api-ms-win-core-xstate-l1-1-0[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

api-ms-win-core-xstate-l1-1-0.dll
Size

3KB
MD5

0bbb20d9d6cd1a2f35511b633e44cb86
SHA1

e7ff023222d9592b2d009de60b88b1b7367226ff
SHA256

c928630a97bc44447ad268ed84783e7e1f89e014941c0b6db1c3436ea861504a
SHA512

13729b933e3353404b7234e6c693e1c617da4a226ef23e2babb36381a3062917326e6d4a318d6ca1e562a68bba1e970d1973aeda34aff59056779cf60ff1210e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
api-ms-win-core-xstate-l1-1-0.dll

Files

api-ms-win-core-xstate-l1-1-0.dll
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

API-MS-Win-Core-Xstate-L1-1-0.pdb

Exports

Exports

RtlCopyExtendedContext
RtlGetEnabledExtendedFeatures
RtlGetExtendedContextLength
RtlGetExtendedFeaturesMask
RtlInitializeExtendedContext
RtlLocateExtendedFeature
RtlLocateLegacyContext
RtlSetExtendedFeaturesMask

Sections

.text
Size: 1024B - Virtual size: 542B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 26B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