TSpkg[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

TSpkg.dll
Size

83KB
MD5

223d8008d4fa0f136540fabacadf2187
SHA1

367dc47b32fafc28eba4540aafe8dc1af7597781
SHA256

bc96526b0aeef12dcd614230ca8dc7b9f39c429e8da487def37efcd1cda8972e
SHA512

c44a88720ea6eebf05a8cb6ca6fa349c461b574ed624335deff86d8c33f0b44b746ae688d5bcb50326cd57d6dd279796d9271b107eb725ba617aecb3098a3c71
SSDEEP

1536:64JSQ/ofAzS0jC2/BHQVyzRXRmI0X/E3CIqQ9xEvM3OsS1XTKVxJ/4nbE1r:6+SQ/ofAzS0jC2/BHQVyzRXRFs/E3C7M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TSpkg.dll

Files

TSpkg.dll
.dll windows:6 windows x86 arch:x86

7c185fe7531a6a57ead0a0d90ba48a99

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

TSpkg.pdb

Imports

msvcrt

wcscat_s
wcsncat_s
_wcsicmp
_wcsnicmp
_except_handler4_common
memcpy
_initterm
malloc
free
_amsg_exit
_XcptFilter
_snwprintf_s
wcsncpy_s
memcmp
_ultow
wcscpy_s
??2@YAPAXI@Z
??3@YAXPAX@Z
wcschr
memset

ntdll

RtlDuplicateUnicodeString
NtCreateEvent
RtlAllocateHeap
NtOpenEvent
NtClose
NtWaitForSingleObject
RtlFreeHeap
NtQuerySystemInformation
NtQuerySystemTime
NtSetEvent
RtlNtStatusToDosError
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlEqualUnicodeString
RtlAllocateAndInitializeSid
RtlInitUnicodeStringEx
NtQueryInformationToken
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
RtlGetLastNtStatus
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlDeleteResource
RtlInitializeGenericTableAvl
RtlInitializeResource
RtlEnumerateGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlDeleteElementGenericTableAvl
RtlAcquireResourceExclusive
RtlInsertElementGenericTableAvl
RtlConvertSharedToExclusive
RtlReleaseResource
RtlLookupElementGenericTableAvl
RtlAcquireResourceShared
EtwTraceMessage

api-ms-win-core-processenvironment-l1-2-0

GetCurrentDirectoryW
ExpandEnvironmentStringsW
SetCurrentDirectoryW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegNotifyChangeKeyValue

sspicli

QueryContextAttributesW
SspiCopyAuthIdentity
SspiEncryptAuthIdentityEx
FreeContextBuffer
InitializeSecurityContextW
CompleteAuthToken
ImpersonateSecurityContext
SspiFreeAuthIdentity
SspiIsAuthIdentityEncrypted
GetUserNameExW
SspiDecryptAuthIdentityEx
SspiUnmarshalAuthIdentity
AcceptSecurityContext
SspiPrepareForCredRead
SspiLocalFree
SetCredentialsAttributesW
EncryptMessage
DecryptMessage
SspiValidateAuthIdentity
DeleteSecurityContext
FreeCredentialsHandle
SspiEncodeAuthIdentityAsStrings
AcquireCredentialsHandleW

api-ms-win-security-base-l1-2-0

GetLengthSid
EqualSid
DuplicateToken
CheckTokenMembershipEx
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RevertToSelf

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

bcrypt

BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptFinishHash

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
FreeLibrary

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
CreateEventW
EnterCriticalSection
Sleep
InitializeCriticalSection
DeleteCriticalSection

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemInfo
GetComputerNameExW
GetWindowsDirectoryW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetVersionExW
GetTickCount

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

msasn1

ASN1BERDecPeekTag
ASN1BERDecNotEndOfContents
ASN1BERDecSkip
ASN1octetstring_free
ASN1BERDecS32Val
ASN1BERDecOctetString
ASN1DecAlloc
ASN1BEREncExplicitTag
ASN1BEREncS32
ASN1BEREncEndOfContents
ASN1BERDecEndOfContents
ASN1DEREncOctetString
ASN1_CreateModule
ASN1Free
ASN1_CreateEncoder
ASN1_CreateDecoder
ASN1_CloseEncoder
ASN1_FreeEncoded
ASN1_CloseDecoder
ASN1_Encode
ASN1_FreeDecoded
ASN1_Decode
ASN1BERDecExplicitTag

api-ms-win-eventing-controller-l1-1-0

StartTraceW
ControlTraceW
EnableTraceEx2

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
MapViewOfFileEx
OpenFileMappingW
VirtualAlloc
UnmapViewOfFile

api-ms-win-core-file-l2-1-1

MoveFileExW

api-ms-win-core-file-l1-2-1

CreateDirectoryW

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
ChangeTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-eventlog-legacy-l1-1-0

ReportEventW
RegisterEventSourceW
DeregisterEventSource

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

SpLsaModeInitialize
SpUserModeInitialize

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c185fe7531a6a57ead0a0d90ba48a99

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-registry-l1-1-0

sspicli

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

bcrypt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

msasn1

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-file-l2-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 66KB - Virtual size: 66KB

.data Size: 2KB - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 160B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 66KB - Virtual size: 66KB

.data
Size: 2KB - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 160B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 3KB - Virtual size: 3KB