AudioSes[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AudioSes.dll
Size

317KB
MD5

9db9df8d05c1e1a801bd4c695f5c239a
SHA1

16cdf963c39a548a5201eb09dd6a477dc481d4d5
SHA256

68c912c755fee4a1d00a5d8463c4f7ac024ecd3998947652dacb653a926cff4c
SHA512

8f422fcc4137fb99b6f72f3fb785475d2878ddde0ec1c4a16f2820879463405202bd72451a0a3f3453e26c76af6b9395f739e24f28fd4b655ff7afd60afecc26
SSDEEP

6144:fxo0NGmTTCEFF8lUnqojbVGMoWACVquSVQbbYyCa9DUitV:fxvNGmTTCEjhnNRGdWeuSKCa+ib

Score

1^/10

Malware Config

Signatures

Files

AudioSes.dll
.dll regsvr32 windows:6 windows x86 arch:x86

c4e115098edba8dbd8599c50adfef62c

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/06/2013, 21:43

Not After

17/09/2014, 21:43

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bb:5e:f2:50:e1:2b:6f:47:7a:df:57:76:a0:ec:9d:d6:f8:2b:a6:58:68:0c:b0:1d:b3:dc:11:28:6e:7d:cd:7a
Signer

Actual PE Digest

bb:5e:f2:50:e1:2b:6f:47:7a:df:57:76:a0:ec:9d:d6:f8:2b:a6:58:68:0c:b0:1d:b3:dc:11:28:6e:7d:cd:7a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AudioSes.pdb

Imports

msvcrt

memset
_wsplitpath_s
wcschr
_XcptFilter
_wcsnicmp
_vsnwprintf
_amsg_exit
_initterm
calloc
ceil
_localtime64_s
_time64
_wcsicmp
_resetstkoflw
_lock
_unlock
memmove_s
__dllonexit
_onexit
_errno
_purecall
realloc
wcscpy_s
??1type_info@@UAE@XZ
wcscat_s
__CxxFrameHandler3
_except_handler4_common
memcpy_s
malloc
free
memcmp
_ftol2
_CxxThrowException
_CIpow
wcsncpy_s
floor
memcpy

ntdll

AlpcInitializeMessageAttribute
RtlInitUnicodeStringEx
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
AlpcGetMessageAttribute
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
RtlFreeHeap
RtlInitUnicodeString
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtQueryInformationToken
RtlDestroyMemoryZone
RtlDestroyMemoryBlockLookaside
RtlUnlockMemoryZone
RtlAllocateMemoryBlockLookaside
RtlCreateMemoryZone
RtlAllocateMemoryZone
RtlLockMemoryZone
RtlCreateMemoryBlockLookaside
RtlFreeMemoryBlockLookaside
RtlExtendMemoryBlockLookaside
ShipAssert
NtSetInformationThread
NtQueryInformationThread
NtQueryInformationProcess
RtlNtStatusToDosError

rpcrt4

RpcSmDestroyClientContext
RpcBindingFromStringBindingW
NdrClientCall2
CStdStubBuffer_Connect
RpcStringBindingComposeW
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
NdrCStdStubBuffer_Release
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
RpcBindingFree
I_RpcExceptionFilter
CStdStubBuffer_CountRefs
NdrOleAllocate
NdrOleFree
NdrDllRegisterProxy
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
NdrDllUnregisterProxy
NdrDllCanUnloadNow
NdrDllGetClassObject
RpcStringFreeW

oleaut32

VarUI4FromStr
BSTR_UserFree
BSTR_UserUnmarshal
LPSAFEARRAY_UserSize
BSTR_UserMarshal
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
BSTR_UserSize
VariantTimeToSystemTime
SystemTimeToVariantTime

api-ms-win-core-com-l1-1-1

CoUninitialize
CoTaskMemRealloc
StringFromGUID2
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree
CoCreateInstance
PropVariantClear

