Windows[.]System[.]RemoteDesktop[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

Windows.System.RemoteDesktop.dll
Size

17KB
MD5

8aad7ab1b8b19e3061d749b8c0248895
SHA1

d2cb7f978b6792f76d9cc0b091f37fb26faede42
SHA256

edd77b4c22a93f44479117bd327a4bf4f094526c85a45406c6e0bffefa52a287
SHA512

92b7e1c400e474442aa0fbc415ee00b482489c51a339f7f9717a2d876ff47bdadbab4964f263b1f99b7b5ab1f64d7f919cc7e634a61ce42e1ef4e5c8c3b11597
SSDEEP

384:/mM5YekgYc9xJGFF99Eqe6wRKIe6p3oen82yPUW+VW6:etn/jp/iyPQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows.System.RemoteDesktop.dll

Files

Windows.System.RemoteDesktop.dll
.dll regsvr32 windows:6 windows x86 arch:x86

11590e609f3d4800ba4fc331ed168069

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Windows.System.RemoteDesktop.pdb

Imports

msvcrt

_unlock
__CxxFrameHandler3
??2@YAPAXI@Z
_initterm
__dllonexit
_onexit
_except_handler4_common
_lock
malloc
free
_amsg_exit
_XcptFilter
_purecall
??3@YAXPAX@Z
memcmp

rpcrt4

NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrOleAllocate
NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy
NdrDllUnregisterProxy
NdrDllGetClassObject
IUnknown_AddRef_Proxy
NdrDllCanUnloadNow
IUnknown_Release_Proxy
NdrStubCall2

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError
RoOriginateErrorW

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Sleep
AcquireSRWLockShared
ReleaseSRWLockShared

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter

combase

ord32
ord33
ord5
ord34

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

11590e609f3d4800ba4fc331ed168069

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

combase

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 9KB

.orpc Size: 512B - Virtual size: 78B

.data Size: 512B - Virtual size: 988B

.idata Size: 2KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 848B

.text
Size: 10KB - Virtual size: 9KB

.orpc
Size: 512B - Virtual size: 78B

.data
Size: 512B - Virtual size: 988B

.idata
Size: 2KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 848B