SHCore[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SHCore.dll
Size

542KB
MD5

3c9e93ae82a41efe22b71741552a73a8
SHA1

23dff0304e05e375aba2fdb212cb45c73bae4d71
SHA256

30b739da8949c52da2e5adcb7f460a0f05f7578d4f7ab7cfb8ac0c9949440c67
SHA512

1adb6f39b718c61f71073bb7d9448c0296874528f861b6191be887934af27ca89500fdcb8d94a626d4a4202556527c1b4ae489aa8930f105cb52ac97dc4c668a
SSDEEP

12288:HxqQdPwlfExS7D96xq8PKnpO9Zj1W454LaA6FVG9J:HcQahETq8inm1WU4LaA6FVG7

Score

1^/10

Malware Config

Signatures

Files

SHCore.dll
.dll windows:10 windows x86 arch:x86

a4df5c277f8ee205f40111c1a8eaad72

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f5:27:fa:84:06:92:39:29:de:70:97:f1:8f:c4:5c:fb:da:cb:a1:82:d1:48:de:32:c2:b3:3d:eb:e0:ff:96:0b
Signer

Actual PE Digest

f5:27:fa:84:06:92:39:29:de:70:97:f1:8f:c4:5c:fb:da:cb:a1:82:d1:48:de:32:c2:b3:3d:eb:e0:ff:96:0b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

shcore.pdb

Imports

msvcrt

_callnewh
__CxxFrameHandler3
_ftol2
_vsnwprintf
_ftol2_sse
memcmp
memcpy
memmove
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
_purecall
memcpy_s
floor
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
LoadResource
LockResource
SizeofResource
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleFileNameA
FreeLibraryAndExitThread
GetModuleFileNameW
FreeLibrary
GetProcAddress
FindResourceExW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceComplete
SleepConditionVariableSRW
InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce

api-ms-win-core-synch-l1-1-0

TryAcquireSRWLockExclusive
EnterCriticalSection
CreateMutexExW
ReleaseSRWLockExclusive
CreateSemaphoreExW
AcquireSRWLockExclusive
WaitForSingleObject
CreateEventW
WaitForMultipleObjectsEx
CreateMutexW
InitializeSRWLock
OpenSemaphoreW
OpenEventW
ReleaseSRWLockShared
DeleteCriticalSection
ReleaseMutex
ReleaseSemaphore
LeaveCriticalSection
AcquireSRWLockShared
SetEvent
CreateEventExW
InitializeCriticalSectionEx
InitializeCriticalSection
WaitForSingleObjectEx

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapReAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer
EventProviderEnabled
EventSetInformation

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
TlsFree
OpenThreadToken
CreateThread
GetThreadPriority
GetCurrentThread
GetProcessId
TlsAlloc
ResumeThread
SetThreadPriority
TlsSetValue
TlsGetValue
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetStartupInfoW
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolTimer
DisassociateCurrentThreadFromCallback
SetThreadpoolTimer
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks
CallbackMayRunLong
WaitForThreadpoolWaitCallbacks
CloseThreadpoolTimer
FreeLibraryWhenCallbackReturns

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
LocalReAlloc

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrChrW
QISearch
StrCmpICW
StrCmpNIW
StrToIntW
StrDupA
StrCmpNICW
StrDupW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegDeleteValueW
RegQueryValueExA
RegEnumValueA
RegCreateKeyExA
RegGetValueW
RegSetValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegDeleteValueA
RegEnumValueW
RegDeleteKeyExW
RegEnumKeyExW
RegDeleteKeyExA
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
AdjustTokenPrivileges
GetTokenInformation
RevertToSelf
CheckTokenMembership

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
OpenFileMappingW
UnmapViewOfFile

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-file-l1-1-0

GetFileAttributesExW
GetFileSizeEx
SetEndOfFile
ReadFile
GetDriveTypeW
GetFileInformationByHandle
UnlockFileEx
FlushFileBuffers
DeleteFileW
CreateFileW
GetFileAttributesW
CreateDirectoryW
SetFileInformationByHandle
LockFileEx
SetFilePointerEx
SetFilePointer
WriteFile
GetVolumeInformationByHandleW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathGetDriveNumberW
PathIsRelativeW
PathCombineW
PathIsUNCW
PathUnExpandEnvStringsW
PathUnExpandEnvStringsA
PathFileExistsW
PathFindFileNameW
PathFindExtensionW
PathRemoveFileSpecW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
ExpandEnvironmentStringsA

api-ms-win-core-sysinfo-l1-2-0

GetOsSafeBootMode

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-largeinteger-l1-1-0

MulDiv

ntdll

_vsnprintf_s
wcsncmp
wcschr
wcsrchr
RtlAreLongPathsEnabled
toupper
NtQuerySystemInformation
memmove_s
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtQueryInformationProcess
NtCreateFile
RtlInitUnicodeString
RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-io-l1-1-0

