WsmAgent[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

WsmAgent.dll
Size

25KB
MD5

387ae1c533753700d933dfca3e08a206
SHA1

a2fa9a55b5bb92ccb96e33aad0b69b72d9935640
SHA256

933a61652fe36545d7156333d167cf86af5c7679a106ee65d7c68f191bebb1bf
SHA512

c0cb40c2728a81a04bdd935f8659ec0119569d61bde99adc1acc587f758e4c7cf048db04fc74ededecf586c3d9fbef824c5ba873667552c0bd57436d3b8625a5
SSDEEP

384:LSh7SrcIvtLuEz8RM1GoSJRnr5rFtyWLWWyThXJbFh+8sICJzcjmG1fHqgfTKyoh:LSMTGoShrfy7TjBRH/UPKLFv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WsmAgent.dll

Files

WsmAgent.dll
.dll regsvr32 windows:6 windows x86 arch:x86

103d5e3e92a70e6b6373c367841e9f68

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

wsmagent.pdb

Imports

msvcrt

_except_handler4_common
swprintf_s
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_purecall
malloc
free
_onexit
__CxxFrameHandler3
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadLibraryExW
FreeLibrary
GetProcAddress

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids
GetTraceEnableLevel

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
OpenThreadToken
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread

api-ms-win-security-base-l1-2-0

CheckTokenMembership

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

wsmsvc

?Alloc@WSManMemory@@SGPAXIHW4_NitsFaultMode@@@Z
??1CWSManCriticalSection@@QAE@XZ
?GetSid@CSecurity@@SGPAXXZ
??1?$AutoDelete@U_SID@@@@QAE@XZ
??1AutoImpersonateUser@@QAE@XZ
??0?$AutoDelete@U_SID@@@@QAE@PAU_SID@@@Z
?Free@WSManMemory@@SGXPAXH@Z
?BeginRevertToSelf@CSecurity@@SGHPAPAXK@Z
??0AutoImpersonateUser@@QAE@XZ
?StringIsBlank@@YGHPBG@Z
?IsLocalSystemSid@CSecurity@@SGHPAX@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

??1CWSManCriticalSectionWithConditionVar@@QAE@XZ
?GetInitError@CWSManCriticalSection@@QBEKXZ
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

103d5e3e92a70e6b6373c367841e9f68

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

wsmsvc

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 17KB - Virtual size: 17KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 44B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 17KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 44B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB