TSWorkspace[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

TSWorkspace.dll
Size

931KB
MD5

ede55afbc765954adaa5296aff0c1543
SHA1

0bed732e6de32b8282044e95305118da8e071fd4
SHA256

b684a3f2c46d41204d3b04329be1454bbbaf65363bb25c016bd3245dfc770cc3
SHA512

9004a49042eb1682bfa99c4ded893cf32a6549f664dd328f0e9c4d578e6f0ebb11f607a0f0b3c6ed144422e9bcb03c7e70088050f33410b491597b37dc511d51
SSDEEP

12288:S2ISyxfT42F+cUgKN58msMER91SsDpqDUN6Kw9ZwXIB7GjFyFW5e/:S2LyxfzVUgosMS7SJIN6KwUimb5e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TSWorkspace.dll

Files

TSWorkspace.dll
.dll regsvr32 windows:10 windows x86 arch:x86

faa7dc37443b81ffcdf5de1d7d913201

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

TSWorkspace.pdb

Imports

msvcrt

toupper
wcstol
___lc_collate_cp_func
wcstok_s
wcstombs_s
_vscwprintf
time
gmtime
wcsftime
setlocale
memcpy
wcsstr
_wtoi
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
___lc_handle_func
_wcsnicmp
wcscspn
wcsncmp
rand_s
fclose
iswcntrl
fgetws
_wfopen_s
iswspace
_vsnwprintf
__crtLCMapStringW
___mb_cur_max_func
___lc_codepage_func
__pctype_func
memcmp
abort
towlower
_wcslwr
??3@YAXPAX@Z
strchr
vswprintf_s
__RTDynamicCast
_ftol2
_ftol2_sse
memmove
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QAE@XZ
calloc
memmove_s
_wcsicmp
?what@exception@@UBEPBDXZ
_purecall
wcscat_s
wcscpy_s
malloc
wcsncpy_s
free
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
memcpy_s
??_V@YAXPAX@Z
__CxxFrameHandler3
__crtCompareStringW
memset

ole32

PropVariantClear
CoInitializeEx
IIDFromString
CLSIDFromString
CoCreateGuid
CoUninitialize
CoInitialize
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
StringFromIID

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

oleaut32

SysStringByteLen
SysAllocStringByteLen
LPSAFEARRAY_UserMarshal
VarBstrCmp
BSTR_UserUnmarshal
SysAllocString
LPSAFEARRAY_UserUnmarshal
SysAllocStringLen
VarUI4FromStr
BSTR_UserMarshal
SafeArrayLock
SysStringLen
SafeArrayRedim
SafeArrayUnlock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayPutElement
LPSAFEARRAY_UserFree
SysFreeString
LPSAFEARRAY_UserSize
BSTR_UserFree
BSTR_UserSize
SafeArrayCreate
VariantChangeType
VarBstrCat
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
LoadRegTypeLi
VariantInit
VariantClear

rpcrt4

CStdStubBuffer_CountRefs
NdrCStdStubBuffer_Release
CStdStubBuffer_AddRef
NdrStubForwardingFunction
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Connect
NdrStubCall2
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow
IUnknown_AddRef_Proxy
NdrCStdStubBuffer2_Release
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
CStdStubBuffer_Disconnect
NdrOleFree
IUnknown_Release_Proxy
CStdStubBuffer_Invoke
CStdStubBuffer_DebugServerRelease
IUnknown_QueryInterface_Proxy
NdrOleAllocate
CStdStubBuffer_QueryInterface

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
ReleaseMutex
CreateEventExW
LeaveCriticalSection
ResetEvent
InitializeCriticalSection
CreateEventW
WaitForSingleObject
SetEvent
CreateMutexW
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExA
GetModuleHandleExW
GetModuleFileNameW
LoadStringW
GetModuleHandleW
SizeofResource
LoadResource
FindResourceExW
LockResource

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegDeleteTreeW
RegDeleteValueW
RegGetValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExW
RegCloseKey
RegNotifyChangeKeyValue
RegOpenKeyExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW
CompareStringEx
GetStringTypeW
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
EventActivityIdControl

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce
InitOnceInitialize

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
InitializeSecurityDescriptor
AddAce
InitializeAcl
SetSecurityDescriptorGroup
GetLengthSid
CopySid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetTokenInformation
RevertToSelf
GetSecurityDescriptorControl
IsValidSid
MakeAbsoluteSD
GetAclInformation
ImpersonateLoggedOnUser

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalFree
LocalAlloc

api-ms-win-core-processthreads-l1-1-0

SwitchToThread
CreateThread
TerminateThread
TlsAlloc
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
TlsSetValue
TlsFree
TerminateProcess
OpenProcessToken
OpenThreadToken
OpenThread
TlsGetValue
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetComputerNameExW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMaximum
CloseThreadpool
TrySubmitThreadpoolCallback
CreateThreadpool
SetThreadpoolThreadMinimum
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects
CreateSemaphoreW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSize
HeapAlloc
HeapReAlloc
HeapDestroy
HeapFree

