WSManMigrationPlugin[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

WSManMigrationPlugin.dll
Size

243KB
MD5

c756368733412d7978d5580ad657172f
SHA1

8beb97736627ecaa045dbc7b96c664950c001eda
SHA256

0e970d6cab7b06ed3d31ef20539f15e6e90d7d508dfbd7bd283a749abfac1cdc
SHA512

e5fef2d12be778b5a1ae1304bee34fd9f94a2aa95dd93a29ef011d608667eb120080cc4f0c6532a551cb4cd21740ed2a1cca18dda39180bc4f9cc76fcf6af658
SSDEEP

6144:bkHVfPFljFQgTKiSNWBgoQoy+szF7UbpQouHJfYhpK:bkHVfl1KYBgobYo3hpK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WSManMigrationPlugin.dll

Files

WSManMigrationPlugin.dll
.dll regsvr32 windows:6 windows x86 arch:x86

8021e3c694b14887ebea6e8abd45fad3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

WSManMigrationPlugin.pdb

Imports

msvcrt

memcpy
malloc
free
_wcsicmp
wcsncmp
_wcsnicmp
iswspace
_wtoi64
iswalnum
_itow
wcstoul
wcsstr
??0exception@@QAE@XZ
_wtoi
_scwprintf
memcpy_s
_CxxThrowException
wcscpy_s
wcsncpy_s
wcscat_s
__CxxFrameHandler3
memset
_vsnwprintf
memmove_s
_purecall
_ultow
_onexit
_lock
__dllonexit
_unlock
_errno
realloc
??1type_info@@UAE@XZ
_except_handler4_common
_XcptFilter
_initterm
_amsg_exit
wcschr
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
?terminate@@YAXXZ

ntdll

EtwEventUnregister
EtwEventEnabled
EtwLogTraceEvent
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwEventWrite
EtwEventRegister

kernel32

GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringA
GetSystemDirectoryW
GetVersionExA
GetVersionExW
GetCurrentThread
CloseHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
HeapDestroy
CompareStringW
WideCharToMultiByte
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
SetLastError
FindResourceExW
LockResource
GetThreadLocale
SetThreadLocale
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
GetModuleFileNameW
lstrcmpiW
GetModuleHandleW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
LocalFree
GetComputerNameExW
GetLocaleInfoW
EnumUILanguagesW
FormatMessageW
InitializeCriticalSectionAndSpinCount
CreateFileW
GetFullPathNameW
ExpandEnvironmentStringsW
UnregisterWaitEx
RegisterWaitForSingleObject
CreateEventW
TerminateProcess

ole32

StringFromCLSID
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx

oleaut32

VariantClear
VarCmp
SysFreeString
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysAllocStringByteLen
SysStringByteLen
LoadRegTypeLi
GetErrorInfo
VariantInit

httpapi

HttpSetServiceConfiguration
HttpQueryServiceConfiguration
HttpInitialize
HttpTerminate
HttpDeleteServiceConfiguration

rpcrt4

UuidCreate

user32

CharNextW
UnregisterClassA

advapi32

GetLengthSid
CopySid
FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
SetThreadToken
RevertToSelf
IsWellKnownSid
LogonUserW
CredDeleteW
CredReadW
CredWriteW
CredFree
RegConnectRegistryW
RegCopyTreeW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetTokenInformation
RegQueryValueExW
RegDeleteKeyW
OpenProcessToken
GetSecurityDescriptorDacl
GetAce
MapGenericMask
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenThreadToken
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW

shell32

SHGetFileInfoW

wsmsvc

?Alloc@WSManMemory@@SGPAXIABVCallSite@TestSystem@@W4Mode@3@@Z
?FreeBstr@WSManMemory@@SGXPAGHABVCallSite@TestSystem@@@Z
?AllocBstr@WSManMemory@@SGPAGPBGHABVCallSite@TestSystem@@@Z
?Free@WSManMemory@@SGXPAXABVCallSite@TestSystem@@@Z

crypt32

CryptDecodeObjectEx
CertFindExtension
CertFreeCertificateContext
CertFreeCertificateChain
CertGetEnhancedKeyUsage
CryptBinaryToStringW
CryptStringToBinaryW
CertGetNameStringW
CertOpenStore
CertFindCertificateInStore
CertGetCertificateContextProperty
CertCloseStore
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptAcquireCertificatePrivateKey

netutils

NetApiBufferFree

wkscli

NetGetJoinInformation

ws2_32

getaddrinfo
WSACleanup
WSAStartup
getnameinfo
freeaddrinfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 213KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8021e3c694b14887ebea6e8abd45fad3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

ole32

oleaut32

httpapi

rpcrt4

user32

advapi32

shell32

wsmsvc

crypt32

netutils

wkscli

ws2_32

Exports

Exports

Sections

.text Size: 213KB - Virtual size: 212KB

.data Size: 6KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 21KB - Virtual size: 20KB

.text
Size: 213KB - Virtual size: 212KB

.data
Size: 6KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 21KB - Virtual size: 20KB