TSpkg[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

TSpkg.dll
Size

120KB
MD5

3a27e67a2134b12f940488d32a734cc2
SHA1

fcef483ac2b54d5f69d031fa3009982d30af1722
SHA256

589c9ef80c45fd0e15559030588cfb431ecdf22c539cef3387741fbd11bb3af8
SHA512

0facc8408f01dc431555d3744e579829ab8a7893774d90a4da02cc43dd7f06841ef747a317dad276474c9362e62f709e2d298cb4592a0b4ce5a8205d5a215aed
SSDEEP

3072:u19pJPXxykceK0ELHS4jLv5NRNZXJyL2JlDH/+zEx:GbPxpFOy4/BNRboiI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TSpkg.dll

Files

TSpkg.dll
.dll windows:10 windows x86 arch:x86

a87b703af52ffb0bf97cdfad2fb3d78e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

TSpkg.pdb

Imports

msvcrt

malloc
_lock
_amsg_exit
_XcptFilter
_unlock
free
_snwprintf_s
__dllonexit
_wcsicmp
_initterm
wcschr
wcsncat_s
_wcsnicmp
wcsncpy_s
wcscat_s
wcscpy_s
_callnewh
memmove_s
_except_handler4_common
__CxxFrameHandler3
memcpy
_purecall
memcpy_s
memcmp
_onexit
_vsnwprintf
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
FreeLibrary

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
CreateSemaphoreExW
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateEventW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
SetThreadStackGuarantee
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

sspicli

CompleteAuthToken
GetUserNameExW
ImpersonateSecurityContext
SspiEncodeAuthIdentityAsStrings
SspiDecryptAuthIdentityEx
SspiValidateAuthIdentity
DeleteSecurityContext
DecryptMessage
EncryptMessage
SspiLocalFree
SspiPrepareForCredRead
AcceptSecurityContext
InitializeSecurityContextW
SspiEncryptAuthIdentityEx
SspiCopyAuthIdentity
FreeContextBuffer
QueryContextAttributesW
SspiFreeAuthIdentity
SspiIsAuthIdentityEncrypted
SspiUnmarshalAuthIdentity
SetCredentialsAttributesW
AcquireCredentialsHandleW
FreeCredentialsHandle

api-ms-win-security-base-l1-1-0

FreeSid
DuplicateToken
RevertToSelf
CopySid
AllocateAndInitializeSid
CheckTokenMembership
GetLengthSid

api-ms-win-security-base-l1-2-0

CheckTokenMembershipEx

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegNotifyChangeKeyValue
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
SetCurrentDirectoryW
ExpandEnvironmentStringsW

bcrypt

BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptGetProperty
BCryptOpenAlgorithmProvider

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetComputerNameExW
GetSystemInfo
GetWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime

msasn1

ASN1BERDecEndOfContents
ASN1BEREncS32
ASN1BERDecSkip
ASN1BEREncExplicitTag
ASN1BERDecNotEndOfContents
ASN1BERDecOctetString
ASN1BEREncU32
ASN1BERDecPeekTag
ASN1BERDecExplicitTag
ASN1octetstring_free
ASN1BERDecOpenType2
ASN1Free
ASN1DecAlloc
ASN1BEREncOpenType
ASN1BERDecS32Val
ASN1DEREncOctetString
ASN1BERDecOctetString2
ASN1BERDecU32Val
ASN1_CreateModule
ASN1_CreateEncoder
ASN1_CreateDecoder
ASN1_CloseEncoder
ASN1_CloseDecoder
ASN1_Decode
ASN1_FreeDecoded
ASN1_Encode
ASN1_FreeEncoded
ASN1BEREncEndOfContents

ntdll

RtlNtStatusToDosError
RtlFreeHeap
NtSetEvent
NtCreateEvent
NtClose
NtOpenEvent
NtQuerySystemInformation
RtlAllocateHeap
NtQuerySystemTime
RtlAvlRemoveNode
RtlAvlInsertNodeEx
RtlDuplicateUnicodeString
RtlCompareUnicodeString
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlEqualUnicodeString
RtlAllocateAndInitializeSid
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlDeleteCriticalSection
NtWaitForSingleObject
RtlInitUnicodeStringEx
NtQueryInformationToken
RtlMapSecurityErrorToNtStatus
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
RtlGetLastNtStatus
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
RtlDeleteResource
RtlInitializeGenericTableAvl
RtlInitializeResource
RtlEnumerateGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlDeleteElementGenericTableAvl
RtlAcquireResourceExclusive
RtlInsertElementGenericTableAvl
RtlConvertSharedToExclusive
RtlReleaseResource
RtlLookupElementGenericTableAvl
RtlAcquireResourceShared
RtlImageNtHeader
EtwTraceMessage
RtlInitializeCriticalSection

api-ms-win-core-file-l1-1-0

CreateDirectoryW

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
ControlTraceW
StartTraceW

api-ms-win-core-memory-l1-1-0

VirtualQuery
MapViewOfFileEx
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
VirtualAlloc
VirtualProtect

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer
ChangeTimerQueueTimer
UnregisterWaitEx

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
ReportEventW
RegisterEventSourceW

Exports

Exports

SpLsaModeInitialize
SpUserModeInitialize

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a87b703af52ffb0bf97cdfad2fb3d78e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

sspicli

api-ms-win-security-base-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

bcrypt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

msasn1

ntdll

api-ms-win-core-file-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

Exports

Exports

Sections

.text Size: 101KB - Virtual size: 101KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 9KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 172B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 101KB - Virtual size: 101KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 9KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 172B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 4KB