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

kernel32

CreateTimerQueueTimer
DeleteTimerQueueTimer
VerifyVersionInfoW
lstrcmpiW
lstrlenA

user32

GetWindowLongW
GetWindowTextW
GetDlgItem
GetPropW
GetMessageW
PostMessageW
SetWindowLongW
SetDlgItemTextW
KillTimer
GetClassInfoExW
DestroyWindow
UnregisterClassW
GetWindowRect
CreateWindowExW
DefWindowProcW
SendMessageW
DispatchMessageW
GetParent
SetDlgItemInt
RemovePropW
GetDesktopWindow
SetTimer
DestroyIcon
SetPropW
ShowWindow
PostQuitMessage
SetFocus
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
PostThreadMessageW
UnregisterClassA
SetWindowPos
LoadIconW
RegisterClassExW
LoadImageW

dnsapi

DnsFree
DnsQuery_W

normaliz

IdnToUnicode
IdnToAscii

sspicli

LsaDeregisterLogonProcess
LsaConnectUntrusted
LsaLookupAuthenticationPackage
GetUserNameExW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW
RegDeleteKeyValueW

api-ms-win-core-file-l2-1-0

CreateDirectoryExW

crypt32

CryptVerifyDetachedMessageSignature
CertCloseStore
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CryptMsgUpdate
CertOpenStore
CryptMsgClose
CryptProtectMemory
CertFreeCertificateContext
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CryptSignMessage
CryptMsgOpenToDecode
CryptUnprotectMemory
CryptBinaryToStringW
CertFindExtension
CertGetCertificateChain
CertGetEnhancedKeyUsage
CryptDecodeObject
CryptProtectData
CryptUnprotectData
CryptStringToBinaryW
CertGetCertificateContextProperty

api-ms-win-security-sddl-l1-1-0

ConvertSecurityDescriptorToStringSecurityDescriptorW

winhttp

WinHttpOpen
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpSendRequest
WinHttpCreateUrl
WinHttpQueryDataAvailable
WinHttpQueryOption
WinHttpQueryAuthSchemes
WinHttpSetCredentials
WinHttpConnect
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpCrackUrl

api-ms-win-security-credentials-l1-1-0

CredWriteW
CredGetSessionTypes

api-ms-win-core-file-l1-1-0

SetFilePointer
DeleteFileW
WriteFile
CreateFileW
GetFileSize
ReadFile
GetFileAttributesW

api-ms-win-core-localization-l1-2-0

GetACP
LCMapStringW

api-ms-win-core-url-l1-1-0

UrlCombineW
UrlGetPartW
UrlCreateFromPathW

cryptsp

CryptCreateHash
CryptHashData
CryptAcquireContextW
CryptDestroyHash
CryptReleaseContext
CryptGetHashParam

ntdll

RtlInitString

advapi32

RegCreateKeyTransactedW
RegOpenKeyTransactedW
RegDeleteKeyW
IsTextUnicode
GetUserNameW

shlwapi

PathFileExistsW
PathCanonicalizeW
PathIsContentTypeW
PathQuoteSpacesW
ord278

shell32

SHGetKnownFolderPath
SHFileOperationW
Shell_NotifyIconW
SHCreateAssociationRegistration
SHChangeNotify
SHCreateDirectoryExW

wininet

InternetCrackUrlW
InternetCreateUrlW
InternetCombineUrlW
InternetCanonicalizeUrlW

credui

CredUIPromptForWindowsCredentialsW
CredUnPackAuthenticationBufferW

ktmw32

CommitTransaction
CreateTransaction

Exports

Exports

CreateClaimsAuthResponseHeader
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RADCProcessGroupPolicyEx
RADCUISupportCreateDiscoveryStrategy
RADCUISupportCreateSubscriptionClient
TaskUpdateWorkspaces
TaskUpdateWorkspaces2
TaskUpdateWorkspacesIfNeeded
TryParseClaimsAuthnHeader
WorkspaceSilentSetupW
WorkspaceStatusNotify
WorkspaceStatusNotify2

Sections

.text
Size: 714KB - Virtual size: 713KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

faa7dc37443b81ffcdf5de1d7d913201

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ole32

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

oleaut32

rpcrt4

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-timezone-l1-1-0

kernel32

user32

dnsapi

normaliz

sspicli

api-ms-win-core-registry-l1-1-1

api-ms-win-core-file-l2-1-0

crypt32

api-ms-win-security-sddl-l1-1-0

winhttp

api-ms-win-security-credentials-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-url-l1-1-0

cryptsp

ntdll

advapi32

shlwapi

shell32

wininet

credui

ktmw32

Exports

Exports

Sections

.text Size: 714KB - Virtual size: 713KB

.data Size: 12KB - Virtual size: 15KB

.idata Size: 14KB - Virtual size: 13KB

.rsrc Size: 137KB - Virtual size: 136KB

.reloc Size: 53KB - Virtual size: 52KB

.text
Size: 714KB - Virtual size: 713KB

.data
Size: 12KB - Virtual size: 15KB

.idata
Size: 14KB - Virtual size: 13KB

.rsrc
Size: 137KB - Virtual size: 136KB

.reloc
Size: 53KB - Virtual size: 52KB