SHCore[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SHCore.dll
Size

536KB
MD5

34df124de443edd9db857b41d5ebf2ec
SHA1

fae8523acce42c678cc369c3c2a6400ac1d036cb
SHA256

2d08e2ca440d92b75c6d2064b687a470a50503374f753c5f9996b64a9e52b69c
SHA512

9b1595961e15f640e0483fe39336f1d23eb4b5bb1f97a583cf5a5685852dc04310fe64223c8985f72faafa89fbac74fd13173d5a869e80ba12a99f0d094c83ca
SSDEEP

6144:MfUXUizKfNTohybc4VSnbP8I1fxq3sKvJCz+2Uf+iG6zjQn6ZBc1:ZUizMTS0VSnbzY3RCzIf5Gjn6ZBc1

Score

1^/10

Malware Config

Signatures

Files

SHCore.dll
.dll windows:10 windows x86 arch:x86

6df3e31673d2ccedabfbe5a79390b72d

Code Sign

33:00:00:01:74:69:de:10:8b:37:65:a8:d7:00:00:00:00:01:74
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:23

Not After

11/08/2018, 20:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e7:8e:6e:e4:37:cb:d7:f6:58:81:1d:7d:27:48:2d:2a:04:4c:6b:b3:eb:8c:14:9a:b1:31:42:57:ed:73:66:02
Signer

Actual PE Digest

e7:8e:6e:e4:37:cb:d7:f6:58:81:1d:7d:27:48:2d:2a:04:4c:6b:b3:eb:8c:14:9a:b1:31:42:57:ed:73:66:02

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

shcore.pdb

Imports

msvcrt

__dllonexit
_unlock
_onexit
_except_handler4_common
memcpy
memcmp
floor
_ftol2_sse
_ftol2
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
__CxxFrameHandler3
_callnewh
wcsrchr
_vsnwprintf
memcpy_s
_purecall
memmove_s
memmove
wcsncmp
wcschr
memset

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventSetInformation
EventUnregister
EventWriteTransfer

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-1

RoOriginateErrorW
SetRestrictedErrorInfo
RoTransformError
GetRestrictedErrorInfo
RoOriginateError

api-ms-win-core-synch-l1-2-0

CreateMutexW
InitializeCriticalSection
AcquireSRWLockExclusive
CreateEventW
AcquireSRWLockShared
WaitForSingleObject
ReleaseSRWLockShared
ReleaseMutex
OpenSemaphoreW
InitOnceExecuteOnce
InitOnceComplete
TryAcquireSRWLockExclusive
EnterCriticalSection
CreateSemaphoreExW
InitOnceBeginInitialize
WaitForSingleObjectEx
WaitForMultipleObjectsEx
OpenEventW
ReleaseSemaphore
InitializeCriticalSectionEx
Sleep
LeaveCriticalSection
InitializeSRWLock
DeleteCriticalSection
CreateEventExW
CreateMutexExW
ReleaseSRWLockExclusive
SetEvent

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadResource
GetProcAddress
FreeLibraryAndExitThread
LoadLibraryExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW
SizeofResource
GetModuleFileNameA
GetModuleFileNameW
FindResourceExW
GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
TerminateProcess
OpenThreadToken
OpenProcessToken
OpenProcess
GetCurrentThreadId
GetCurrentProcessId
TlsSetValue
TlsFree
TlsGetValue
GetProcessId
GetStartupInfoW
GetCurrentThread
TlsAlloc
CreateThread

api-ms-win-core-sysinfo-l1-2-1

GetOsSafeBootMode
GetVersionExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-1

RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-heap-l1-2-0

HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
SetThreadpoolWait
SetThreadpoolTimer
DisassociateCurrentThreadFromCallback
FreeLibraryWhenCallbackReturns
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CallbackMayRunLong
WaitForThreadpoolTimerCallbacks

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetLocaleInfoW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegOpenKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegDeleteValueA
RegQueryValueExW
RegDeleteKeyExA
RegCreateKeyExA
RegQueryValueExA
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyExW
RegEnumValueW
RegGetValueW
RegEnumValueA
RegEnumKeyExA
RegEnumKeyExW

api-ms-win-security-base-l1-2-0

GetTokenInformation
CheckTokenMembership
RevertToSelf
AdjustTokenPrivileges
ImpersonateLoggedOnUser

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-file-l1-2-1

UnlockFileEx
SetEndOfFile
SetFilePointerEx
GetFileAttributesExW
GetFileSizeEx
CreateFile2
SetFilePointer
SetFileInformationByHandle
GetFileInformationByHandle
FlushFileBuffers
CreateDirectoryW
DeleteFileW
CreateFileW
WriteFile
ReadFile
GetDriveTypeW
GetVolumeInformationByHandleW
LockFileEx
GetFileAttributesW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
ExpandEnvironmentStringsA

