da4c4a2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

InkEd.pdb

Imports

msvcrt

_ftol2_sse
memcmp
memcpy
_except_handler4_common
??1type_info@@UAE@XZ
realloc
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
_callnewh
memmove_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
memcpy_s
malloc
free
_purecall
wcscat_s
wcscpy_s
?terminate@@YAXXZ
memset

oleaut32

VariantClear
SysFreeString
VarUI4FromStr
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetVartype
SafeArrayPutElement
SysStringLen
DispCallFunc
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayAccessData
OleLoadPicture
VariantInit
OleCreateFontIndirect
SafeArrayCopy
OleCreatePropertyFrame
SysStringByteLen
SysAllocString
SysAllocStringByteLen
OleCreatePictureIndirect
SysReAllocStringLen
OleTranslateColor
RegisterTypeLi
SysAllocStringLen
VariantChangeType
LoadRegTypeLi
LoadTypeLi

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
FindResourceExW
DisableThreadLibraryCalls
LoadResource
SizeofResource
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
LoadLibraryExA
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW

api-ms-win-core-memory-l1-1-2

VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc

api-ms-win-core-synch-l1-2-0

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
Sleep

api-ms-win-core-com-l1-1-1

CoTaskMemRealloc
GetHGlobalFromStream
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance

api-ms-win-core-string-l2-1-0

CharPrevW
CharNextW

api-ms-win-core-sysinfo-l1-2-1

GetVersionExW
GetSystemDirectoryW
GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-heap-l1-2-0

HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
FlushInstructionCache
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-1

GetUserDefaultLangID

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-interlocked-l1-2-0

InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

gdi32

DeleteObject
LPtoDP
RestoreDC
SetViewportOrgEx
DeleteDC
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
PatBlt
StretchBlt
CloseEnhMetaFile
GetClipBox
CreateRectRgnIndirect
SetWindowExtEx
CreateEnhMetaFileW
SetViewportExtEx
GetDeviceCaps
CreateSolidBrush
GetMapMode
GetObjectType
SaveDC
CreateDCW
SetWindowOrgEx
SetMapMode

kernel32

lstrcpyW
lstrcmpiW
GlobalLock
lstrcpynW
GlobalUnlock

ole32

OleRegEnumVerbs
StgCreateDocfileOnILockBytes
CreateDataAdviseHolder
CreateOleAdviseHolder
CreateILockBytesOnHGlobal
OleRegGetMiscStatus
OleRegGetUserType

user32

IsWindowEnabled
UpdateWindow
SetCapture
GetDC
KillTimer
ReleaseCapture
ShowCursor
UnionRect
ShowWindow
GetCursorPos
InflateRect
IsWindow
IsWindowVisible
SetWindowPos
GetParent
DestroyWindow
GetClassInfoExW
EqualRect
GetFocus
CallWindowProcW
SetWindowRgn
GetMessageExtraInfo
PostMessageW
GetKeyState
DefWindowProcW
GetWindowLongW
ScreenToClient
GetDoubleClickTime
DestroyAcceleratorTable
RegisterClassW
GetCapture
GetClassInfoW
RegisterClassExW
UnregisterClassW
SetRect
FillRect
CreateWindowExW
GetSystemMetrics
SetTimer
IsChild
SendMessageW
MessageBeep
OffsetRect
DispatchMessageW
EnableWindow
GetClientRect
WindowFromDC
ValidateRect
GetSysColor
SetWindowLongW
wsprintfW
PtInRect
IntersectRect
GetCursorInfo
SetFocus
TranslateMessage
LoadCursorW
ReleaseDC
InvalidateRect
SetParent

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23d6c311da247ca1261f2554da4c4a2f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-profile-l1-1-0

gdi32

kernel32

ole32

user32

Exports

Exports

Sections

.text Size: 107KB - Virtual size: 106KB

.data Size: 1KB - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 102KB - Virtual size: 102KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 107KB - Virtual size: 106KB

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 102KB - Virtual size: 102KB

.reloc
Size: 7KB - Virtual size: 6KB