Windows[.]Globalization[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Windows.Globalization.dll
Size

843KB
MD5

654e30be118f1c7b1cd39bfea696af2a
SHA1

a2793c94762d9bf0efd396fea073106ae38dac9b
SHA256

c50558d603de8041ab3aad7c9c8f435c6038171fb6aa57a7af66d439e53086d7
SHA512

a63edd4b6db246270303736e416b1aa64ecb5a7c8007198cf0ca18cc52c68433b2f28043407a4d14510c581089e9e2dcfb39605a81ac0f32d323b28f04718c66
SSDEEP

24576:HiNBfuRi5uGDF4Wos7Chvzn/yY86FoUxClIqDp:CN17uj67ChrrqVDp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows.Globalization.dll

Files

Windows.Globalization.dll
.dll windows:6 windows x86 arch:x86

19d0eaa2181917db4bb7dd1586e2f439

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Windows.Globalization.pdb

Imports

msvcrt

__CxxFrameHandler3
memcpy
setlocale
_lock
_CxxThrowException
_unlock
___lc_collate_cp_func
memcmp
__pctype_func
memset
_ismbblead
calloc
_callnewh
__uncaught_exception
_wcsdup
??8type_info@@QBEHABV0@@Z
__crtCompareStringW
___lc_codepage_func
___lc_handle_func
___mb_cur_max_func
__crtLCMapStringW
wcstod
_get_current_locale
_free_locale
modf
abort
ceil
??0exception@@QAE@XZ
_ecvt_s
??0exception@@QAE@ABQBDH@Z
??3@YAXPAX@Z
_ftol2_sse
_ftol2
_CIlog10
_CIfmod
wcstol
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_initterm
_amsg_exit
_XcptFilter
_errno
wcscpy_s
realloc
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_purecall
??0bad_cast@@QAE@ABV0@@Z
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??_V@YAXPAX@Z
strchr
malloc
free
memmove
memmove_s
floor

api-ms-win-core-winrt-error-l1-1-1

RoTransformError
RoOriginateErrorW
RoOriginateError

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal
WindowsDeleteString
HSTRING_UserSize
WindowsStringHasEmbeddedNull
HSTRING_UserMarshal
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsCreateString
WindowsCreateStringReference
HSTRING_UserUnmarshal
WindowsGetStringLen
HSTRING_UserFree

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

InitOnceInitialize
InitializeSRWLock
Sleep
DeleteCriticalSection
AcquireSRWLockShared
LeaveCriticalSection
EnterCriticalSection
ReleaseSRWLockShared
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitOnceExecuteOnce

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventRegister
EventUnregister

api-ms-win-core-libraryloader-l1-2-0

FindStringOrdinal
DisableThreadLibraryCalls

api-ms-win-core-com-l1-1-1

CoCreateInstance
CLSIDFromString
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-localization-l1-2-1

EnumSystemLocalesEx
ResolveLocaleName
EnumSystemGeoID
GetUserGeoID
GetGeoInfoW
GetUserDefaultLocaleName
GetLocaleInfoEx
FormatMessageW
IsValidLocaleName
GetCalendarInfoEx

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
CompareStringOrdinal

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegGetValueW

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformationEffectiveYears
EnumDynamicTimeZoneInformation
GetTimeZoneInformationForYear
GetTimeZoneInformation
GetDynamicTimeZoneInformation

api-ms-win-core-path-l1-1-0

PathCchAppend

rpcrt4

NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_CountRefs
NdrStubCall2
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
CStdStubBuffer_Connect
CStdStubBuffer_AddRef

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-localization-obsolete-l1-2-0

LCIDToLocaleName

api-ms-win-core-kernel32-legacy-l1-1-1

RaiseFailFastException

api-ms-win-core-localization-l2-1-0

EnumTimeFormatsEx
EnumCalendarInfoExEx

api-ms-win-core-normalization-l1-1-0

GetStringScripts

ntdll

RtlQueryWnfStateData
RtlNtStatusToDosError
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
ord1

combase

ord16
ord12
ord5
ord7
ord9
ord2
ord11
ord22
ord33
ord6
ord20
ord8
ord21
ord34
ord19
ord17
ord32
ord13
ord10
ord15
ord18
ord14

bcp47langs

GetApplicationLanguageOverride
Bcp47Normalize
Bcp47GetExtensionSubstring
Bcp47GetIsoScriptCode
GetUserLanguages
ClearApplicationLanguageOverride
SetApplicationLanguageOverride
GetApplicationManifestLanguages
Bcp47IsWellFormed
GetApplicationLanguages
ResolveLanguages
Bcp47GetDistance

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 765KB - Virtual size: 764KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 534B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19d0eaa2181917db4bb7dd1586e2f439

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-path-l1-1-0

rpcrt4

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-localization-l2-1-0

api-ms-win-core-normalization-l1-1-0

ntdll

combase

bcp47langs

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 765KB - Virtual size: 764KB

.orpc Size: 1024B - Virtual size: 534B

.data Size: 11KB - Virtual size: 10KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 52B

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 48KB - Virtual size: 48KB

.text
Size: 765KB - Virtual size: 764KB

.orpc
Size: 1024B - Virtual size: 534B

.data
Size: 11KB - Virtual size: 10KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 52B

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 48KB - Virtual size: 48KB