SHCore[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SHCore.dll
Size

549KB
MD5

c8d4be4156036807529ed4269d927a39
SHA1

1e621adaf547d30347fbe399d5da4383395172a7
SHA256

bf03550396412577984e966b07a2e64383beced3b146d1b8b66e305527e1d515
SHA512

6235df2979c55ece616d47495f27976883218e315baa2caff9f321fdc930cdd0c3933c2f5ccbaa909abfdc1045e76961421fb9ef7de0235bb54bd5936d9c78ea
SSDEEP

6144:12N7lee/wKBjsYqL6LDL5XJ8Y3cmXtkBcSebRFKVtRjUPxGveH9EGqrP:12N7Hgj25XJ8A8cSbeHH9EBD

Score

1^/10

Malware Config

Signatures

Files

SHCore.dll
.dll windows:6 windows x86 arch:x86

d82752860da95453839838234cb9e6e1

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:5d:00:a6:45:7c:69:a6:ad:e7:13:d5:4c:33:b9:d0:99:3d:25:53:e5:15:32:51:03:3a:a4:86:9b:ab:3a:0e
Signer

Actual PE Digest

4d:5d:00:a6:45:7c:69:a6:ad:e7:13:d5:4c:33:b9:d0:99:3d:25:53:e5:15:32:51:03:3a:a4:86:9b:ab:3a:0e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

shcore.pdb

Imports

msvcrt

memmove
_except_handler4_common
_ftol2
_amsg_exit
wcsncmp
_lock
wcschr
_initterm
__CxxFrameHandler3
__dllonexit
memcpy_s
strchr
_vsnwprintf
??2@YAPAXI@Z
memcpy
_purecall
??3@YAXPAX@Z
_unlock
memcmp
wcsrchr
memset
free
_onexit
_XcptFilter
malloc
_ftol2_sse

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseSRWLockExclusive
WaitForMultipleObjectsEx
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObject
SetEvent
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
InitializeCriticalSection
CreateMutexW
ReleaseMutex
Sleep
AcquireSRWLockShared
OpenEventW
InitializeSRWLock
CreateEventW
InitOnceExecuteOnce
WaitForSingleObjectEx
ReleaseSemaphore
CreateEventExW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoTransformError
RoOriginateError

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventUnregister
EventRegister

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameW
FreeLibraryAndExitThread
LoadLibraryExW
GetProcAddress
FindResourceExW
LoadResource
FreeLibrary
LockResource
SizeofResource
GetModuleHandleExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

TlsSetValue
OpenProcess
GetCurrentThread
GetStartupInfoW
GetCurrentProcess
OpenThreadToken
GetCurrentProcessId
OpenProcessToken
TlsGetValue
GetProcessId
TlsAlloc
TlsFree
CreateThread
TerminateProcess
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-2-1

GetVersionExW
GetSystemTimeAsFileTime
GetOsSafeBootMode
GetTickCount

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-memory-l1-1-2

OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsA
ExpandEnvironmentStringsW

api-ms-win-core-registry-l1-1-0

RegSetValueExA
RegDeleteKeyExA
RegQueryValueExA
RegCreateKeyExA
RegDeleteKeyExW
RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyW
RegDeleteValueA
RegCreateKeyExW
RegQueryInfoKeyA
RegQueryValueExW
RegDeleteValueW
RegEnumValueA
RegEnumKeyExA
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegSetValueExW
RegGetValueW

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CloseThreadpoolTimer
DisassociateCurrentThreadFromCallback
CloseThreadpoolWait
FreeLibraryWhenCallbackReturns
SetThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
TrySubmitThreadpoolCallback

api-ms-win-security-base-l1-2-0

GetTokenInformation
AdjustTokenPrivileges
CheckTokenMembership

api-ms-win-core-file-l1-2-1

GetFileInformationByHandle
FlushFileBuffers
GetFileSizeEx
ReadFile
DeleteFileW
LockFileEx
SetFileInformationByHandle
GetFileAttributesExW
CreateFileW
SetFilePointer
GetFileAttributesW
UnlockFileEx
GetVolumeInformationByHandleW
GetDriveTypeW
SetFilePointerEx
SetEndOfFile
WriteFile

