Dsui[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Dsui.dll
Size

118KB
MD5

aaea89f563187650a673c1e944fcf0f0
SHA1

559fe0b91bb1fbec3974f0a951a50dd3945cf0a9
SHA256

8bae9b93ecd189c3b00540e05016cd23b735f9648b2ce7da153db80c843965f1
SHA512

6fa23d8cfdc6060f31b76fbf6e954479c5e34705711517d58e5eb255859e132d2e3719097186402f7a7b557dfad85d3e194d6629bd8b8e50853f70e71a118bed
SSDEEP

1536:Cza7AVWKiH/SGFH0Yu071MdG2w5AfXg7kg/O8TfZQOFmTGP7y5rbpb2SH+ysrd/M:38YKifSuhMgo4Oq0b2SHD4/h3+r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Dsui.dll

Files

Dsui.dll
.dll regsvr32 windows:6 windows x86 arch:x86

6f7a4d21a9d5264cc80ada29e1670213

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Dsui.pdb

Imports

msvcrt

_vsnwprintf
__CxxFrameHandler3
_except_handler4_common
??1type_info@@UAE@XZ
realloc
_errno
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
memset
??2@YAPAXI@Z
wcscpy_s
wcscat_s
memcpy_s
_purecall
??_V@YAXPAX@Z
malloc
free
??_U@YAPAXI@Z
wcsncpy_s
??3@YAXPAX@Z
__RTDynamicCast

advapi32

RegEnumKeyExW
RegCreateKeyExW
GetTraceEnableFlags
RegQueryInfoKeyW
GetTraceLoggerHandle
RegQueryValueExW
RegSetValueExW
RegisterTraceGuidsW
RegCloseKey
TraceMessage
GetTraceEnableLevel
RegOpenKeyExW
UnregisterTraceGuids
RegDeleteValueW

shell32

ord6
SHGetPropertyStoreForWindow

user32

SetCursor
LoadCursorW
GetWindowLongW
SetWindowLongW
LoadStringW
ShowWindow
GetSystemMetrics
SetTimer
RemovePropW
GetWindowRect
SetActiveWindow
IsIconic
LoadImageW
PostMessageW
KillTimer
GetParent
SetPropW
GetForegroundWindow
FlashWindowEx
MonitorFromWindow
SetWindowPos
GetActiveWindow
SendMessageW
DestroyIcon
GetPropW
GetMonitorInfoW
UnregisterClassA
CharNextW

ole32

StringFromGUID2
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc

oleaut32

SysStringLen
LoadTypeLi
UnRegisterTypeLi
VarUI4FromStr
RegisterTypeLi
SysFreeString
SysAllocString

kernel32

TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
FormatMessageW
InitializeSRWLock
LocalFree
ExpandEnvironmentStringsW
TlsGetValue
TlsSetValue
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
FindResourceExW
TlsFree
TlsAlloc
DeleteCriticalSection
FreeLibrary
LoadResource
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
SizeofResource
LeaveCriticalSection
GetModuleFileNameW
MultiByteToWideChar
RaiseException
lstrcmpiW
DisableThreadLibraryCalls
EnterCriticalSection
GetProcAddress
GetLastError
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
LocalAlloc
GetCurrentProcess

dui70

?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?Release@Value@DirectUI@@QAEXXZ
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?SetID@Element@DirectUI@@QAEJPBG@Z
StrToID
?Click@Button@DirectUI@@SG?AVUID@@XZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z

shlwapi

SHStrDupW
PathParseIconLocationW

cfgmgr32

DevFreeObjectProperties
DevCloseObjectQuery
DevGetObjectProperties
DevCreateObjectQueryFromId

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f7a4d21a9d5264cc80ada29e1670213

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

shell32

user32

ole32

oleaut32

kernel32

dui70

shlwapi

cfgmgr32

Exports

Exports

Sections

.text Size: 51KB - Virtual size: 50KB

.data Size: 3KB - Virtual size: 4KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 53KB - Virtual size: 53KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 51KB - Virtual size: 50KB

.data
Size: 3KB - Virtual size: 4KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 53KB - Virtual size: 53KB

.reloc
Size: 5KB - Virtual size: 4KB