WinTypes[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

WinTypes.dll
Size

494KB
MD5

f592098a86d10ff4277f5d0ef6c90ad2
SHA1

5174e894cec1817579dd1d4e63adc7296e869ed4
SHA256

3b648a2c987a0b3bb5f33e827580e96eea720bb4f0ee18befb40807b4371cde3
SHA512

1419e33badf03f73617ff2f7c476b897c4b4f5e0400fb8ea7a7860a4e7db07c66da33b12689374870275d6a9a415def8ada822587187531c390bff0c5dcdbe3e
SSDEEP

6144:zgqqwNjj7TVM/5Q6rPC+luk3I/RhOnZ/nMNTO83KAmff+4rvBSpSjRuA6W7PyjA0:za6FM/5Q6rPyIXrvB2mRuA6yyjv

Score

1^/10

Malware Config

Signatures

Files

WinTypes.dll
.dll windows:6 windows x86 arch:x86

c5538b64f38ebb613251099e34bfc962

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/06/2013, 21:43

Not After

17/09/2014, 21:43

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b2:13:bd:f8:f2:e7:c1:48:b8:82:d9:dc:57:95:81:23:c1:2f:8c:e9:58:91:bf:0b:66:3d:4c:03:4c:a4:88:10
Signer

Actual PE Digest

b2:13:bd:f8:f2:e7:c1:48:b8:82:d9:dc:57:95:81:23:c1:2f:8c:e9:58:91:bf:0b:66:3d:4c:03:4c:a4:88:10

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WinTypes.pdb

Imports

msvcrt

_except_handler4_common
_purecall
__CxxFrameHandler3
??2@YAPAXI@Z
_onexit
__dllonexit
_unlock
_lock
memcpy
memcmp
_ftol2_sse
_ftol2
?terminate@@YAXXZ
_initterm
memcpy_s
wcsrchr
wcsncmp
_vsnwprintf
isdigit
??_V@YAXPAX@Z
towupper
_wcsnicmp
wcschr
swprintf_s
memmove
wcstoul
wcsncat_s
wcscat_s
wcscpy_s
_errno
realloc
??3@YAXPAX@Z
malloc
free
_amsg_exit
_XcptFilter
memset

combase

ord9
ord32
ord12
ord34
ord7
ord8
ord5
ord90
ord2
ord18
ord6
ord28
ord15
ord25
ord26
ord29
ord10
ord22
ord30
ord27
ord24
ord16
ord21
ord13
ord33
ord20
ord19
ord11
ord23
ord17
ord14

api-ms-win-core-winrt-string-l1-1-0

HSTRING_UserUnmarshal
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringLen
WindowsDeleteString
HSTRING_UserFree
WindowsPreallocateStringBuffer
HSTRING_UserSize
WindowsPromoteStringBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDeleteStringBuffer
WindowsGetStringRawBuffer
HSTRING_UserMarshal
WindowsDuplicateString

api-ms-win-core-winrt-error-l1-1-1

RoOriginateErrorW
SetRestrictedErrorInfo
RoTransformError
IsErrorPropagationEnabled
GetRestrictedErrorInfo
RoReportFailedDelegate
RoOriginateError
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
InitOnceExecuteOnce
InitOnceInitialize
DeleteCriticalSection
EnterCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
Sleep
InitializeCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventRegister

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

OpenProcessToken
OpenProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter

rpcrt4

CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Disconnect
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_AddRef
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrStubCall2
NdrOleAllocate
NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release

api-ms-win-core-file-l1-2-1

FindNextFileW
FindClose
GetFileAttributesW
FindFirstFileW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringEx
WideCharToMultiByte

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-handle-l1-1-0

CloseHandle

ntdll

RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
RoCreateNonAgilePropertySet
RoGetBufferMarshaler
RoGetMetaDataFile
RoParseTypeName
RoResolveNamespace

Sections

.text
Size: 398KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5538b64f38ebb613251099e34bfc962

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

b2:13:bd:f8:f2:e7:c1:48:b8:82:d9:dc:57:95:81:23:c1:2f:8c:e9:58:91:bf:0b:66:3d:4c:03:4c:a4:88:10Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

combase

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

rpcrt4

api-ms-win-core-file-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-handle-l1-1-0

ntdll

api-ms-win-core-debug-l1-1-1

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 398KB - Virtual size: 398KB

.orpc Size: 4KB - Virtual size: 3KB

.data Size: 18KB - Virtual size: 17KB

.idata Size: 5KB - Virtual size: 5KB

minATL Size: 512B - Virtual size: 44B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 51KB - Virtual size: 50KB

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

b2:13:bd:f8:f2:e7:c1:48:b8:82:d9:dc:57:95:81:23:c1:2f:8c:e9:58:91:bf:0b:66:3d:4c:03:4c:a4:88:10
Signer

.text
Size: 398KB - Virtual size: 398KB

.orpc
Size: 4KB - Virtual size: 3KB

.data
Size: 18KB - Virtual size: 17KB

.idata
Size: 5KB - Virtual size: 5KB

minATL
Size: 512B - Virtual size: 44B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 51KB - Virtual size: 50KB