AUDIOKSE[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AUDIOKSE.dll
Size

336KB
MD5

61ca68cc3c7473f5640c39e534438bfa
SHA1

99f2054d97dde981a716e6c3a2782f8615dcd5e0
SHA256

02d14b405a65ea711d59c5833541e28a94ff6d4aaf021657cbcbe131cc5c8069
SHA512

bfec262cf709ec5f5594f848fdd6eb270ce1b58af3095a296005005d1041beb077ce5fbf199339aa54104c0a4b09a1fe48d17f1db6189420efca0461e783325c
SSDEEP

6144:xqnMk6qpLHWKMeyA7T+u26k4qAFJ2RYtNQ8QBIbE7f:x4EdKMeyA7TGAFkYtSIbE7f

Score

1^/10

Malware Config

Signatures

Files

AUDIOKSE.dll
.dll regsvr32 windows:6 windows x86 arch:x86

428542b0c681edd340bba06591afd0ab

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/07/2018, 20:45

Not After

26/07/2019, 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1c:90:fc:fc:99:46:01:07:b7:41:bf:49:e7:0f:c9:6d:fa:4c:d3:d9:92:e6:dc:66:e2:3c:a0:78:79:09:07:ef
Signer

Actual PE Digest

1c:90:fc:fc:99:46:01:07:b7:41:bf:49:e7:0f:c9:6d:fa:4c:d3:d9:92:e6:dc:66:e2:3c:a0:78:79:09:07:ef

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AUDIOKSE.pdb

Imports

msvcrt

_ftol2_sse
memcmp
_except_handler4_common
_initterm
memset
_wcslwr
_ftol2
wcsstr
__CxxFrameHandler3
_resetstkoflw
_CIpow
_onexit
??_V@YAXPAX@Z
__dllonexit
_purecall
_lock
realloc
_unlock
_XcptFilter
_amsg_exit
wcscat_s
wcscpy_s
??_U@YAPAXI@Z
memcpy_s
free
malloc
wcsncpy_s
strncmp
_strnicmp
tolower
wcsrchr
_wtol
_wfopen
fseek
feof
fread
fclose
_CIlog10
strnlen
wcsnlen
_errno
_CxxThrowException
??1type_info@@UAE@XZ
memcpy

ntdll

NtCreateFile
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
RtlUnlockMemoryBlockLookaside
RtlDestroyMemoryBlockLookaside
RtlAllocateMemoryBlockLookaside
RtlLockMemoryBlockLookaside
RtlNtStatusToDosError
RtlCreateMemoryBlockLookaside
RtlFreeMemoryBlockLookaside
NtQueryInformationProcess
RtlExtendMemoryBlockLookaside
ShipAssert

oleaut32

SysStringLen
VarUI4FromStr
SysFreeString
SysAllocString

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventUnregister

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceEnableFlags
GetTraceLoggerHandle
GetTraceEnableLevel
TraceEvent

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
Sleep
WaitForSingleObject
CreateEventExW
WaitForMultipleObjectsEx
SetWaitableTimer
CancelWaitableTimer
EnterCriticalSection
InitOnceBeginInitialize
ResetEvent
InitOnceInitialize
InitOnceExecuteOnce
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObjectEx
CreateWaitableTimerExW
CreateEventW
SetEvent
CreateEventA

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-com-l1-1-1

CoTaskMemFree
CoCreateInstance
PropVariantClear
StringFromGUID2
CoTaskMemAlloc
CoGetMalloc
CoTaskMemRealloc

api-ms-win-core-libraryloader-l1-2-0

LoadResource
LoadLibraryExW
GetProcAddress
SizeofResource
DisableThreadLibraryCalls
GetModuleHandleW
FindResourceExW
GetModuleFileNameW
FreeLibrary

api-ms-win-core-string-l2-1-0

CharLowerBuffW
CharNextW

api-ms-win-core-errorhandling-l1-1-1

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegQueryValueExW
RegGetValueW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-localization-l1-2-1

GetThreadLocale
SetThreadLocale

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentProcess
CreateThread
TerminateProcess
GetCurrentThread
SetThreadPriority
GetCurrentThreadId

api-ms-win-core-io-l1-1-1

GetOverlappedResult
DeviceIoControl
CancelIo

api-ms-win-core-memory-l1-1-2

VirtualAlloc
VirtualFree
SetProcessWorkingSetSizeEx
CreateFileMappingW
GetProcessWorkingSetSizeEx
UnmapViewOfFile
MapViewOfFile

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-sysinfo-l1-2-1

GetLocalTime
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetVersionExA
GlobalMemoryStatusEx
GetTickCount

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-file-l1-2-1

CreateFileW
GetDiskFreeSpaceW
GetFileSize

api-ms-win-core-processenvironment-l1-2-0

FreeEnvironmentStringsW
GetEnvironmentStringsW
FreeEnvironmentStringsA
GetEnvironmentStrings

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-kernel32-legacy-l1-1-1

RaiseFailFastException

mmdevapi

ord5

avrt

AvSetMmThreadPriority
AvSetMmThreadCharacteristicsA
AvQuerySystemResponsiveness
AvRevertMmThreadCharacteristics

api-ms-win-core-psapi-l1-1-0

K32GetDeviceDriverFileNameW
K32GetDeviceDriverBaseNameW
K32EnumDeviceDrivers

api-ms-win-devices-query-l1-1-1

DevCloseObjectQuery
DevCreateObjectQuery

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 293KB - Virtual size: 293KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_CONST
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

428542b0c681edd340bba06591afd0ab

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

1c:90:fc:fc:99:46:01:07:b7:41:bf:49:e7:0f:c9:6d:fa:4c:d3:d9:92:e6:dc:66:e2:3c:a0:78:79:09:07:efSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-io-l1-1-1

api-ms-win-core-memory-l1-1-2

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

mmdevapi

avrt

api-ms-win-core-psapi-l1-1-0

api-ms-win-devices-query-l1-1-1

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 293KB - Virtual size: 293KB

RT_CODE Size: 2KB - Virtual size: 1KB

RT_BSS Size: - Virtual size: 40B

.data Size: 3KB - Virtual size: 9KB

.idata Size: 7KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 88B

RT_DATA Size: 512B - Virtual size: 240B

RT_CONST Size: 2KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 12KB - Virtual size: 12KB

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

1c:90:fc:fc:99:46:01:07:b7:41:bf:49:e7:0f:c9:6d:fa:4c:d3:d9:92:e6:dc:66:e2:3c:a0:78:79:09:07:ef
Signer

.text
Size: 293KB - Virtual size: 293KB

RT_CODE
Size: 2KB - Virtual size: 1KB

RT_BSS
Size: - Virtual size: 40B

.data
Size: 3KB - Virtual size: 9KB

.idata
Size: 7KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 88B

RT_DATA
Size: 512B - Virtual size: 240B

RT_CONST
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 12KB - Virtual size: 12KB