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-io-l1-1-1

CancelIoEx
GetOverlappedResult
DeviceIoControl

api-ms-win-core-file-l2-1-1

ReplaceFileW
GetFileInformationByHandleEx

api-ms-win-core-path-l1-1-0

PathAllocCanonicalize
PathCchAddBackslash

rpcrt4

I_RpcBindingInqLocalClientPID

api-ms-win-core-errorhandling-l1-1-3

RaiseFailFastException

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW
GlobalAddAtomExW
GlobalDeleteAtom

api-ms-win-core-shlwapi-legacy-l1-1-0

PathUnExpandEnvStringsW
PathIsRelativeW
PathUnExpandEnvStringsA
PathFindExtensionW
PathFindFileNameW
PathGetDriveNumberW
PathIsUNCW
PathFileExistsW
PathRemoveFileSpecW
PathCombineW

api-ms-win-core-kernel32-legacy-l1-1-1

MulDiv

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
QueueUserWorkItem
CreateTimerQueueTimer

api-ms-win-core-shlwapi-obsolete-l1-2-0

StrChrW
StrToIntW
StrCmpNIW
StrCmpNICW
StrDupA
QISearch
StrCmpICW
StrDupW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-localization-obsolete-l1-3-0

GetUserDefaultUILanguage

combase

ord134

ntdll

NtQuerySystemInformation
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtQueryInformationProcess
NtCreateFile
RtlInitUnicodeString
RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

CommandLineToArgvW
CreateRandomAccessStreamOnFile
CreateRandomAccessStreamOverStream
CreateStreamOverRandomAccessStream
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetCurrentProcessExplicitAppUserModelID
GetDpiForMonitor
GetDpiForShellUIComponent
GetFeatureEnabledState
GetProcessDpiAwareness
GetProcessReference
GetScaleFactorForDevice
GetScaleFactorForMonitor
IStream_Copy
IStream_Read
IStream_ReadStr
IStream_Reset
IStream_Size
IStream_Write
IStream_WriteStr
IUnknown_AtomicRelease
IUnknown_GetSite
IUnknown_QueryService
IUnknown_Set
IUnknown_SetSite
IsOS
RecordFeatureError
RecordFeatureUsage
RegisterScaleChangeEvent
RegisterScaleChangeNotifications
RevokeScaleChangeNotifications
SHAnsiToAnsi
SHAnsiToUnicode
SHCopyKeyA
SHCopyKeyW
SHCreateMemStream
SHCreateStreamOnFileA
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
SHCreateThread
SHCreateThreadRef
SHCreateThreadWithHandle
SHDeleteEmptyKeyA
SHDeleteEmptyKeyW
SHDeleteKeyA
SHDeleteKeyW
SHDeleteValueA
SHDeleteValueW
SHEnumKeyExA
SHEnumKeyExW
SHEnumValueA
SHEnumValueW
SHGetThreadRef
SHGetValueA
SHGetValueW
SHOpenRegStream2A
SHOpenRegStream2W
SHOpenRegStreamA
SHOpenRegStreamW
SHQueryInfoKeyA
SHQueryInfoKeyW
SHQueryValueExA
SHQueryValueExW
SHRegDuplicateHKey
SHRegGetIntW
SHRegGetPathA
SHRegGetPathW
SHRegGetValueA
SHRegGetValueFromHKCUHKLM
SHRegGetValueW
SHRegSetPathA
SHRegSetPathW
SHReleaseThreadRef
SHSetThreadRef
SHSetValueA
SHSetValueW
SHStrDupA
SHStrDupW
SHUnicodeToAnsi
SHUnicodeToUnicode
SetCurrentProcessExplicitAppUserModelID
SetProcessDpiAwareness
SetProcessReference
SubscribeFeatureStateChangeNotification
UnregisterScaleChangeEvent
UnsubscribeFeatureStateChangeNotification

Sections

.text
Size: 476KB - Virtual size: 475KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6df3e31673d2ccedabfbe5a79390b72d

Code Sign

33:00:00:01:74:69:de:10:8b:37:65:a8:d7:00:00:00:00:01:74Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

e7:8e:6e:e4:37:cb:d7:f6:58:81:1d:7d:27:48:2d:2a:04:4c:6b:b3:eb:8c:14:9a:b1:31:42:57:ed:73:66:02Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-path-l1-1-0

rpcrt4

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-version-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-3-0

combase

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 476KB - Virtual size: 475KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 412B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 33KB - Virtual size: 32KB

33:00:00:01:74:69:de:10:8b:37:65:a8:d7:00:00:00:00:01:74
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

e7:8e:6e:e4:37:cb:d7:f6:58:81:1d:7d:27:48:2d:2a:04:4c:6b:b3:eb:8c:14:9a:b1:31:42:57:ed:73:66:02
Signer

.text
Size: 476KB - Virtual size: 475KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 412B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 33KB - Virtual size: 32KB