WebClnt[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WebClnt.dll
Size

204KB
MD5

dc54d7a40b6e18e5c7f592f836d163ff
SHA1

136d80627a426d6a1f41201adc98ddc631a13c03
SHA256

436af3b94eae6cbd2516a63235ae1d6ec4f1fcaa0f974a9672bb5ab2a846bb2c
SHA512

75961bf56cc13902ae6ee37ae3a3e9f7596fce3610e3fd3884c48875bcfe8e43fd6ea279170b147039ed6ce22c5eafdbbdb470b0daee69c3b9ae6d3303831bc3
SSDEEP

3072:+ETnfGpW3xb/EJ2KLPCOTAAwt+5DdA8uYMYTvOiR8f/m5Nk8cfo2n:spOx7EJbB0BtwDiBYTvO+8f/m5NpG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WebClnt.dll

Files

WebClnt.dll
.dll windows:6 windows x86 arch:x86

f7305c751933ed958571fd2a42e348ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WebClnt.pdb

Imports

msvcrt

_wtoi
wcstok
wcsstr
_vsnprintf
_wcsnicmp
memcpy
memset
wcscspn
wcschr
_vsnwprintf
_wcsupr
time
_wcsicmp
strtoul
wcspbrk
swscanf
??2@YAPAXI@Z
_XcptFilter
malloc
free
_initterm
_amsg_exit
_except_handler4_common
wcstombs
??3@YAXPAX@Z
tolower
_wtoi64
iswctype

ntdll

EtwTraceMessage
NtCreateFile
RtlNtStatusToDosError
RtlMapSecurityErrorToNtStatus
NtClose
NtQueryInformationToken
NtOpenThreadToken
RtlCopyLuid
RtlReleaseResource
RtlAcquireResourceExclusive
RtlInitUnicodeString
RtlAppendUnicodeStringToString
RtlIntegerToUnicodeString
NtFsControlFile
NtOpenFile
RtlInitializeResource
RtlDeleteResource
RtlFreeHeap
RtlDosPathNameToNtPathName_U
NtQueryInformationFile
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
NtQueryInformationProcess
RtlTimeFieldsToTime
NtSetInformationThread
NtAdjustPrivilegesToken
NtDuplicateToken
NtOpenProcessToken

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

DefineDosDeviceW
QueryDosDeviceW
ReadFile
FileTimeToSystemTime
CreateFileW
WriteFile
GetFileInformationByHandle
SetFilePointer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-interlocked-l1-1-0

InterlockedExchange
InterlockedCompareExchange
InterlockedIncrement
InterlockedDecrement

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-libraryloader-l1-1-0

DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
LoadLibraryExA

api-ms-win-core-localregistry-l1-1-0

RegDisablePredefinedCacheEx
RegGetValueW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-misc-l1-1-0

LocalFree
LocalAlloc
LocalLock
LocalReAlloc
LocalUnlock
Sleep
lstrlenW
GlobalFree
lstrcmpW

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentThread
SetThreadToken
GetCurrentThreadId
CreateThread
GetExitCodeProcess
TerminateProcess
CreateProcessAsUserW
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
SetEvent
CreateEventW

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemDirectoryW
GetSystemTime
SystemTimeToFileTime
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-threadpool-l1-1-0

CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
CreateThreadpool
TrySubmitThreadpoolCallback

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
SetFileSecurityW
RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-service-core-l1-1-0

SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

rpcrt4

RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcBindingServerFromClient
RpcBindingToStringBindingW
RpcStringBindingParseW
I_RpcBindingIsClientLocal
RpcBindingFree
RpcStringFreeW
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
NdrServerCall2

davhlpr

DavGetServerPortAndPhysicalName
DavRemoveDummyShareFromFileName
UtfUrlStrToWideStr
WideStrToUtfUrlStr
DavRemoveDummyShareFromFileNameEx

oleaut32

SysFreeString

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

kernel32

CreateDirectoryW
FindNextFileW
DeleteFileW
FindFirstFileW
FindClose
LoadLibraryW
DelayLoadFailureHook
UnregisterWait
GetTempPathW
LocalSize
DosPathToSessionPathW
GetModuleFileNameW
FreeLibraryAndExitThread
GetModuleHandleW
IdnToAscii

Exports

Exports

DavClose
DavInit
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f7305c751933ed958571fd2a42e348ea

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

rpcrt4

davhlpr

oleaut32

userenv

kernel32

Exports

Exports

Sections

.text Size: 171KB - Virtual size: 171KB

.data Size: 17KB - Virtual size: 16KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 171KB - Virtual size: 171KB

.data
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 12KB