ExSMime[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ExSMime.dll
Size

214KB
MD5

edd0734354424990c7d4e45cefeba51f
SHA1

ab853dd8f5a08bef2066cbf3b0a6c883197fffdb
SHA256

66fd9e05c3763a43ecd5575c05984b65706a979f41644e8fd27863007ca4e11a
SHA512

d926d266f6a4212c98ad35c4166e0fae8c020cc0149a00ccb2a31df7db14e8dfba656a6ae42bffda5b9fdbb0ce4e52edee788db5944673063cf38ae7e0a7badd
SSDEEP

3072:0d8CYoebtJkwFgkC8cZCB7p+rD32zN+GS5I3m5MZj/O4+aSOO3P0Ed8yRG8aneuq:0WSwF/haD3w+qV/dKv/0QNPNu01

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExSMime.dll

Files

ExSMime.dll
.dll regsvr32 windows:10 windows x86 arch:x86

7a1ca0f2d4ddff1a89f1bd5c6323c035

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

exsmime.pdb

Imports

msvcrt

wcsncpy_s
wcscat_s
_snprintf_s
strchr
realloc
_errno
_ultoa_s
_callnewh
_except_handler4_common
_initterm
_unlock
_amsg_exit
__dllonexit
_XcptFilter
_onexit
memcmp
free
strcpy_s
_lock
malloc
wcscpy_s
_purecall
memcpy_s
memchr
memset

oleaut32

VariantChangeType
VariantInit
SysAllocString
VariantCopy
VarCmp
VarUI4FromStr
VariantClear
SysStringLen
SysFreeString

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree

api-ms-win-core-url-l1-1-0

PathIsURLW
UrlIsW
PathCreateFromUrlW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
FindResourceExW
FreeLibrary
LoadResource
SizeofResource
GetProcAddress
LoadLibraryExW
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyExA
RegCreateKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegQueryValueExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-file-l1-1-0

GetFileInformationByHandle
FlushFileBuffers
SetEndOfFile
WriteFile
CreateFileW
FileTimeToLocalFileTime
SetFilePointerEx
GetTempFileNameW
ReadFile

api-ms-win-core-localization-l1-2-0

IsDBCSLeadByteEx

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNA
StrCmpNIA

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a1ca0f2d4ddff1a89f1bd5c6323c035

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 197KB - Virtual size: 197KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 192B

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 197KB - Virtual size: 197KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 192B

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 9KB - Virtual size: 9KB