TSpkg[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

TSpkg.dll
Size

64KB
MD5

4fab9495ac00d8a12e9eb14de518188b
SHA1

07b8fc1122c4be7942cec3c314e382fe8e9f7500
SHA256

ada45b57f871676c00c6b096c5fce34035a1deed230662fb5dd7f2044c656484
SHA512

479fa4cfbe3b8f5261a98b4b40f0d3f842e05d57be7be0a2203abaedaf835070309d3962ce62481a23ed387dcf9d3baaa1106f32dbfeb6346b4d42732af9a7c5
SSDEEP

1536:T9r0Zi3+VQber+jmKv213oMckNG/3udaq1PcDSC:T9r7++Sr+iKS30kNG/3uPPc+C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TSpkg.dll

Files

TSpkg.dll
.dll windows:6 windows x86 arch:x86

1caade39892300c23d62eabff2c1755d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

TSpkg.pdb

Imports

msvcrt

_snwprintf_s
wcsncat_s
wcsncpy_s
wcscat_s
_wcsnicmp
??3@YAXPAX@Z
??2@YAPAXI@Z
_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
_wcsicmp
wcschr
memset
memcpy

ntdll

EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
RtlAllocateAndInitializeSid
NtQueryInformationToken
RtlInitUnicodeString
RtlGetLastNtStatus
RtlInitializeGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlEnumerateGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlConvertSharedToExclusive
RtlInsertElementGenericTableAvl
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlDeleteResource
RtlAcquireResourceShared
RtlLookupElementGenericTableAvl
RtlAcquireResourceExclusive
RtlReleaseResource
RtlInitializeResource
RtlRegisterWait
RtlDeregisterWait
EtwTraceMessage
NtWaitForSingleObject
NtOpenEvent
NtCreateEvent
NtClose
NtSetEvent
NtQuerySystemInformation
RtlFreeHeap
RtlAllocateHeap
NtQuerySystemTime
RtlNtStatusToDosError
RtlDuplicateUnicodeString

sspicli

DeleteSecurityContext
ImpersonateSecurityContext
GetUserNameExW
AcceptSecurityContext
InitializeSecurityContextW
CompleteAuthToken
EncryptMessage
QueryContextAttributesW
FreeContextBuffer
DecryptMessage
AcquireCredentialsHandleW
FreeCredentialsHandle

msasn1

ASN1_CreateModule
ASN1BEREncEndOfContents
ASN1DEREncOctetString
ASN1BEREncExplicitTag
ASN1BERDecEndOfContents
ASN1BERDecOctetString
ASN1BERDecExplicitTag
ASN1octetstring_free
ASN1DecAlloc
ASN1BERDecPeekTag
ASN1BERDecNotEndOfContents
ASN1Free
ASN1BERDecSkip
ASN1BEREncS32
ASN1BERDecS32Val
ASN1_CreateDecoder
ASN1_CreateEncoder
ASN1_CloseDecoder
ASN1_CloseEncoder
ASN1_Decode
ASN1_FreeDecoded
ASN1_FreeEncoded
ASN1_Encode

kernel32

SetLastError
GetSystemDirectoryW
LoadLibraryW
GetSystemInfo
OpenFileMappingW
MapViewOfFileEx
CreateFileMappingW
VirtualAlloc
InitializeCriticalSection
UnmapViewOfFile
EnterCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
Sleep
InterlockedExchange
LoadLibraryExA
InterlockedCompareExchange
RegEnumValueW
IsDebuggerPresent
RegisterWaitForSingleObjectEx
RegSetValueExW
DeleteTimerQueueTimer
CreateTimerQueueTimer
ChangeTimerQueueTimer
SetCurrentDirectoryW
GetWindowsDirectoryW
CreateDirectoryW
GetVersionExW
GetComputerNameW
GetCurrentDirectoryW
MoveFileExW
UnregisterWait
DeleteCriticalSection
FreeLibrary
GetProcAddress
DelayLoadFailureHook
GetModuleHandleW
GetModuleFileNameW
GetLastError
lstrlenW
InterlockedExchangeAdd
InterlockedDecrement
InterlockedIncrement
CreateEventW
CloseHandle
ExpandEnvironmentStringsW

Exports

Exports

SpLsaModeInitialize
SpUserModeInitialize

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1caade39892300c23d62eabff2c1755d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

sspicli

msasn1

kernel32

Exports

Exports

Sections

.text Size: 55KB - Virtual size: 54KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 55KB - Virtual size: 54KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB