TapiMigPlugin[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

TapiMigPlugin.dll
Size

45KB
MD5

966d5896719233c8be1248219d2b0c75
SHA1

780b7ae86cf16ec2a56b77a1056e0083d9fd9017
SHA256

0e04932b4441ce4628c1d5b03c3b2aaea0eee6d85f5c4e66640907ee90928108
SHA512

5cfbc3ef4c77207c38805362ba817eeab2a2a15ed72db0d1b3e1714f9c2b21de154f9c6ab5ca9e9bcdbddec98df8c8f6db4b4f7dd87466b4d0653f4c342e4730
SSDEEP

768:4QV5fFbZSuB2vUvhAST/rjwV9fjtSHlXTD2TA+UDNxc:5V9N1vhAST/f89fjtulYAHN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TapiMigPlugin.dll

Files

TapiMigPlugin.dll
.dll regsvr32 windows:10 windows x86 arch:x86

a6a268350a7213b80cefbd818dd269b3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

TapiMigPlugin.pdb

Imports

msvcrt

_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
memset
_wcsnicmp
_vsnwprintf
wcsncpy_s
malloc
memmove_s
free
_purecall
wcscat_s
wcscpy_s
memcpy_s
memcmp

ole32

CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
StringFromCLSID
CoTaskMemRealloc

oleaut32

VarUI4FromStr
SysAllocString
RegisterTypeLi
SysFreeString
LoadTypeLi
GetErrorInfo
SysStringLen
UnRegisterTypeLi
LoadRegTypeLi

user32

UnregisterClassA
CharNextW

kernel32

GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
LocalFree
GetCurrentThreadId
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetPrivateProfileStringW
LoadLibraryExW
lstrcmpiW
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
FreeLibrary
WritePrivateProfileStringW
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
LoadResource
FindResourceExW
RaiseException
LockResource
GetLastError
MultiByteToWideChar
InitializeCriticalSection
LeaveCriticalSection
GetThreadLocale
GetModuleFileNameW
EnterCriticalSection
SetThreadLocale
SizeofResource
GetPrivateProfileIntW

advapi32

RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW

shell32

SHGetFileInfoW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6a268350a7213b80cefbd818dd269b3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ole32

oleaut32

user32

kernel32

advapi32

shell32

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 35KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 36KB - Virtual size: 35KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB