IDStore[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

IDStore.dll
Size

125KB
MD5

22b70b71edc79e98bb8bd94206cb3c3a
SHA1

9cf1d2f4d134da3a29a0659e0821965f7824eb85
SHA256

fe9701f1b5ad657c543c80613f43cc15b46c2757bb582597befbc547db2e58b5
SHA512

3d003f381a7774fe92316a0bc5c1af4fdb2fb0fecc74749aaa6b7d4892d2c4618fd9b4dca2812a00434ca992a3f59fbc1ac3d7e76e7cfd4a1c7dc9725c169400
SSDEEP

3072:M+lB81bM5jXtp4npz5L38nO83aZoc4XlzgyzkVxaJcSvW:Mi1AQ51UyzkVxwn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IDStore.dll

Files

IDStore.dll
.dll windows:10 windows x86 arch:x86

2b314c712a7a75ee777a344e0494beb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

IdStore.pdb

Imports

msvcrt

_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
_lock
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
_amsg_exit
free
_vsnprintf_s
_initterm
_except_handler4_common
??0exception@@QAE@ABQBDH@Z
?terminate@@YAXXZ
??0exception@@QAE@ABV0@@Z
memcmp
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
_wcsnicmp
_wcsicmp
wcscpy_s
_XcptFilter
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
__CxxFrameHandler3
??3@YAXPAX@Z
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
CreateMutexW
ReleaseMutex

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
PropVariantClear
CoTaskMemFree
IIDFromString

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegSetKeySecurity
RegCopyTreeW
RegDeleteTreeW
RegQueryValueExW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
OpenThreadToken
GetCurrentThreadId
GetCurrentThread
OpenProcessToken

api-ms-win-core-string-l2-1-0

CharUpperBuffW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-security-base-l1-1-0

InitializeAcl
GetLengthSid
AddAccessAllowedAceEx
CopySid
IsValidSid
EqualDomainSid
AllocateAndInitializeSid
CheckTokenMembership
GetTokenInformation
FreeSid

api-ms-win-core-namespace-l1-1-0

CreatePrivateNamespaceW
DeleteBoundaryDescriptor
CreateBoundaryDescriptorW
ClosePrivateNamespace
AddSIDToBoundaryDescriptor
OpenPrivateNamespaceW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

ntdll

RtlInitString
RtlFreeUnicodeString
RtlDuplicateUnicodeString
RtlEqualSid
RtlSubAuthoritySid
RtlSubAuthorityCountSid
RtlCopySid
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlFreeHeap
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlNtStatusToDosError
RtlAllocateAndInitializeSid
RtlLengthSid
RtlEqualUnicodeString
RtlInitUnicodeString
EtwTraceMessage
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
NtQueryInformationToken
RtlLengthRequiredSid
RtlInitializeSid

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

bcrypt

BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash
BCryptHashData

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b314c712a7a75ee777a344e0494beb1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-namespace-l1-1-0

api-ms-win-core-heap-l2-1-0

ntdll

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

bcrypt

Exports

Exports

Sections

.text Size: 105KB - Virtual size: 104KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 168B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 105KB - Virtual size: 104KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 168B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB