DismApi[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

DismApi.dll
Size

430KB
MD5

21e1e0492ea1312a9f9cc22fc9a814b1
SHA1

2e742a9c42d061b48ef78abda07e51e9394f1bcc
SHA256

11d883ad8fe139fc233d501b8a600320495c2c565104a278036d2d5720bd70e5
SHA512

90efe6ec7714185c8a3f36dca5f4ff4190708b4ee4bc9a2707c201df66783775bd02be10745f177761d084cdb39f35edad86cf42d12b229475039f47ded20c97
SSDEEP

6144:axD3hReoNh1eEBc9nNEtOMUtQdX2t/pIeaDvdtQCy:a9hReyJwq07Od2ZS5HQ1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DismApi.dll

Files

DismApi.dll
.dll windows:6 windows x86 arch:x86

21074fa0dff9e0cbe39f980c9636aff1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

DismApi.pdb

Imports

msvcrt

_wcslwr_s
_wtoi
iswspace
wcschr
_wcstoui64
towlower
wcsstr
_vsnwprintf
wcsrchr
_wcsnicmp
??0exception@@QAE@XZ
_callnewh
_CxxThrowException
_XcptFilter
swscanf_s
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_lock
_unlock
__dllonexit
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
_onexit
?what@exception@@UBEPBDXZ
rand
_vsnprintf
_purecall
_wcsicmp
calloc
iswalpha
_vscprintf
malloc
vsprintf_s
memset
feof
__CxxFrameHandler3
_errno
realloc
_except_handler4_common
memcmp
_ftol2
_wfopen
strrchr
fgetws
wcstok_s
fclose
free
vswprintf_s
_vscwprintf
memmove_s
wcstoul
iswctype
_amsg_exit
memcpy_s
memcpy

api-ms-win-downlevel-kernel32-l1-1-0

SearchPathW
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareStringW
HeapFree
GetProcessHeap
GetEnvironmentVariableW
LoadLibraryExW
FreeLibrary
GetModuleFileNameW
GetThreadUILanguage
OutputDebugStringA
GetModuleHandleExW
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
GetCurrentProcessId
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
FormatMessageW
RaiseException
DeleteCriticalSection
InitializeCriticalSection
GetProcAddress
GetVersionExW
GetModuleHandleW
WaitForSingleObject
IsDebuggerPresent
GetFileSizeEx
DeleteFileA
DebugBreak
DeleteFileW
ReleaseMutex
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
GetVersion
CreateMutexA
LoadLibraryExA
GetModuleFileNameA
WriteFile
ExpandEnvironmentStringsA
CreateMutexW
MultiByteToWideChar
CreateFileA
Sleep
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
WaitForMultipleObjectsEx
SetUnhandledExceptionFilter
TerminateProcess
TlsFree
GetWindowsDirectoryW
TlsAlloc
CreateFileMappingW
GetLocalTime
TlsSetValue
FormatMessageA
VirtualQuery
UnmapViewOfFile
MapViewOfFile
TlsGetValue
GetFileSize
ExitProcess
MoveFileExW
GetLocaleInfoW
GetSystemTime
GetTimeFormatW
SetFilePointer
GetSystemWindowsDirectoryW
CreateEventW
ResumeThread
DuplicateHandle
GetTempFileNameW
OutputDebugStringW
CreateThread
ExpandEnvironmentStringsW
GetLastError
ResetEvent
GetFullPathNameW
FindFirstFileW
CreateFileW
FlushFileBuffers
GetTempPathW
SetLastError
FindClose
DeviceIoControl
CloseHandle
GetFileInformationByHandle
GetCurrentThread
GetSystemInfo
GetCurrentProcess
IsWow64Process
CreateDirectoryW
GetFileAttributesW
GetCommandLineW
SetErrorMode
UnhandledExceptionFilter
SetEvent
FindResourceExW

api-ms-win-downlevel-advapi32-l1-1-1

RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
OpenProcessToken
OpenThreadToken
GetTokenInformation
EqualSid
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorDacl
GetTraceEnableFlags
GetTraceLoggerHandle
GetTraceEnableLevel
RegisterTraceGuidsW
TraceEvent
UnregisterTraceGuids
InitializeSecurityDescriptor
GetLengthSid

api-ms-win-downlevel-ole32-l1-1-1

CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
GetErrorInfo
CoUninitialize

api-ms-win-downlevel-kernel32-l2-1-0

LocalFree
CreateFileMappingA

api-ms-win-downlevel-user32-l1-1-1

CharLowerBuffW

oleaut32

SafeArrayAccessData
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringLen
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysStringLen
VarBstrCmp
VariantClear
LoadRegTypeLi
LoadTypeLi
SafeArrayUnaccessData
SafeArrayDestroy
SysFreeString

ntdll

RtlAllocateHeap
RtlFreeHeap
RtlGetVersion
RtlNtStatusToDosError

api-ms-win-downlevel-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

Exports

Exports

DismAddDriver
DismAddPackage
DismApplyUnattend
DismCheckImageHealth
DismCleanupMountpoints
DismCloseSession
DismCommitImage
DismDelete
DismDisableFeature
DismEnableFeature
DismGetDriverInfo
DismGetDrivers
DismGetFeatureInfo
DismGetFeatureParent
DismGetFeatures
DismGetImageInfo
DismGetLastErrorMessage
DismGetMountedImageInfo
DismGetPackageInfo
DismGetPackages
DismInitialize
DismMountImage
DismOpenSession
DismRemountImage
DismRemoveDriver
DismRemovePackage
DismRestoreImageHealth
DismShutdown
DismUnmountImage
_DismAddProvisionedAppxPackage
_DismEnableDisableFeature
_DismGetCurrentEdition
_DismGetFeaturesEx
_DismGetKCacheBinaryValue
_DismGetKCacheDwordValue
_DismGetKCacheStringValue
_DismGetLastCBSSessionID
_DismGetOsInfo
_DismGetProductKeyInfo
_DismGetProvisionedAppxPackages
_DismGetRegistryMountPoint
_DismGetStateFromCBSSessionID
_DismGetTargetEditions
_DismRemoveProvisionedAppxPackage
_DismSetAppXProvisionedDataFile
_DismSetEdition
_DismSetFirstBootCommandLine
_DismSetMachineName
_DismSetProductKey
_DismValidateProductKey

Sections

.text
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

21074fa0dff9e0cbe39f980c9636aff1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-downlevel-kernel32-l1-1-0

api-ms-win-downlevel-advapi32-l1-1-1

api-ms-win-downlevel-ole32-l1-1-1

api-ms-win-downlevel-kernel32-l2-1-0

api-ms-win-downlevel-user32-l1-1-1

oleaut32

ntdll

api-ms-win-downlevel-version-l1-1-0

Exports

Exports

Sections

.text Size: 364KB - Virtual size: 363KB

.data Size: 15KB - Virtual size: 16KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 32KB - Virtual size: 32KB

.text
Size: 364KB - Virtual size: 363KB

.data
Size: 15KB - Virtual size: 16KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 32KB - Virtual size: 32KB