AudioEng[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AudioEng.dll
Size

396KB
MD5

0a0d07f5584b4975580071fbbeca4a11
SHA1

e7a4ff75ad843fea8b7502270aefab93ce43312d
SHA256

c6b6a276b56039469103c508c093e5b97b599399b89300c9b234aa2cb1fcf81c
SHA512

ec4ec5e77f1383fb8c1f322a98accec3b6f2f80aeb869672a7a5d6e45126eba69810a0ae8fc74e7459315c3c2a4412b86c209c600a5db3a3d1b8120e918e8528
SSDEEP

6144:RDSeouMeW8mVfOk091VP4QMFeJ1xBFa3D2Au7qbUxkU8d5SfOlH9UA4g0eU69LPc:JLouM5BN2Xr/azNQO15sgl0

Score

1^/10

Malware Config

Signatures

Files

AudioEng.dll
.dll regsvr32 windows:6 windows x86 arch:x86

e4ae3deeb56954c5c58bb1b26a5e6bc6

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/06/2013, 21:43

Not After

17/09/2014, 21:43

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:19:dd:1d:90:85:fa:ed:72:9a:60:7c:9b:76:68:d5:06:d4:fc:13:e5:bc:37:8a:66:12:83:bc:39:ce:69:3e
Signer

Actual PE Digest

fb:19:dd:1d:90:85:fa:ed:72:9a:60:7c:9b:76:68:d5:06:d4:fc:13:e5:bc:37:8a:66:12:83:bc:39:ce:69:3e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AUDIOENG.pdb

Imports

msvcrt

_CIpow
_ftol2
_ftol2_sse
_CIexp
memcmp
_except_handler4_common
_onexit
_CIcos
__dllonexit
_CIsin
_lock
realloc
_errno
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
_unlock
memset
_resetstkoflw
calloc
memmove_s
ceil
_finite
_CIsqrt
_isnan
_vsnwprintf
_purecall
wcscat_s
??_V@YAXPAX@Z
wcscpy_s
??_U@YAPAXI@Z
memcpy_s
free
malloc
wcsncpy_s
floor
memcpy

ntdll

EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
RtlUnlockMemoryBlockLookaside
RtlDestroyMemoryBlockLookaside
RtlAllocateMemoryBlockLookaside
RtlLockMemoryBlockLookaside
RtlNtStatusToDosError
RtlCreateMemoryBlockLookaside
RtlFreeMemoryBlockLookaside
RtlUnlockCurrentThread
NtQueryInformationProcess
RtlLockModuleSection
RtlLockCurrentThread
RtlUnlockModuleSection
RtlExtendMemoryBlockLookaside
EtwLogTraceEvent
NtSetTimerResolution

oleaut32

VarUI4FromStr

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventRegister

api-ms-win-core-synch-l1-2-0

InitOnceInitialize
InitOnceExecuteOnce
WaitForMultipleObjectsEx
InitializeCriticalSection
ResetEvent
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
CreateWaitableTimerExW
SetEvent
EnterCriticalSection
InitOnceBeginInitialize
WaitForSingleObject
CancelWaitableTimer
SetWaitableTimer
Sleep
CreateEventW

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadResource
GetModuleFileNameW
FindResourceExW
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleHandleW
SizeofResource

api-ms-win-core-com-l1-1-1

CoTaskMemFree
CoCreateInstance
CoDisconnectObject
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegDeleteKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegGetValueW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
TraceEvent
UnregisterTraceGuids

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-localization-l1-2-1

GetThreadLocale
SetThreadLocale

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
SetThreadPriority
CreateThread
GetCurrentProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThread
TerminateProcess

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-memory-l1-1-2

GetProcessWorkingSetSizeEx
SetProcessWorkingSetSizeEx

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

avrt

AvSetMmThreadCharacteristicsA
AvQuerySystemResponsiveness
AvRevertMmThreadCharacteristics
AvSetMmThreadPriority

Exports

Exports

AERT_Allocate
AERT_Free
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 341KB - Virtual size: 341KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 512B - Virtual size: 330B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

RT_DATA
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_CONST
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4ae3deeb56954c5c58bb1b26a5e6bc6

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

fb:19:dd:1d:90:85:fa:ed:72:9a:60:7c:9b:76:68:d5:06:d4:fc:13:e5:bc:37:8a:66:12:83:bc:39:ce:69:3eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-debug-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

avrt

Exports

Exports

Sections

.text Size: 341KB - Virtual size: 341KB

RT_CODE Size: 512B - Virtual size: 330B

RT_BSS Size: - Virtual size: 40B

.data Size: 13KB - Virtual size: 13KB

.idata Size: 5KB - Virtual size: 5KB

RT_DATA Size: 3KB - Virtual size: 3KB

RT_CONST Size: 2KB - Virtual size: 2KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 10KB - Virtual size: 9KB

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

fb:19:dd:1d:90:85:fa:ed:72:9a:60:7c:9b:76:68:d5:06:d4:fc:13:e5:bc:37:8a:66:12:83:bc:39:ce:69:3e
Signer

.text
Size: 341KB - Virtual size: 341KB

RT_CODE
Size: 512B - Virtual size: 330B

RT_BSS
Size: - Virtual size: 40B

.data
Size: 13KB - Virtual size: 13KB

.idata
Size: 5KB - Virtual size: 5KB

RT_DATA
Size: 3KB - Virtual size: 3KB

RT_CONST
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 10KB - Virtual size: 9KB