WSDApi[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WSDApi.dll
Size

448KB
MD5

fabccadc3d91ea1a522081cd82258dd5
SHA1

31ae789b22d0c111ece9e4a7db7baac12505839a
SHA256

772cc17cc4facbd17043181194263ddda53314a167ff54c7983d6e6d906ba7b0
SHA512

71458855f142b8c2d3608adee37ecd95b66eda9bc4a436602e0ec28cdf290c097d1fe4d6aac632cf960bcaff8e9f783104e6d32d8aac8ca44203ff270b50dfbc
SSDEEP

6144:SBT4KPTZ4r3px95tsHooO1No1ghCJqsZRhYzxHTntBBw29nfGHA:3KP14LFHsHooO1NyRJgFztBe29+g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WSDApi.dll

Files

WSDApi.dll
.dll windows:6 windows x86 arch:x86

e6bf59641841ded211c2791850b2b046

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WSDApi.pdb

Imports

msvcrt

_except_handler4_common
??3@YAXPAX@Z
_initterm
_XcptFilter
wcstok_s
time
iswdigit
_wtol
_stricmp
strncmp
vfwprintf_s
fclose
_get_errno
_wcserror
_wfsopen
fwprintf_s
_strnicmp
memmove_s
_vsnprintf
_purecall
tolower
wcsstr
_vsnwprintf
_wcsdup
towlower
memcpy
_time64
_localtime64
wcsncmp
_wcsnicmp
_wcsicmp
memset
malloc
free
wcschr
??2@YAPAXI@Z
_amsg_exit

ntdll

EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage
RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
EtwGetTraceEnableLevel

rpcrt4

UuidCreate
UuidFromStringA

ws2_32

getsockname
WSADuplicateSocketW
WSASocketW
setsockopt
WSASendTo
WSARecvFrom
WSAIoctl
shutdown
bind
closesocket
WSACleanup
WSAStartup
WSAAddressToStringW
WSAGetLastError
GetAddrInfoW
FreeAddrInfoW
ntohs
htons
socket
freeaddrinfo
WSAStringToAddressW
getaddrinfo

iphlpapi

GetAdaptersAddresses
ConvertInterfaceGuidToLuid
CancelMibChangeNotify2
NotifyUnicastIpAddressChange
GetBestRoute2

webservices

WsWriteStartAttribute
WsWriteChars
WsWriteEndAttribute
WsStartWriterCanonicalization
WsEndWriterCanonicalization
WsGetWriterPosition
WsMoveWriter
WsMoveReader
WsReadStartElement
WsReadEndElement
WsReadNode
WsStartReaderCanonicalization
WsEndReaderCanonicalization
WsSkipNode
WsReadBytes
WsFindAttribute
WsReadStartAttribute
WsWriteEndElement
WsReadChars
WsReadToStartElement
WsSetInput
WsSetOutputToBuffer
WsGetWriterProperty
WsCreateHeap
WsCreateXmlBuffer
WsFreeHeap
WsFreeWriter
WsCreateReader
WsSetInputToBuffer
WsCreateWriter
WsSetOutput
WsGetReaderNode
WsCopyNode
WsFreeReader
WsWriteBytes
WsWriteStartElement
WsWriteEndStartElement
WsWriteXmlnsAttribute
WsWriteText
WsWriteCharsUtf8
WsWriteValue
WsReadEndAttribute
WsSetWriterPosition

nsi

NsiGetParameter

firewallapi

IcfChangeNotificationCreate
IcfAddrChangeNotificationCreate
IcfChangeNotificationDestroy
FWClosePolicyStore
FWFreeFirewallRules
FWQueryFirewallRules
FWGetConfig
IsFirewallInCoExistanceMode
FWOpenPolicyStore
FWGetGlobalConfig

api-ms-win-core-localregistry-l1-1-0

RegOpenKeyExA
RegCloseKey

kernel32

DelayLoadFailureHook
DisableThreadLibraryCalls
GetModuleFileNameW
InterlockedDecrement
GetProcAddress
GetLastError
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
InterlockedIncrement
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
WaitForThreadpoolWorkCallbacks
ResetEvent
DuplicateHandle
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
TrySubmitThreadpoolCallback
SetThreadpoolThreadMinimum
CancelThreadpoolIo
StartThreadpoolIo
CreateThreadpoolIo
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
CancelIoEx
InitializeCriticalSection
GlobalFree
CancelIo
WaitForMultipleObjectsEx
OutputDebugStringW
MultiByteToWideChar
ReleaseSemaphore
QueueUserWorkItem
WideCharToMultiByte
GetCurrentProcessId
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
LoadLibraryW
CreateThreadpoolWait
SleepEx
UnregisterWaitEx
SetWaitableTimer
RegisterWaitForSingleObject
CreateWaitableTimerW
SetEvent
CloseHandle
CreateSemaphoreW
WaitForSingleObject
Sleep
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpool
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CreateThreadpool
SetThreadpoolThreadMaximum
CreateThreadpoolCleanupGroup
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
CreateEventW

Exports

Exports

WSDAddFirewallCheck
WSDAllocateLinkedMemory
WSDAttachLinkedMemory
WSDCancelNetworkChangeNotify
WSDCompareEndpoints
WSDCopyEndpoint
WSDCopyNameList
WSDCreateDeviceHost
WSDCreateDeviceHost2
WSDCreateDeviceHostAdvanced
WSDCreateDeviceProxy
WSDCreateDeviceProxy2
WSDCreateDeviceProxyAdvanced
WSDCreateDiscoveryProvider
WSDCreateDiscoveryProvider2
WSDCreateDiscoveryPublisher
WSDCreateDiscoveryPublisher2
WSDCreateHttpAddress
WSDCreateHttpMessageParameters
WSDCreateHttpTransport
WSDCreateMetadataAgent
WSDCreateOutboundAttachment
WSDCreateUdpAddress
WSDCreateUdpMessageParameters
WSDCreateUdpTransport
WSDDetachLinkedMemory
WSDFreeLinkedMemory
WSDGenerateFault
WSDGenerateFaultEx
WSDGenerateRandomDelay
WSDGetConfigurationOption
WSDNotifyNetworkChange
WSDProcessFault
WSDRemoveFirewallCheck
WSDSetConfigurationOption
WSDUriDecode
WSDUriEncode
WSDXMLAddChild
WSDXMLAddSibling
WSDXMLBuildAnyForSingleElement
WSDXMLCleanupElement
WSDXMLCompareNames
WSDXMLCreateContext
WSDXMLGetNameFromBuiltinNamespace
WSDXMLGetValueFromAny

Sections

.text
Size: 414KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6bf59641841ded211c2791850b2b046

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

rpcrt4

ws2_32

iphlpapi

webservices

nsi

firewallapi

api-ms-win-core-localregistry-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 414KB - Virtual size: 413KB

.data Size: 7KB - Virtual size: 9KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 414KB - Virtual size: 413KB

.data
Size: 7KB - Virtual size: 9KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 23KB