efscore[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

efscore.dll
Size

421KB
MD5

5c22c6741b146727a38ab1ffa41430e3
SHA1

e0109c6a73b4da492a6bfb3ddb5ed0d5dc403dcd
SHA256

65dbda30871acb9e848d7a36b2823c6b1879a28023ac72ef29cf84b72109a006
SHA512

6febb901003b124384ac6a4d70dcb5d772903c363cb02fa484c891688caa31b3566e35b3ba8ef58737cfa6dd27c7492018a19b7cad44f2f57c2e30377aaa1a86
SSDEEP

12288:lck6fP3kXp8wvZYBXyD8FRnFGfYK+lYEyRL68lgiaFZPzhZ/MHL:lcffP3kXvYhMH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efscore.dll

Files

efscore.dll
.dll windows:6 windows x64 arch:x64

3051b59d717682bb6f60bc56be533aac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

efscore.pdb

Imports

msvcrt

_wcsnicmp
strchr
??3@YAXPEAX@Z
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBV0@@Z
memmove
_CxxThrowException
_wcsicmp
_callnewh
??1type_info@@UEAA@XZ
_vsnprintf
_vsnwprintf
__CxxFrameHandler3
memcmp
memcpy
memset
strcmp
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
??0exception@@QEAA@AEBQEBDH@Z
wcscmp

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlConvertSidToUnicodeString
NtQueryInformationToken
RtlInitializeSRWLock
RtlCopySid
RtlDeleteCriticalSection
RtlInitializeResource
RtlInitializeCriticalSection
RtlEqualSid
NtQuerySystemTime
RtlAcquireResourceShared
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtReadFile
NtQueryObject
RtlCompareMemory
RtlReleaseResource
RtlAcquireResourceExclusive
NtClose
NtSetInformationThread
NtOpenThreadToken
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlLengthSid
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeUnicodeString
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtFlushBuffersFile
NtQueryVolumeInformationFile
RtlAllocateHeap
RtlImageNtHeader
EtwEventRegister
EtwEventUnregister
EtwEventEnabled
EtwEventWrite
RtlValidSid
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
WinSqmIsOptedIn
WinSqmAddToStreamEx
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U
NtWriteFile
RtlGetDaclSecurityDescriptor
NtSetInformationFile
RtlNtStatusToDosError
NtFsControlFile
NtQueryInformationFile
RtlFreeHeap
NtCreateFile

authz

AuthziLogAuditEvent
AuthziAllocateAuditParams
AuthziInitializeAuditEventType
AuthziInitializeAuditParams
AuthziInitializeAuditEvent
AuthziFreeAuditParams
AuthziFreeAuditEventType
AuthzFreeAuditEvent

efsutil

EfsUtilReleaseProvider
EfsUtilGetUserKey
EfsUtilSmartcardCredsNeededError
EfsUtilCheckCurrentKeyCapabilities
EfsUtilSetSmartcardPin
EfsUtilReleaseUserKey
EfsUtilGetCertContextFromCertHash
EfsUtilApplyGroupPolicy
EfsUtilIsSmartcardKey
EfsUtilSetCurrentKey
EfsUtilCreateSelfSignedCertificate
EfsUtilGetProvider
EfsUtilIsSmartcardProvider

userenv

CreateEnvironmentBlock
LeaveCriticalPolicySection
EnterCriticalPolicySection
DestroyEnvironmentBlock
RegisterGPNotification
ExpandEnvironmentStringsForUserW
UnloadUserProfile
LoadUserProfileW
UnregisterGPNotification

kernel32

FindNextVolumeW
FindFirstVolumeW
LocalFree
CompareFileTime
SystemTimeToFileTime
GetSystemTime
Sleep
SetFileInformationByHandle
GetSystemTimeAsFileTime
GetCurrentProcess
UnmapViewOfFile
WriteFile
MapViewOfFile
RegDeleteKeyExW
RegEnumKeyExW
FindVolumeClose
GetModuleHandleExW
GetModuleFileNameW
GetComputerNameExW
HeapFree
HeapAlloc
SetThreadStackGuarantee
VirtualProtect
VirtualQuery
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FormatMessageW
FindFirstFileW
FindNextFileW
DelayLoadFailureHook
ResolveDelayLoadedAPI
FindClose
ReadFile
HeapSetInformation
GetProcessHeap
GetSystemInfo
GetComputerNameW
LocalAlloc
VirtualAlloc
CreateEventW
RegisterWaitForSingleObject
UnregisterWait
ResetEvent
UnregisterWaitEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
TerminateProcess
CreateMutexW
GetProcAddress
WaitForSingleObject
CreateFileMappingW
SetFilePointer
GetVolumeInformationW
GetCurrentThread
DeleteFileW
VirtualFree
GetVolumePathNameW
DeviceIoControl
SetFileTime
CreateThread
CloseHandle
SetLastError
GetFileAttributesW
GetLastError
CreateFileW
GetFileTime
ReleaseMutex

Exports

Exports

EfsDllAddUsersToFileSrv
EfsDllAllocateHeap
EfsDllCloseFileRaw
EfsDllConstructEFS
EfsDllDecryptFek
EfsDllDecryptFileSrv
EfsDllDisabled
EfsDllDuplicateEncryptionInfoFileSrv
EfsDllEncryptFileSrv
EfsDllErrorToNtStatus
EfsDllFileKeyInfoSrv
EfsDllFreeHeap
EfsDllFreeUserInfo
EfsDllGetLocalFileName
EfsDllGetLogFile
EfsDllGetUserInfo
EfsDllGetVolumeRoot
EfsDllIsNonEfsSKU
EfsDllLoadUserProfile
EfsDllMarkFileForDelete
EfsDllOnSessionChange
EfsDllOpenFileRaw
EfsDllQueryProtectorsSrv
EfsDllQueryRecoveryAgentsSrv
EfsDllQueryUsersOnFileSrv
EfsDllReadFileRaw
EfsDllRemoveUsersFromFileSrv
EfsDllSetFileEncryptionKeySrv
EfsDllShareDecline
EfsDllSsoFlushUserCache
EfsDllUnloadUserProfile
EfsDllUsePinForEncryptedFilesSrv
EfsDllValidateEfsStream
EfsDllWriteFileRaw
EfsInitialize
EfsUnInitialize
EfsValidateEfsStream

Sections

.text
Size: 383KB - Virtual size: 383KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3051b59d717682bb6f60bc56be533aac

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

authz

efsutil

userenv

kernel32

Exports

Exports

Sections

.text Size: 383KB - Virtual size: 383KB

.data Size: 3KB - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 6KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 1KB - Virtual size: 1KB

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 383KB - Virtual size: 383KB

.data
Size: 3KB - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 6KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 4KB - Virtual size: 3KB