dssenh[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dssenh.dll
Size

192KB
MD5

090a67a23cc449aa2adf49be797b66ea
SHA1

a9029e5e9f72e9a3ec157f9f70a203e22458b75d
SHA256

e04dbde19528a5be04c396638c8ce8c89f4351b6be9752cb7a064a15334cfe5b
SHA512

151e416faed6317553afe4ee000c9362d244df49eb5e285b7faecaf9eac6df826bf036d1c3cc24a4f5437b801799c7db3c32df403fb4c7f29cafbafb31e5b380
SSDEEP

6144:98pfgHTIeOhLLrlOrNhOsaTqtZA4/v0bhUY:sfgHcbhLLr2xamsbhUY

Score

1^/10

Malware Config

Signatures

Files

dssenh.dll
.dll regsvr32 windows:6 windows x64 arch:x64

7ecb38df82d9ba4585174aef105f0169

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:63:5d:33:1b:26:32:2d:16:da:8e:b7:9e:b0:d3:34:cf:96:71:bc:15:2d:51:00:38:9d:a7:0c:a1:fd:73:dd
Signer

Actual PE Digest

16:63:5d:33:1b:26:32:2d:16:da:8e:b7:9e:b0:d3:34:cf:96:71:bc:15:2d:51:00:38:9d:a7:0c:a1:fd:73:dd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dssenh.pdb

Imports

ntdll

NtQueryInformationToken
wcscat_s
strcpy_s
RtlReleaseRelativeName
NtClose
wcscpy_s
RtlNtStatusToDosError
NtCreateFile
memcpy
memset
__chkstk
RtlAllocateHeap
RtlImageNtHeader
EtwTraceMessage
_vsnwprintf
RtlDosPathNameToRelativeNtPathName_U
RtlFreeHeap
_strlwr
strchr
NtTerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnhandledExceptionFilter
wcsncpy_s
swprintf_s
ord1
RtlVirtualUnwind
__C_specific_handler
memcmp
wcscmp

api-ms-win-core-synch-l1-2-0

ReleaseSRWLockShared
AcquireSRWLockExclusive
LeaveCriticalSection
InitializeSRWLock
EnterCriticalSection
Sleep
AcquireSRWLockShared
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSection

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetLastError

api-ms-win-core-file-l1-2-1

WriteFile
ReadFile
FindFirstFileExW
GetTempPathW
FindClose
GetTempFileNameW
GetFileSize
RemoveDirectoryW
FindNextFileW
DeleteFileW
CreateFileW

bcrypt

BCryptCreateHash
BCryptGetProperty
BCryptSetProperty
BCryptImportKeyPair
BCryptExportKey
BCryptDestroyKey
BCryptSignHash
BCryptFinalizeKeyPair
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptDecrypt
BCryptEncrypt
BCryptVerifySignature
BCryptOpenAlgorithmProvider
BCryptDuplicateKey
BCryptGenerateKeyPair
BCryptDuplicateHash
BCryptFinishHash
BCryptHashData
BCryptDestroyHash

api-ms-win-core-registry-l1-1-0

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
LoadLibraryExA
LoadStringW

api-ms-win-security-base-l1-2-0

SetSecurityDescriptorDacl
GetAclInformation
GetSecurityDescriptorControl
GetAce
GetSecurityDescriptorLength
GetSidSubAuthority
GetTokenInformation
EqualSid
InitializeAcl
AllocateAndInitializeSid
GetSidSubAuthorityCount
GetSecurityDescriptorOwner
AddAccessAllowedAce
GetSidIdentifierAuthority
IsValidSid
FreeSid
GetSecurityDescriptorSacl
MakeSelfRelativeSD
PrivilegeCheck
GetLengthSid
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
InitializeSecurityDescriptor

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap

api-ms-win-core-processthreads-l1-1-2

GetCurrentThread
OpenProcessToken
OpenThreadToken
GetCurrentProcess
SetThreadStackGuarantee

api-ms-win-core-memory-l1-1-2

MapViewOfFile
VirtualQuery
UnmapViewOfFile
VirtualAlloc
VirtualProtect
CreateFileMappingW

api-ms-win-core-file-l2-1-1

MoveFileExW

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemInfo
GetSystemDirectoryW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventRegister
EventUnregister

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrlenA

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ecb38df82d9ba4585174aef105f0169

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

16:63:5d:33:1b:26:32:2d:16:da:8e:b7:9e:b0:d3:34:cf:96:71:bc:15:2d:51:00:38:9d:a7:0c:a1:fd:73:ddSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-file-l1-2-1

bcrypt

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-memory-l1-1-2

api-ms-win-core-file-l2-1-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 146KB - Virtual size: 145KB

.data Size: 6KB - Virtual size: 9KB

.pdata Size: 5KB - Virtual size: 5KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 160B

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 512B - Virtual size: 188B

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

16:63:5d:33:1b:26:32:2d:16:da:8e:b7:9e:b0:d3:34:cf:96:71:bc:15:2d:51:00:38:9d:a7:0c:a1:fd:73:dd
Signer

.text
Size: 146KB - Virtual size: 145KB

.data
Size: 6KB - Virtual size: 9KB

.pdata
Size: 5KB - Virtual size: 5KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 160B

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 512B - Virtual size: 188B