Windows[.]Web[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Windows.Web.dll
Size

553KB
MD5

af65521a5b136f0d53dfcf66ad1b3b62
SHA1

e1535306d49091a91478edcb4a8d2c881e3e35d4
SHA256

bb348c855ee042d1b2053cf019252d895155ce13325421a435020a504a376841
SHA512

ff1504a3f9f833467fc5d0671e8ae23cc695f09d26283b72ec2085a2bfe1c563022d18131dfe4ce8145f3626c505339d266749194cd6eb35b993bd78ecf2666b
SSDEEP

12288:8OifklQPCzbHwMGsaqdSumQWAnc8JX7JkNutMXhdd:IfklQPCPXYGc8Jd7eXt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows.Web.dll

Files

Windows.Web.dll
.dll regsvr32 windows:6 windows x86 arch:x86

0054dd7624583847e5d4e62f05770685

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Windows.Web.pdb

Imports

msvcrt

_XcptFilter
_itoa_s
_ftol2
_itow_s
_wcsicmp
memcmp
_amsg_exit
_initterm
_ecvt_s
_finite
_lock
_unlock
__dllonexit
memcpy
??3@YAXPAX@Z
_onexit
__CxxFrameHandler3
_except_handler4_common
_wtof
free
realloc
malloc
memmove_s
_purecall
??2@YAPAXI@Z
memset

ntdll

WinSqmIncrementDWORD
WinSqmIsOptedIn
WinSqmSetDWORD

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal

api-ms-win-core-synch-l1-2-0

AcquireSRWLockShared
ReleaseSRWLockShared
LeaveCriticalSection
EnterCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DeleteCriticalSection
InitOnceExecuteOnce
InitializeCriticalSection
CreateEventW
Sleep

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
OpenProcessToken
OpenProcess

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
CallbackMayRunLong
TrySubmitThreadpoolCallback
SubmitThreadpoolWork
CreateThreadpoolWait
CloseThreadpoolWait
CloseThreadpoolWork
SetThreadpoolWait
FreeLibraryWhenCallbackReturns
WaitForThreadpoolWorkCallbacks

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventUnregister

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-sysinfo-l1-2-1

GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount

rpcrt4

CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
RpcStringFreeW
UuidToStringW
UuidCreate
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllUnregisterProxy
CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
NdrStubCall2
CStdStubBuffer_DebugServerRelease
NdrStubForwardingFunction
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
FreeLibrary
GetModuleHandleExW
DisableThreadLibraryCalls

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

combase

ord34
ord13
ord11
ord16
ord7
ord14
ord6
ord10
ord12
ord9
ord8
ord15
ord17
ord5
ord32
ord2
ord3
ord33

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 483KB - Virtual size: 482KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0054dd7624583847e5d4e62f05770685

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

rpcrt4

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

combase

api-ms-win-core-localization-l1-2-1

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 483KB - Virtual size: 482KB

.orpc Size: 1KB - Virtual size: 1KB

.data Size: 5KB - Virtual size: 6KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 372B

.rsrc Size: 18KB - Virtual size: 17KB

.reloc Size: 39KB - Virtual size: 39KB

.text
Size: 483KB - Virtual size: 482KB

.orpc
Size: 1KB - Virtual size: 1KB

.data
Size: 5KB - Virtual size: 6KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 372B

.rsrc
Size: 18KB - Virtual size: 17KB

.reloc
Size: 39KB - Virtual size: 39KB