Dsui[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Dsui.dll
Size

116KB
MD5

c1ee7aedc90a2ca702dba4d930fd06cd
SHA1

8139f10b95b7ae965b7a286b542955767757f0a7
SHA256

f3288e997316db7f4f16a79a7ab968dc27bec03eb740f122d93d829b17c9149a
SHA512

88e1ae5d43a4e555eb619ab4e020321881f3ec2ffc38d2ea593077b0e8530da3698f651b69e329f6ad9f74c4ba044b6b8976389a47719fffe0485f137e151e94
SSDEEP

1536:SXMvzj0fYTtoU/R21YTrZCXN5xltupd5XCIWQO8XfZQOomTGI4Q5rbpb2SH+ysrn:Nj0hKhTrcxOOB+b2SHD4/h3P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Dsui.dll

Files

Dsui.dll
.dll regsvr32 windows:6 windows x86 arch:x86

6f7a4d21a9d5264cc80ada29e1670213

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Dsui.pdb

Imports

msvcrt

_vsnwprintf
__CxxFrameHandler3
_except_handler4_common
??1type_info@@UAE@XZ
realloc
_errno
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
memset
??2@YAPAXI@Z
wcscpy_s
wcscat_s
memcpy_s
_purecall
??_V@YAXPAX@Z
malloc
free
??_U@YAPAXI@Z
wcsncpy_s
??3@YAXPAX@Z
__RTDynamicCast

advapi32

RegEnumKeyExW
RegCreateKeyExW
GetTraceEnableFlags
RegQueryInfoKeyW
GetTraceLoggerHandle
RegQueryValueExW
RegSetValueExW
RegisterTraceGuidsW
RegCloseKey
TraceMessage
GetTraceEnableLevel
RegOpenKeyExW
UnregisterTraceGuids
RegDeleteValueW

shell32

ord6
SHGetPropertyStoreForWindow

user32

SetCursor
LoadCursorW
GetWindowLongW
SetWindowLongW
LoadStringW
ShowWindow
GetSystemMetrics
SetTimer
RemovePropW
GetWindowRect
SetActiveWindow
IsIconic
LoadImageW
PostMessageW
KillTimer
GetParent
SetPropW
GetForegroundWindow
FlashWindowEx
MonitorFromWindow
SetWindowPos
GetActiveWindow
SendMessageW
DestroyIcon
GetPropW
GetMonitorInfoW
UnregisterClassA
CharNextW

ole32

StringFromGUID2
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc

oleaut32

SysStringLen
LoadTypeLi
UnRegisterTypeLi
VarUI4FromStr
RegisterTypeLi
SysFreeString
SysAllocString

kernel32

TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
FormatMessageW
InitializeSRWLock
LocalFree
ExpandEnvironmentStringsW
TlsGetValue
TlsSetValue
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
FindResourceExW
TlsFree
TlsAlloc
DeleteCriticalSection
FreeLibrary
LoadResource
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
SizeofResource
LeaveCriticalSection
GetModuleFileNameW
MultiByteToWideChar
RaiseException
lstrcmpiW
DisableThreadLibraryCalls
EnterCriticalSection
GetProcAddress
GetLastError
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
LocalAlloc
GetCurrentProcess

dui70

?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?Release@Value@DirectUI@@QAEXXZ
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?SetID@Element@DirectUI@@QAEJPBG@Z
StrToID
?Click@Button@DirectUI@@SG?AVUID@@XZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z

shlwapi

SHStrDupW
PathParseIconLocationW

cfgmgr32

DevFreeObjectProperties
DevCloseObjectQuery
DevGetObjectProperties
DevCreateObjectQueryFromId

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f7a4d21a9d5264cc80ada29e1670213

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

shell32

user32

ole32

oleaut32

kernel32

dui70

shlwapi

cfgmgr32

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 46KB

.data Size: 3KB - Virtual size: 4KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 53KB - Virtual size: 53KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 46KB - Virtual size: 46KB

.data
Size: 3KB - Virtual size: 4KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 53KB - Virtual size: 53KB

.reloc
Size: 8KB - Virtual size: 7KB