AudioEng[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

AudioEng.dll
Size

471KB
MD5

6f237ee5dda34eaf3d9c79d4a283e250
SHA1

0650fbb6e3e81b9ba1f43d012bd53d264950e5b9
SHA256

ada6083fa042f786fb15e21a669354df41c26a1fd7bd36a144f6541c00393e3f
SHA512

7423a504fb5fdffaaac754ccce7659867611d017bb8cefec455e1a5789d6eef0c4d3ec9509859e7d5e033d3269518f741966b4cef646306e02c7f190a6c9780b
SSDEEP

6144:pP/H5zxquMeW8m186CjJ1xBFa3D2Au7qbUxkU8d5SfuluSwPpyRyZ+BO8uRXgrpJ:dLquM54l/azNQO15s1PUCRI

Score

1^/10

Malware Config

Signatures

Files

AudioEng.dll
.dll regsvr32 windows:6 windows x64 arch:x64

b19b16a11c3f88c75caf745fc02d06b4

Code Sign

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01-07-2014 20:32

Not After

01-10-2015 20:32

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f8:d2:d8:d5:35:b7:0b:61:66:39:4e:76:d2:1d:23:de:a1:47:00:c4:de:30:3a:20:d6:34:d2:ae:f3:91:b0:50
Signer

Actual PE Digest

f8:d2:d8:d5:35:b7:0b:61:66:39:4e:76:d2:1d:23:de:a1:47:00:c4:de:30:3a:20:d6:34:d2:ae:f3:91:b0:50

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

AUDIOENG.pdb

Imports

msvcrt

_initterm
_vsnwprintf
?terminate@@YAXXZ
_purecall
_XcptFilter
wcscat_s
_CxxThrowException
__CxxFrameHandler3
memcpy_s
_amsg_exit
cos
exp
wcscpy_s
_finite
_isnan
memmove_s
floor
floorf
logf
memcmp
memcpy
ceilf
free
malloc
??_V@YAXPEAX@Z
__C_specific_handler
powf
wcsncpy_s
calloc
sin
_resetstkoflw
memset
ceil
_onexit
__dllonexit
_unlock
_lock
??_U@YAPEAX_K@Z
realloc
_errno
??1type_info@@UEAA@XZ
sqrt

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
RtlUnlockMemoryBlockLookaside
RtlDestroyMemoryBlockLookaside
RtlAllocateMemoryBlockLookaside
RtlLockMemoryBlockLookaside
RtlNtStatusToDosError
RtlCreateMemoryBlockLookaside
RtlFreeMemoryBlockLookaside
RtlUnlockCurrentThread
NtQueryInformationProcess
RtlLockModuleSection
RtlLockCurrentThread
RtlUnlockModuleSection
RtlExtendMemoryBlockLookaside
EtwLogTraceEvent
NtSetTimerResolution

oleaut32

VarUI4FromStr

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite

api-ms-win-core-synch-l1-2-0

CreateEventW
CreateWaitableTimerExW
InitOnceBeginInitialize
WaitForSingleObject
InitOnceInitialize
ResetEvent
InitializeCriticalSection
WaitForMultipleObjectsEx
WaitForSingleObjectEx
CancelWaitableTimer
SetWaitableTimer
DeleteCriticalSection
Sleep
EnterCriticalSection
SetEvent
LeaveCriticalSection
InitOnceExecuteOnce

api-ms-win-core-libraryloader-l1-2-0

SizeofResource
DisableThreadLibraryCalls
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryExW
LoadResource
FindResourceExW
GetModuleHandleW

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoDisconnectObject
StringFromGUID2

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-1

RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
TraceEvent
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-localization-l1-2-1

GetThreadLocale
SetThreadLocale

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
GetCurrentThread
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
SetThreadPriority
CreateThread

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-memory-l1-1-2

GetProcessWorkingSetSizeEx
SetProcessWorkingSetSizeEx

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

avrt

AvSetMmThreadPriority
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsA
AvQuerySystemResponsiveness

Exports

Exports

AERT_Allocate
AERT_Free
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 401KB - Virtual size: 401KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 1024B - Virtual size: 906B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 48B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

RT_DATA
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_CONST
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b19b16a11c3f88c75caf745fc02d06b4

Code Sign

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4eCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

f8:d2:d8:d5:35:b7:0b:61:66:39:4e:76:d2:1d:23:de:a1:47:00:c4:de:30:3a:20:d6:34:d2:ae:f3:91:b0:50Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-debug-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

avrt

Exports

Exports

Sections

.text Size: 401KB - Virtual size: 401KB

RT_CODE Size: 1024B - Virtual size: 906B

RT_BSS Size: - Virtual size: 48B

.data Size: 15KB - Virtual size: 15KB

.pdata Size: 16KB - Virtual size: 15KB

.idata Size: 7KB - Virtual size: 6KB

RT_DATA Size: 3KB - Virtual size: 3KB

RT_CONST Size: 4KB - Virtual size: 3KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 3KB - Virtual size: 2KB

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

f8:d2:d8:d5:35:b7:0b:61:66:39:4e:76:d2:1d:23:de:a1:47:00:c4:de:30:3a:20:d6:34:d2:ae:f3:91:b0:50
Signer

.text
Size: 401KB - Virtual size: 401KB

RT_CODE
Size: 1024B - Virtual size: 906B

RT_BSS
Size: - Virtual size: 48B

.data
Size: 15KB - Virtual size: 15KB

.pdata
Size: 16KB - Virtual size: 15KB

.idata
Size: 7KB - Virtual size: 6KB

RT_DATA
Size: 3KB - Virtual size: 3KB

RT_CONST
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 3KB - Virtual size: 2KB