UXInit[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

UXInit.dll
Size

81KB
MD5

bf58acd759bd112c495de83e0ae3878c
SHA1

5488ed6de3ba372f2d9be0fcfe2569287dfae13c
SHA256

eaf78e7d93818f8b3bf6712c15b88443761014b73d97a9d931366daab92f2f3c
SHA512

523dc46342eeb22a060c36e656c888a44f5f30c3a2d0753421d596b8e518b570f607402d5df277c0a1978ed2a9d35ba63a043b635a19149ba6c359c0fb4f99ee
SSDEEP

1536:3mGzyk9mXZVlgTF+9rp0rYZ9EQdJOzcyAViA5jOXMQJmuNjLiA:aAmXHlgTF+9rpTZGQnavAYUFQJmmLz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UXInit.dll

Files

UXInit.dll
.dll windows:10 windows x86 arch:x86

7855b1a6ccea9f36a07635c399c17d28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

UXInit.pdb

Imports

msvcrt

wcsrchr
_vsnwprintf
wcschr
memmove_s
_wcsicmp
_purecall
memcmp
memcpy
memmove
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
memcpy_s
rand_s
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
LoadLibraryExW
LockResource
LoadResource
GetProcAddress
SizeofResource
GetModuleHandleW
FindResourceExW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSection
CreateEventW
InitializeCriticalSectionEx
ResetEvent
ReleaseMutex
ReleaseSemaphore
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
WaitForSingleObject
EnterCriticalSection
CreateSemaphoreExW
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockShared
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentThread
SetThreadToken
OpenThreadToken
ExitThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait
RegisterWaitForSingleObject

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

ntdll

RtlGetCompressionWorkSpaceSize
RtlUnhandledExceptionFilter
NtCreateSection
NtOpenSection
RtlCompressBuffer
NtConnectPort
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtClose
NtSetInformationThread
NtDuplicateToken
RtlImageNtHeader
NtQuerySystemInformation
RtlNtStatusToDosError
NtCreateEvent
RtlInitUnicodeString
NtAlpcSendWaitReceivePort
EtwEventRegister
EtwEventUnregister
RtlDecompressBufferEx

user32

EnumDisplayMonitors
ord2711
RegisterDManipHook
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetThreadDesktop
IsProcessDPIAware
GetDC
ReleaseDC
EnumDisplayDevicesW
EnumDisplaySettingsW
DisplayConfigGetDeviceInfo
SystemParametersInfoW
GetSystemMetrics
GetDpiForMonitorInternal
GetWindowDC

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-file-l1-1-0

WriteFile
GetFileSize
ReadFile
CreateFileW
SetFilePointer

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegEnumValueW
RegOpenCurrentUser
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CloseThreadpoolWait
SetThreadpoolWait
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrlenW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-shcore-scaling-l1-1-1

UnregisterScaleChangeEvent
RegisterScaleChangeEvent

dwmapi

ord168

gdi32

SetBitmapAttributes
CreateDIBSection
CreateSessionMappedDIBSection
DeleteObject
ClearBitmapAttributes
GetDeviceCaps

Exports

Exports

ThemeUserLogoff
ThemeUserLogon
ThemeUserStartShell
ThemeUserTSReconnect
ThemeWatchForStart
ThemesOnCreateSession
ThemesOnDisconnect
ThemesOnEarlyCreateSession
ThemesOnLogoff
ThemesOnLogon
ThemesOnReconnect
ThemesOnTerminateSession

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7855b1a6ccea9f36a07635c399c17d28

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

ntdll

user32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-shcore-scaling-l1-1-1

dwmapi

gdi32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 67KB

.data Size: 512B - Virtual size: 3KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 176B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 68KB - Virtual size: 67KB

.data
Size: 512B - Virtual size: 3KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 176B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB