api-ms-win-core-misc-l1-1-0[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

api-ms-win-core-misc-l1-1-0.dll
Size

4KB
MD5

ef8ea394a8fa856340f57defd47bb9af
SHA1

1035bd01de534bc2b25a75323bf4dc52b4d7b753
SHA256

bef1925c265d2ecd01156fa37021b8a7f3ccd9f97b643eb892d2500c64553f0f
SHA512

cf9fb65a3486f6b99075ff1ce274ba713ebff3bb7e65828101983bcb77ffee19cf94e959c8c249bc5f19df0fe8c5bdc0063730c48f7dad3c37a2a744b52cb1b0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
api-ms-win-core-misc-l1-1-0.dll

Files

api-ms-win-core-misc-l1-1-0.dll
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

API-MS-Win-Core-Misc-L1-1-0.pdb

Exports

Exports

EnumSystemLocalesA
FatalAppExitA
FatalAppExitW
FormatMessageA
FormatMessageW
GlobalAlloc
GlobalFree
IsProcessInJob
IsWow64Process
LCMapStringA
LocalAlloc
LocalFree
LocalLock
LocalReAlloc
LocalUnlock
NeedCurrentDirectoryForExePathA
NeedCurrentDirectoryForExePathW
PulseEvent
SetHandleCount
Sleep
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
lstrcmp
lstrcmpA
lstrcmpW
lstrcmpi
lstrcmpiA
lstrcmpiW
lstrcpyn
lstrcpynA
lstrcpynW
lstrlen
lstrlenA
lstrlenW

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 26B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