TlsBrand[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

TlsBrand.dll
Size

122KB
MD5

0c223da2e9ec18d3390c46cb115836e9
SHA1

5a280b028bd691a9e694a24365f539608f380d2c
SHA256

07647b9d0dc490668561e84559861c81f943e27ffd2e2b038b0c927da157617b
SHA512

374a8cef1611f74773a95f7fc1c51c4d494c99054ac45c086fd867fbd8ffc2aa778e2ee95bf4b773dee3c5a6e173468be4baeaab67d4becb56ed1c2766c2a1c6
SSDEEP

3072:2+nDCKZw9VhToel7yGT5M2csQSGixSnPC7WAEfdlvKa:2eDCKZw9VhTom7yGlQSGicgEfdRK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TlsBrand.dll

Files

TlsBrand.dll
.dll windows:10 windows x86 arch:x86

7b1017edbaf45a008a7d327f4122ede3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

TlsBrand.pdb

Imports

msvcrt

swscanf_s
_wcsicmp
__CxxFrameHandler3
_purecall
wcstol
malloc
_callnewh
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
memmove_s
wcsstr
memcpy_s
memcpy
??3@YAXPAX@Z
memmove
_XcptFilter
_amsg_exit
free
_initterm
?terminate@@YAXXZ
_lock
??_V@YAXPAX@Z
_unlock
__dllonexit
_vsnwprintf
_onexit
??1type_info@@UAE@XZ
_except_handler4_common
memset

winbrand

BrandingFormatString

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
RegisterTraceGuidsW
GetTraceLoggerHandle
UnregisterTraceGuids

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
FreeLibrary
GetModuleHandleExA
GetProcAddress

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalFree
LocalFree

oleaut32

SysAllocString
VariantClear
SysFreeString
VariantInit

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoUninitialize
CoInitializeEx

api-ms-win-core-file-l1-1-0

DeleteFileW
GetTempFileNameW
CreateFileW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-file-l1-2-4

GetTempPath2W

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

user32

GetSystemMetrics
UnregisterClassA

kernel32

LoadResource
FindResourceExW
LockResource
WriteFile
SizeofResource

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpConnect
WinHttpSetTimeouts
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryOption

api-ms-win-core-heap-l1-1-0

HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
HeapDestroy

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection

Exports

Exports

??0ICALDetails@@QAE@ABV0@@Z
??0ICALDetails@@QAE@XZ
??0ICALStringDetails@@QAE@ABV0@@Z
??0ICALStringDetails@@QAE@XZ
??0IRDSProductDetails@@QAE@ABV0@@Z
??0IRDSProductDetails@@QAE@XZ
??0IW2K3ADPUCALDetails@@QAE@ABV0@@Z
??0IW2K3ADPUCALDetails@@QAE@XZ
??0IWMICALDetails@@QAE@ABV0@@Z
??0IWMICALDetails@@QAE@XZ
??1ICALDetails@@UAE@XZ
??1ICALStringDetails@@UAE@XZ
??1IRDSProductDetails@@UAE@XZ
??1IW2K3ADPUCALDetails@@UAE@XZ
??1IWMICALDetails@@UAE@XZ
??4ICALDetails@@QAEAAV0@ABV0@@Z
??4ICALStringDetails@@QAEAAV0@ABV0@@Z
??4IRDSProductDetails@@QAEAAV0@ABV0@@Z
??4IW2K3ADPUCALDetails@@QAEAAV0@ABV0@@Z
??4IWMICALDetails@@QAEAAV0@ABV0@@Z
??_7ICALDetails@@6B@
??_7ICALStringDetails@@6B@
??_7IRDSProductDetails@@6B@
??_7IW2K3ADPUCALDetails@@6B@
??_7IWMICALDetails@@6B@
?GetAccessRights@IRDSProductDetails@@UAEJPAGPAK1@Z
?GetProductFromAccessRights@IRDSProductDetails@@UAEJKKPAPAG@Z
?IsTestHookValid@IRDSProductDetails@@UAEHPAK@Z
CALDetailsCreator
CALStringDetailsCreator
CRetailCALCreator
CWMICALDetailsCreator
CleanupRDLSConfig
GetRdlsSupportedFeatureMask
LicBrandFormatString
LoadRDLSConfig
RDSProductDetailsCreator
UpdateRDLSConfig
W2K3ADPUCALDetailsCreator
_GetCALVersion@4
_GetCALVersionStrings@8
_GetConversionVersionStrings@12
_RDSGetCALVersionString@12
_RDSGetCurrentVersion@0
_RDSGetOSVersionString@12
_RDSGetProductAccessRights@12

Sections

.text
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b1017edbaf45a008a7d327f4122ede3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

winbrand

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l2-1-0

oleaut32

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-2-4

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

user32

kernel32

winhttp

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

Exports

Exports

Sections

.text Size: 105KB - Virtual size: 105KB

.data Size: 1KB - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 105KB - Virtual size: 105KB

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 7KB - Virtual size: 7KB