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
UnregisterTraceGuids
TraceEvent
GetTraceLoggerHandle
RegisterTraceGuidsW
TraceMessage
GetTraceEnableLevel

api-ms-win-core-libraryloader-l1-2-0

LoadResource
LockResource
SizeofResource
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameW
FindResourceExW
GetModuleHandleW
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap
HeapSize
HeapDestroy
HeapReAlloc

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
TrySubmitThreadpoolCallback

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegGetValueW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW

api-ms-win-core-synch-l1-2-0

SetEvent
InitOnceBeginInitialize
Sleep
CreateEventExW
InitializeCriticalSection
DeleteCriticalSection
CreateWaitableTimerExW
LeaveCriticalSection
EnterCriticalSection
SetWaitableTimer
OpenEventW
InitOnceExecuteOnce
CreateEventW
WaitForSingleObject
ResetEvent
InitOnceInitialize

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventRegister

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-1

RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-localization-l1-2-1

SetThreadLocale
GetThreadLocale

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-processthreads-l1-1-2

GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
CreateThread
OpenProcessToken
GetCurrentThreadId

api-ms-win-power-base-l1-1-0

PowerRegisterSuspendResumeNotification
PowerUnregisterSuspendResumeNotification

api-ms-win-core-memory-l1-1-2

MapViewOfFileEx
PrefetchVirtualMemory
MapViewOfFile
OpenFileMappingW
UnmapViewOfFile
GetProcessWorkingSetSizeEx
VirtualUnlock
SetProcessWorkingSetSizeEx
VirtualLock
CreateFileMappingW

api-ms-win-core-file-l1-2-1

GetFileSize

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-kernel32-legacy-l1-1-1

WaitForMultipleObjects
FindResourceW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

mmdevapi

ord11
ord10

combase

ord17
ord8
ord4
ord2
ord9
ord5
ord16
ord13
ord6
ord12
ord11
ord10
ord3
ord23
ord7
ord14
ord20
ord21
ord19
ord18
ord22
ord15

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 241KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 1024B - Virtual size: 971B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

RT_DATA
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_CONST
Size: 512B - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4e115098edba8dbd8599c50adfef62c

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

bb:5e:f2:50:e1:2b:6f:47:7a:df:57:76:a0:ec:9d:d6:f8:2b:a6:58:68:0c:b0:1d:b3:dc:11:28:6e:7d:cd:7aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

rpcrt4

oleaut32

api-ms-win-core-com-l1-1-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-power-base-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-file-l1-2-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

mmdevapi

combase

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 241KB - Virtual size: 240KB

.orpc Size: 1KB - Virtual size: 1KB

RT_CODE Size: 1024B - Virtual size: 971B

RT_BSS Size: - Virtual size: 40B

.data Size: 2KB - Virtual size: 1KB

.idata Size: 8KB - Virtual size: 8KB

RT_DATA Size: 512B - Virtual size: 160B

RT_CONST Size: 512B - Virtual size: 476B

.rsrc Size: 34KB - Virtual size: 34KB

.reloc Size: 16KB - Virtual size: 15KB

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

bb:5e:f2:50:e1:2b:6f:47:7a:df:57:76:a0:ec:9d:d6:f8:2b:a6:58:68:0c:b0:1d:b3:dc:11:28:6e:7d:cd:7a
Signer

.text
Size: 241KB - Virtual size: 240KB

.orpc
Size: 1KB - Virtual size: 1KB

RT_CODE
Size: 1024B - Virtual size: 971B

RT_BSS
Size: - Virtual size: 40B

.data
Size: 2KB - Virtual size: 1KB

.idata
Size: 8KB - Virtual size: 8KB

RT_DATA
Size: 512B - Virtual size: 160B

RT_CONST
Size: 512B - Virtual size: 476B

.rsrc
Size: 34KB - Virtual size: 34KB

.reloc
Size: 16KB - Virtual size: 15KB