DataExchange[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

DataExchange.dll
Size

290KB
MD5

4b3982a5c0f265d16b3725f9030dd83d
SHA1

5ec47418cf50f36198b85501bed7a792483ce463
SHA256

c8d558c7cf31bcaea8832f56056dd051e9024d09731e0154f0fbd639a891842a
SHA512

9d852da2889bae6fe5b599ab625b2479c9935da0a37ce018132ba709645e2ed9bb6eb33d0b2e1dc63392ad1bb107c31e330f7fddd9736e863c9ba0292fd91162
SSDEEP

6144:5Nwyg7yz40D0bjP4Dhp/GqUdkYi6+pivYn1N/fCvVe/:Z+yzJD0bMNGqUdPiJjnfT/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DataExchange.dll

Files

DataExchange.dll
.dll windows:10 windows x86 arch:x86

80eda68d27052c0ff5337f5e7ac0ae7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DataExchange.pdb

Imports

msvcrt

??1type_info@@UAE@XZ
memmove
_ftol2_sse
_purecall
memcpy_s
_vsnprintf_s
memmove_s
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
_except_handler4_common
memcmp
??3@YAXPAX@Z
_vsnwprintf
memcpy
_CxxThrowException
_callnewh
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
memset

shcore

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
GetScaleFactorForMonitor
GetProcessDpiAwareness
ord244
ord270
CreateStreamOverRandomAccessStream

api-ms-win-core-libraryloader-l1-2-0

LockResource
DisableThreadLibraryCalls
GetModuleFileNameA
LoadResource
GetModuleHandleExW
GetModuleHandleW
SizeofResource
GetProcAddress

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
WindowsIsStringEmpty
WindowsDuplicateString
WindowsDeleteString
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsCreateString

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventActivityIdControl
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
OpenProcessToken

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW
RoOriginateError

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
WaitForSingleObjectEx
InitializeSRWLock
LeaveCriticalSection
CreateMutexExW
OpenSemaphoreW
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
CreateEventExW
ReleaseMutex
CreateEventW
WaitForSingleObject
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockShared

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
SleepConditionVariableSRW
InitOnceExecuteOnce
InitOnceBeginInitialize
WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoReleaseMarshalData
PropVariantClear
CreateStreamOnHGlobal
CoMarshalInterface

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegGetValueW

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

combase

ord90
ord157

ntdll

RtlIsMultiSessionSku
RtlGetDeviceFamilyInfoEnum
ZwQueryWnfStateData
RtlNtStatusToDosError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice2

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80eda68d27052c0ff5337f5e7ac0ae7a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shcore

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-kernel32-legacy-l1-1-0

combase

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

d3d11

dcomp

Exports

Exports

Sections

.text Size: 153KB - Virtual size: 153KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 88B

.rsrc Size: 117KB - Virtual size: 117KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 153KB - Virtual size: 153KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 88B

.rsrc
Size: 117KB - Virtual size: 117KB

.reloc
Size: 10KB - Virtual size: 10KB