GetOverlappedResult
CancelIoEx
DeviceIoControl

api-ms-win-core-file-l2-1-0

ReplaceFileW
GetFileInformationByHandleEx

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
QueueUserWorkItem
CreateTimerQueueTimer

rpcrt4

I_RpcBindingInqLocalClientPID

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-atoms-l1-1-0

GlobalDeleteAtom
GlobalGetAtomNameW
GlobalAddAtomExW

api-ms-win-core-path-l1-1-0

PathCchAddBackslashEx

combase

ord134

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CommandLineToArgvW
CreateRandomAccessStreamOnFile
CreateRandomAccessStreamOverStream
CreateStreamOverRandomAccessStream
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetCurrentProcessExplicitAppUserModelID
GetDpiForMonitor
GetDpiForShellUIComponent
GetFeatureEnabledState
GetFeatureVariant
GetProcessDpiAwareness
GetProcessReference
GetScaleFactorForDevice
GetScaleFactorForMonitor
IStream_Copy
IStream_Read
IStream_ReadStr
IStream_Reset
IStream_Size
IStream_Write
IStream_WriteStr
IUnknown_AtomicRelease
IUnknown_GetSite
IUnknown_QueryService
IUnknown_Set
IUnknown_SetSite
IsOS
IsProcessInIsolatedContainer
RecordFeatureError
RecordFeatureUsage
RegisterScaleChangeEvent
RegisterScaleChangeNotifications
RevokeScaleChangeNotifications
SHAnsiToAnsi
SHAnsiToUnicode
SHCopyKeyA
SHCopyKeyW
SHCreateMemStream
SHCreateStreamOnFileA
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
SHCreateThread
SHCreateThreadRef
SHCreateThreadWithHandle
SHDeleteEmptyKeyA
SHDeleteEmptyKeyW
SHDeleteKeyA
SHDeleteKeyW
SHDeleteValueA
SHDeleteValueW
SHEnumKeyExA
SHEnumKeyExW
SHEnumValueA
SHEnumValueW
SHGetThreadRef
SHGetValueA
SHGetValueW
SHOpenRegStream2A
SHOpenRegStream2W
SHOpenRegStreamA
SHOpenRegStreamW
SHQueryInfoKeyA
SHQueryInfoKeyW
SHQueryValueExA
SHQueryValueExW
SHRegDuplicateHKey
SHRegGetIntW
SHRegGetPathA
SHRegGetPathW
SHRegGetValueA
SHRegGetValueFromHKCUHKLM
SHRegGetValueW
SHRegSetPathA
SHRegSetPathW
SHReleaseThreadRef
SHSetThreadRef
SHSetValueA
SHSetValueW
SHStrDupA
SHStrDupW
SHTaskPoolAllowThreadReuse
SHTaskPoolDoNotWaitForMoreTasks
SHTaskPoolGetCurrentThreadLifetime
SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask
SHTaskPoolSetThreadReuseAllowed
SHUnicodeToAnsi
SHUnicodeToUnicode
SetCurrentProcessExplicitAppUserModelID
SetProcessDpiAwareness
SetProcessReference
SubscribeFeatureStateChangeNotification
UnregisterScaleChangeEvent
UnsubscribeFeatureStateChangeNotification

Sections

.text
Size: 483KB - Virtual size: 482KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a4df5c277f8ee205f40111c1a8eaad72

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

f5:27:fa:84:06:92:39:29:de:70:97:f1:8f:c4:5c:fb:da:cb:a1:82:d1:48:de:32:c2:b3:3d:eb:e0:ff:96:0bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-largeinteger-l1-1-0

ntdll

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-threadpool-legacy-l1-1-0

rpcrt4

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-version-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-path-l1-1-0

combase

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 483KB - Virtual size: 482KB

.data Size: 1024B - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 508B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 33KB - Virtual size: 32KB

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

f5:27:fa:84:06:92:39:29:de:70:97:f1:8f:c4:5c:fb:da:cb:a1:82:d1:48:de:32:c2:b3:3d:eb:e0:ff:96:0b
Signer

.text
Size: 483KB - Virtual size: 482KB

.data
Size: 1024B - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 508B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 33KB - Virtual size: 32KB