DismApi[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

DismApi.dll
Size

458KB
MD5

1a841fa49043d13a8a9603be3b97cffa
SHA1

9453313c59a1b5ca15210df07b52cd9fac52d657
SHA256

e66c1bf36c0761ab806674204cf9dda9aefdd773e489b65331c56e4f1c6e9826
SHA512

87e2b6c3d52b67a99ac43014550f494e9c897c71704d73aff972b85d933e0a82e3f76011db682ba829e6b43e1fa559b59e781e896120f98e4b87f46ec0c7ab4b
SSDEEP

6144:A9e4AjZVpR+/M6FCmesrFp6lGNDYSVfTmKYzxktevGu49n9+LIa+af:A9EZkk6cmesZp6wYWbmKY1kWfga+af

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DismApi.dll

Files

DismApi.dll
.dll windows:6 windows x86 arch:x86

d98e1c3bd66f901788b57cb29afa868e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

DismApi.pdb

Imports

msvcrt

fclose
wcstok_s
fgetws
_wfopen
feof
iswctype
strrchr
rand
_wcslwr_s
_wtoi
towlower
wcsstr
_vsnwprintf
wcsrchr
_wcsnicmp
_except_handler4_common
realloc
_errno
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QAE@XZ
wcscpy_s
memset
vsprintf_s
_vscprintf
calloc
_vsnprintf
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
swscanf_s
iswspace
wcschr
memcmp
_ftol2
_wcstoui64
wcstoul
_purecall
_wcsicmp
iswalpha
malloc
free
vswprintf_s
_vscwprintf
memmove_s
memcpy_s
memcpy

api-ms-win-downlevel-kernel32-l1-1-0

FileTimeToLocalFileTime
FileTimeToSystemTime
SizeofResource
GetCurrentProcessId
CompareStringW
HeapFree
GetProcessHeap
GetEnvironmentVariableW
LoadLibraryExW
LockResource
GetModuleFileNameW
GetThreadUILanguage
OutputDebugStringA
GetModuleHandleExW
WideCharToMultiByte
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
RaiseException
DeleteCriticalSection
InitializeCriticalSection
GetProcAddress
GetVersionExW
GetModuleHandleW
MoveFileExW
ExitProcess
GetFileSize
TlsGetValue
MapViewOfFile
UnmapViewOfFile
VirtualQuery
FormatMessageA
TlsSetValue
GetLocalTime
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
GetVersion
CreateFileMappingW
TlsAlloc
FormatMessageW
GetWindowsDirectoryW
TlsFree
CreateFileA
MultiByteToWideChar
CreateMutexW
Sleep
QueryPerformanceCounter
GetSystemTimeAsFileTime
WaitForSingleObject
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
ExpandEnvironmentStringsA
WriteFile
CreateThread
ExpandEnvironmentStringsW
GetModuleFileNameA
LoadLibraryExA
CreateMutexA
ReleaseMutex
DeleteFileW
DebugBreak
DeleteFileA
GetFileSizeEx
IsDebuggerPresent
WaitForMultipleObjectsEx
LoadResource
GetLocaleInfoW
GetSystemTime
GetTimeFormatW
SetFilePointer
GetSystemWindowsDirectoryW
CreateEventW
ResumeThread
DuplicateHandle
OutputDebugStringW
ResetEvent
GetLastError
GetCurrentProcess
SearchPathW
GetFullPathNameW
FindFirstFileW
CopyFileExW
CreateFileW
FlushFileBuffers
GetTempPathW
SetLastError
FindClose
DeviceIoControl
FindNextFileW
CloseHandle
GetFileInformationByHandle
SetFileAttributesW
GetCurrentThread
GetSystemInfo
IsWow64Process
GetFileAttributesW
CreateDirectoryW
GetCommandLineW
GetTickCount
SetErrorMode
FindResourceExW
SetEvent
GetTempFileNameW

api-ms-win-downlevel-advapi32-l1-1-1

OpenThreadToken
CheckTokenMembership
GetTokenInformation
FreeSid
AddAccessAllowedAce
AllocateAndInitializeSid
EqualSid
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
InitializeAcl
SetSecurityDescriptorDacl
GetTraceEnableFlags
GetTraceLoggerHandle
InitializeSecurityDescriptor
GetTraceEnableLevel
RegisterTraceGuidsW
TraceEvent
UnregisterTraceGuids
GetLengthSid
RegCloseKey
RegSetValueExW
OpenProcessToken

api-ms-win-downlevel-ole32-l1-1-1

CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
GetErrorInfo

api-ms-win-downlevel-kernel32-l2-1-0

LocalFree
CreateFileMappingA

api-ms-win-downlevel-user32-l1-1-1

CharLowerBuffW

oleaut32

SafeArrayUnaccessData
SysStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringLen
VarBstrCat
SysAllocStringByteLen
SysAllocString
SysStringLen
VarBstrCmp
SafeArrayDestroy
SafeArrayAccessData
LoadTypeLi
LoadRegTypeLi
VariantClear
SysFreeString

ntdll

RtlAllocateHeap
RtlFreeHeap
RtlGetVersion
RtlNtStatusToDosError
NtSetInformationFile

api-ms-win-downlevel-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

Exports

Exports

DismAddDriver
DismAddPackage
DismApplyUnattend
DismCheckImageHealth
DismCleanupMountpoints
DismCloseSession
DismCommitImage
DismDelete
DismDisableFeature
DismEnableFeature
DismGetDriverInfo
DismGetDrivers
DismGetFeatureInfo
DismGetFeatureParent
DismGetFeatures
DismGetImageInfo
DismGetLastErrorMessage
DismGetMountedImageInfo
DismGetPackageInfo
DismGetPackages
DismInitialize
DismMountImage
DismOpenSession
DismRemountImage
DismRemoveDriver
DismRemovePackage
DismRestoreImageHealth
DismShutdown
DismUnmountImage
_DismAddProvisionedAppxPackage
_DismEnableDisableFeature
_DismExportDriver
_DismGetCurrentEdition
_DismGetFeaturesEx
_DismGetKCacheBinaryValue
_DismGetKCacheDwordValue
_DismGetKCacheStringValue
_DismGetLastCBSSessionID
_DismGetOsInfo
_DismGetProductKeyInfo
_DismGetProvisionedAppxPackages
_DismGetRegistryMountPoint
_DismGetStateFromCBSSessionID
_DismGetTargetEditions
_DismOptimizeImage
_DismRemoveProvisionedAppxPackage
_DismSetAppXProvisionedDataFile
_DismSetEdition
_DismSetFirstBootCommandLine
_DismSetMachineName
_DismSetProductKey
_DismValidateProductKey

Sections

.text
Size: 396KB - Virtual size: 396KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d98e1c3bd66f901788b57cb29afa868e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-downlevel-kernel32-l1-1-0

api-ms-win-downlevel-advapi32-l1-1-1

api-ms-win-downlevel-ole32-l1-1-1

api-ms-win-downlevel-kernel32-l2-1-0

api-ms-win-downlevel-user32-l1-1-1

oleaut32

ntdll

api-ms-win-downlevel-version-l1-1-0

Exports

Exports

Sections

.text Size: 396KB - Virtual size: 396KB

.data Size: 15KB - Virtual size: 16KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 396KB - Virtual size: 396KB

.data
Size: 15KB - Virtual size: 16KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 27KB - Virtual size: 27KB