api-ms-win-core-misc-l1-1-0[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

api-ms-win-core-misc-l1-1-0.dll
Size

4KB
MD5

49bf1a696e90320401c384db21840cb4
SHA1

d3cdb17c6985841bcfe824ff192eb8d1adfd3e85
SHA256

5b77e9706710077bed6eeb8e6b664022533ce6f6abfc86c3f34dc4612a37f2c6
SHA512

172e6f323f4bd5ab93a39940cf41c9fb8b6801983c7b9ab09cbb5dd68ea476d33031a1bea116238b95f7a180ff2c56fc155b8ba8e11784cf3efe7c0f3a48d1e0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
api-ms-win-core-misc-l1-1-0.dll

Files

api-ms-win-core-misc-l1-1-0.dll
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

API-MS-Win-Core-Misc-L1-1-0.pdb

Exports

Exports

EnumSystemLocalesA
FatalAppExitA
FatalAppExitW
FormatMessageA
FormatMessageW
GlobalAlloc
GlobalFree
IsProcessInJob
IsWow64Process
LCMapStringA
LocalAlloc
LocalFree
LocalLock
LocalReAlloc
LocalUnlock
NeedCurrentDirectoryForExePathA
NeedCurrentDirectoryForExePathW
PulseEvent
SetHandleCount
Sleep
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
lstrcmp
lstrcmpA
lstrcmpW
lstrcmpi
lstrcmpiA
lstrcmpiW
lstrcpyn
lstrcpynA
lstrcpynW
lstrlen
lstrlenA
lstrlenW

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 26B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