AudioEng[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AudioEng.dll
Size

414KB
MD5

7b2643ae85322ea168b0e760b73258ff
SHA1

ebbc831d5e635ba78dc0e96468219addf94035ed
SHA256

a399626684aacd5384b6cd34418c2fee7628a5952d341139eb5f95dffe5f0f62
SHA512

5f0c8fe80db2a1e019785211a8ef97edf0013b7c55d610ba2ed2a6670c61896bc8da9f0784321693979abefc1d217434c6e8ed20e0553f0e0b90ab92d0a16636
SSDEEP

6144:etaeoqU9mZoAuMeW8mEXFLLhKJvJ1xBFa3D2Au7qbUxkU8d5SfOl9DvPxzi7o7Ld:eta3qU9AuM5H/azNQO15syXk7SfmS

Score

1^/10

Malware Config

Signatures

Files

AudioEng.dll
.dll regsvr32 windows:6 windows x86 arch:x86

e4ae3deeb56954c5c58bb1b26a5e6bc6

Code Sign

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/07/2014, 20:32

Not After

01/10/2015, 20:32

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:ed:24:57:80:de:1c:4c:9c:45:a7:cc:14:ab:5d:cd:ea:21:68:2b:fe:98:11:d9:07:04:62:fb:8b:f8:2c:7a
Signer

Actual PE Digest

cd:ed:24:57:80:de:1c:4c:9c:45:a7:cc:14:ab:5d:cd:ea:21:68:2b:fe:98:11:d9:07:04:62:fb:8b:f8:2c:7a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AUDIOENG.pdb

Imports

msvcrt

_CIpow
_ftol2
_ftol2_sse
_CIexp
memcmp
_except_handler4_common
_onexit
_CIcos
__dllonexit
_CIsin
_lock
realloc
_errno
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
_unlock
memset
_resetstkoflw
calloc
memmove_s
ceil
_finite
_CIsqrt
_isnan
_vsnwprintf
_purecall
wcscat_s
??_V@YAXPAX@Z
wcscpy_s
??_U@YAPAXI@Z
memcpy_s
free
malloc
wcsncpy_s
floor
memcpy

ntdll

EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
RtlUnlockMemoryBlockLookaside
RtlDestroyMemoryBlockLookaside
RtlAllocateMemoryBlockLookaside
RtlLockMemoryBlockLookaside
RtlNtStatusToDosError
RtlCreateMemoryBlockLookaside
RtlFreeMemoryBlockLookaside
RtlUnlockCurrentThread
NtQueryInformationProcess
RtlLockModuleSection
RtlLockCurrentThread
RtlUnlockModuleSection
RtlExtendMemoryBlockLookaside
EtwLogTraceEvent
NtSetTimerResolution

oleaut32

VarUI4FromStr

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventRegister

api-ms-win-core-synch-l1-2-0

InitOnceInitialize
InitOnceExecuteOnce
WaitForMultipleObjectsEx
InitializeCriticalSection
ResetEvent
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
CreateWaitableTimerExW
SetEvent
EnterCriticalSection
InitOnceBeginInitialize
WaitForSingleObject
CancelWaitableTimer
SetWaitableTimer
Sleep
CreateEventW

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadResource
GetModuleFileNameW
FindResourceExW
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleW
SizeofResource

api-ms-win-core-com-l1-1-1

CoTaskMemFree
CoCreateInstance
CoDisconnectObject
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegDeleteKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegGetValueW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
TraceEvent
UnregisterTraceGuids

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-localization-l1-2-1

GetThreadLocale
SetThreadLocale

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
SetThreadPriority
CreateThread
GetCurrentProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThread
TerminateProcess

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-memory-l1-1-2

GetProcessWorkingSetSizeEx
SetProcessWorkingSetSizeEx

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

avrt

AvSetMmThreadCharacteristicsA
AvQuerySystemResponsiveness
AvRevertMmThreadCharacteristics
AvSetMmThreadPriority

Exports

Exports

AERT_Allocate
AERT_Free
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 357KB - Virtual size: 357KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 512B - Virtual size: 333B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

RT_DATA
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_CONST
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4ae3deeb56954c5c58bb1b26a5e6bc6

Code Sign

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4eCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

cd:ed:24:57:80:de:1c:4c:9c:45:a7:cc:14:ab:5d:cd:ea:21:68:2b:fe:98:11:d9:07:04:62:fb:8b:f8:2c:7aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-debug-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

avrt

Exports

Exports

Sections

.text Size: 357KB - Virtual size: 357KB

RT_CODE Size: 512B - Virtual size: 333B

RT_BSS Size: - Virtual size: 40B

.data Size: 13KB - Virtual size: 13KB

.idata Size: 5KB - Virtual size: 5KB

RT_DATA Size: 3KB - Virtual size: 3KB

RT_CONST Size: 2KB - Virtual size: 2KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 11KB - Virtual size: 11KB

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

cd:ed:24:57:80:de:1c:4c:9c:45:a7:cc:14:ab:5d:cd:ea:21:68:2b:fe:98:11:d9:07:04:62:fb:8b:f8:2c:7a
Signer

.text
Size: 357KB - Virtual size: 357KB

RT_CODE
Size: 512B - Virtual size: 333B

RT_BSS
Size: - Virtual size: 40B

.data
Size: 13KB - Virtual size: 13KB

.idata
Size: 5KB - Virtual size: 5KB

RT_DATA
Size: 3KB - Virtual size: 3KB

RT_CONST
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 11KB - Virtual size: 11KB