api-ms-win-core-xstate-l1-1-0[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

api-ms-win-core-xstate-l1-1-0.dll
Size

3KB
MD5

359199a62cb2d835ba5d36a70218ccd5
SHA1

361d69500142eaa2c39d3d69a01b86979e026c12
SHA256

774fe9851c13d17e3b850d37b415c46894e8673db714fcbfc2e6f71f5a77c964
SHA512

e0df062dbff9672cb5f81f06031df748d55e3619e7672e7d987b18152aa202ea2eba4d6fe9c159501f01d7cc391b5ccb5de204e50b163391f1cbc688ffa59b4a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
api-ms-win-core-xstate-l1-1-0.dll

Files

api-ms-win-core-xstate-l1-1-0.dll
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

API-MS-Win-Core-Xstate-L1-1-0.pdb

Exports

Exports

RtlCopyExtendedContext
RtlGetEnabledExtendedFeatures
RtlGetExtendedContextLength
RtlGetExtendedFeaturesMask
RtlInitializeExtendedContext
RtlLocateExtendedFeature
RtlLocateLegacyContext
RtlSetExtendedFeaturesMask

Sections

.text
Size: 1024B - Virtual size: 542B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 26B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