TtlsExt[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

TtlsExt.dll
Size

129KB
MD5

6dcf152d5c9a720917162083980c6eb2
SHA1

4240043f68e6647dca0aae029dc424bbc6795874
SHA256

c3def09560533827de3635058eafa85dee1412ffdabb40450f6cc71b92a17538
SHA512

1a865b2ef9b7686ceecafdab8cb35aceb7a5deb220eaf9e9acfbd0ad37bed1a9e28f640d65bba5c7ad6315651e2f6608076bd39158f11dd74b632ad794d146e9
SSDEEP

3072:tw2KQ7cgXSenEm1JMtwSUVWsR3Julp5fc3VRqbInh:tzKQgPVtmVWslJulp5fc3VRqih

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TtlsExt.dll

Files

TtlsExt.dll
.dll regsvr32 windows:10 windows x86 arch:x86

57c1521b95148f8b0211686ba13a2c61

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ttlsext.pdb

Imports

msvcp_win

?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Incref@facet@locale@std@@UAEXXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Wcscoll
??Bid@locale@std@@QAEIXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?is@?$ctype@G@std@@QBE_NFG@Z
?tolower@?$ctype@G@std@@QBEGG@Z
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
_Wcsxfrm
?id@?$ctype@G@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@G@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z

api-ms-win-crt-string-l1-1-0

wcsncmp
wcscspn
memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wtol
_o_free
_o_malloc
_o_realloc
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_except_handler4_common
_CxxThrowException
__std_terminate
_o__cexit
_o__callnewh
__CxxFrameHandler3
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__RTDynamicCast
memcmp
memcpy
strchr

ntdll

RtlNtStatusToDosError
RtlInitString

oleaut32

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetProcAddress
DisableThreadLibraryCalls
FindResourceExW
LoadStringW
LockResource
SizeofResource
GetModuleHandleW
FreeLibrary
GetModuleFileNameW
LoadResource

sspicli

LsaConnectUntrusted
GetUserNameExW
LsaLookupAuthenticationPackage

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

crypt32

CertVerifyTimeValidity
CertEnumCertificatesInStore
CertFindCertificateInStore
CertGetNameStringW
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertGetCertificateContextProperty

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemTimeAsFileTime
GetComputerNameExW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

eappcfg

EapHostPeerFreeErrorMemory
EapHostPeerFreeMemory
EapHostPeerInvokeConfigUI
EapHostPeerGetMethods

eappprxy

EapHostPeerGetEncryptedPassword
EapHostPeerInitialize

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TtlsExt_EapPeerInvokeConfigUI
TtlsExt_FreeMemoryExt
TtlsExt_GetConfigCacheOnlyCertValidation
TtlsExt_GetConfigForceNotDomainJoined
TtlsExt_GetContextData
TtlsExt_GetUserCredentials
TtlsExt_InvokeNonEapMethodUI
TtlsExt_InvokeServerAuthentication
TtlsExt_ShowHelp

Sections

.text
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57c1521b95148f8b0211686ba13a2c61

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

ntdll

oleaut32

api-ms-win-core-libraryloader-l1-2-0

sspicli

api-ms-win-core-synch-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-l1-1-0

crypt32

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

eappcfg

eappprxy

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 107KB - Virtual size: 106KB

.data Size: 6KB - Virtual size: 6KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 304B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 107KB - Virtual size: 106KB

.data
Size: 6KB - Virtual size: 6KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 304B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB