exsmime.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ExSMime.dll
Resource
win10v2004-20240426-en
General
-
Target
ExSMime.dll
-
Size
208KB
-
MD5
d879be3b9eee31c8d5e5ca692f080a35
-
SHA1
31dab798a42c4b5bfdf399e871a2ded856a60932
-
SHA256
0dd807e6a4882d114ce0eb3bc271f438ea5515fe37dd25e4b57a0c5ad98abff6
-
SHA512
78df239b50d6891f8130c23d79b6b3ed7ad7827fe4948e86fbfa013cf9f639bd3d72e87468ef5b996167ac003e7361ad3abd8a8d81c9580e7bbf8056d8afcab2
-
SSDEEP
6144:dVL0pM1isOeY3uyJFwkQcNprofXjffqrk:dV8DacTrofbqo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ExSMime.dll
Files
-
ExSMime.dll.dll regsvr32 windows:10 windows x86 arch:x86
5a82cabdf2a7edf6dba29459b8b23320
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_ultoa_s
_callnewh
_XcptFilter
strchr
_amsg_exit
_snprintf_s
_except_handler4_common
_errno
wcsncpy_s
realloc
_lock
_unlock
__dllonexit
_onexit
memcmp
memchr
_initterm
free
strcpy_s
wcscat_s
malloc
wcscpy_s
_purecall
memcpy_s
memset
oleaut32
VariantInit
SysAllocString
VariantCopy
VarCmp
VariantClear
VarUI4FromStr
VariantChangeType
SysStringLen
SysFreeString
api-ms-win-core-errorhandling-l1-1-0
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-url-l1-1-0
UrlIsW
PathCreateFromUrlW
PathIsURLW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
DisableThreadLibraryCalls
SizeofResource
FreeLibrary
FindResourceExW
LoadResource
GetProcAddress
LoadLibraryExW
GetModuleHandleW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegDeleteValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-file-l1-1-0
GetFileInformationByHandle
FlushFileBuffers
SetEndOfFile
GetTempFileNameW
CreateFileW
FileTimeToLocalFileTime
SetFilePointerEx
WriteFile
ReadFile
api-ms-win-core-localization-l1-2-0
IsDBCSLeadByteEx
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpNIA
StrCmpNA
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 191KB - Virtual size: 191KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