api-ms-win-core-io-l1-1-1

DeviceIoControl
GetOverlappedResult
CancelIoEx

api-ms-win-core-path-l1-1-0

PathAllocCanonicalize

api-ms-win-core-file-l2-1-1

ReplaceFileW
GetFileInformationByHandleEx

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-core-heap-l1-2-0

HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW
PathRemoveFileSpecW
PathCombineW
PathUnExpandEnvStringsA
PathUnExpandEnvStringsW
PathFindFileNameW
PathIsUNCW
PathGetDriveNumberW
PathFindExtensionW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
QueueUserWorkItem
CreateTimerQueueTimer

api-ms-win-core-kernel32-legacy-l1-1-1

CreateSemaphoreW
MulDiv
RaiseFailFastException

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW
GlobalDeleteAtom
GlobalAddAtomExW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc
LocalReAlloc

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNICW
StrDupA
StrDupW
QISearch
StrToIntW
StrCmpNIW
StrCmpICW
StrChrW
SHLoadIndirectString

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

ntdll

RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlNtStatusToDosError
NtQueryInformationProcess
NtCreateFile
NtQuerySystemInformation
RtlInitUnicodeString

combase

ord134

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

CommandLineToArgvW
CreateRandomAccessStreamOnFile
CreateRandomAccessStreamOverStream
CreateStreamOverRandomAccessStream
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetCurrentProcessExplicitAppUserModelID
GetDpiForMonitor
GetProcessDpiAwareness
GetProcessReference
GetScaleFactorForDevice
GetScaleFactorForMonitor
IStream_Copy
IStream_Read
IStream_ReadStr
IStream_Reset
IStream_Size
IStream_Write
IStream_WriteStr
IUnknown_AtomicRelease
IUnknown_GetSite
IUnknown_QueryService
IUnknown_Set
IUnknown_SetSite
IsOS
RegisterScaleChangeEvent
RegisterScaleChangeNotifications
RevokeScaleChangeNotifications
SHAnsiToAnsi
SHAnsiToUnicode
SHCopyKeyA
SHCopyKeyW
SHCreateMemStream
SHCreateStreamOnFileA
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
SHCreateThread
SHCreateThreadRef
SHCreateThreadWithHandle
SHDeleteEmptyKeyA
SHDeleteEmptyKeyW
SHDeleteKeyA
SHDeleteKeyW
SHDeleteValueA
SHDeleteValueW
SHEnumKeyExA
SHEnumKeyExW
SHEnumValueA
SHEnumValueW
SHGetThreadRef
SHGetValueA
SHGetValueW
SHOpenRegStream2A
SHOpenRegStream2W
SHOpenRegStreamA
SHOpenRegStreamW
SHQueryInfoKeyA
SHQueryInfoKeyW
SHQueryValueExA
SHQueryValueExW
SHRegDuplicateHKey
SHRegGetIntW
SHRegGetPathA
SHRegGetPathW
SHRegGetValueA
SHRegGetValueFromHKCUHKLM
SHRegGetValueW
SHRegSetPathA
SHRegSetPathW
SHReleaseThreadRef
SHSetThreadRef
SHSetValueA
SHSetValueW
SHStrDupA
SHStrDupW
SHUnicodeToAnsi
SHUnicodeToUnicode
SetCurrentProcessExplicitAppUserModelID
SetProcessDpiAwareness
SetProcessReference
UnregisterScaleChangeEvent

Sections

.text
Size: 489KB - Virtual size: 488KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 9B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d82752860da95453839838234cb9e6e1

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

4d:5d:00:a6:45:7c:69:a6:ad:e7:13:d5:4c:33:b9:d0:99:3d:25:53:e5:15:32:51:03:3a:a4:86:9b:ab:3a:0eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

combase

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 489KB - Virtual size: 488KB

.data Size: 2KB - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 364B

.tls Size: - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 32KB - Virtual size: 32KB

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

4d:5d:00:a6:45:7c:69:a6:ad:e7:13:d5:4c:33:b9:d0:99:3d:25:53:e5:15:32:51:03:3a:a4:86:9b:ab:3a:0e
Signer

.text
Size: 489KB - Virtual size: 488KB

.data
Size: 2KB - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 364B

.tls
Size: - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 32KB - Virtual size: 32KB