Windows[.]Globalization[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Windows.Globalization.dll
Size

783KB
MD5

fe356beafce5eb14e5899095f5185a28
SHA1

dcb7196ad5ca1281dd10eb042436ebc6ffd0aa4c
SHA256

b3122bd350d649984fb702d0e8796478685a762f1a427e4a7211a1e77348c5c1
SHA512

61fe0f9cd839a13d1506b809a61f61f5213aa5662d79931bcdebf2fee31850a520b03745706973f821f952eb43833c39388d478ec259b15903de137d11d5e632
SSDEEP

24576:TayuVuhOw98jksp8Uz/iWCWvhoTCT9t/GensBaA:OhuUw98jLuUeWCohoAsBaA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows.Globalization.dll

Files

Windows.Globalization.dll
.dll windows:6 windows x86 arch:x86

caebe2458255d472bfb613000192af2a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Windows.Globalization.pdb

Imports

msvcrt

_CxxThrowException
__CxxFrameHandler3
memcpy
setlocale
_lock
memset
_unlock
___lc_collate_cp_func
memcmp
__pctype_func
_ismbblead
___lc_codepage_func
calloc
_callnewh
__uncaught_exception
_wcsdup
??8type_info@@QBEHABV0@@Z
__crtCompareStringW
___lc_handle_func
___mb_cur_max_func
wcstod
__crtLCMapStringW
modf
_get_current_locale
_free_locale
ceil
abort
??0exception@@QAE@XZ
_ecvt_s
??0exception@@QAE@ABQBDH@Z
??3@YAXPAX@Z
_ftol2_sse
_ftol2
_CIlog10
_CIfmod
wcstol
_errno
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_initterm
_amsg_exit
_XcptFilter
wcscpy_s
realloc
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_purecall
??0bad_cast@@QAE@ABV0@@Z
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??_V@YAXPAX@Z
strchr
malloc
free
memmove
memmove_s
floor

api-ms-win-core-winrt-error-l1-1-1

RoTransformError
RoOriginateErrorW
RoOriginateError

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateString
WindowsGetStringLen
WindowsCompareStringOrdinal
WindowsDeleteString
HSTRING_UserFree
HSTRING_UserUnmarshal
HSTRING_UserMarshal
HSTRING_UserSize
WindowsCreateStringReference
WindowsDuplicateString

api-ms-win-core-sysinfo-l1-2-1

GetSystemWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
InitializeSRWLock
InitOnceExecuteOnce
InitOnceInitialize
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWrite

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-com-l1-1-1

CoCreateInstance
CLSIDFromString
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-localization-l1-2-1

ResolveLocaleName
EnumSystemGeoID
GetUserGeoID
GetGeoInfoW
GetUserDefaultLocaleName
GetLocaleInfoEx
FormatMessageW
IsValidLocaleName
EnumSystemLocalesEx

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
GetStringTypeW
CompareStringOrdinal
WideCharToMultiByte

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
GetTimeZoneInformationForYear
EnumDynamicTimeZoneInformation
GetDynamicTimeZoneInformationEffectiveYears
GetDynamicTimeZoneInformation

api-ms-win-core-path-l1-1-0

PathCchAppend

rpcrt4

NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
NdrOleAllocate
CStdStubBuffer_CountRefs
NdrStubCall2
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
CStdStubBuffer_Connect
CStdStubBuffer_AddRef

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-localization-obsolete-l1-2-0

LCIDToLocaleName

api-ms-win-core-kernel32-legacy-l1-1-1

RaiseFailFastException

api-ms-win-core-localization-l2-1-0

EnumCalendarInfoExEx
EnumTimeFormatsEx

api-ms-win-core-normalization-l1-1-0

GetStringScripts

ntdll

RtlQueryWnfStateData
RtlNtStatusToDosError
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
ord1

combase

ord10
ord12
ord32
ord5
ord9
ord2
ord14
ord17
ord7
ord20
ord8
ord21
ord34
ord19
ord16
ord6
ord11
ord33
ord13
ord15
ord18
ord22

bcp47langs

GetApplicationLanguageOverride
Bcp47Normalize
Bcp47GetExtensionSubstring
Bcp47GetIsoScriptCode
GetUserLanguages
ClearApplicationLanguageOverride
SetApplicationLanguageOverride
GetApplicationManifestLanguages
Bcp47IsWellFormed
GetApplicationLanguages
ResolveLanguages
Bcp47GetDistance

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 709KB - Virtual size: 709KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 523B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

caebe2458255d472bfb613000192af2a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-path-l1-1-0

rpcrt4

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-localization-l2-1-0

api-ms-win-core-normalization-l1-1-0

ntdll

combase

bcp47langs

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 709KB - Virtual size: 709KB

.orpc Size: 1024B - Virtual size: 523B

.data Size: 11KB - Virtual size: 10KB

.idata Size: 7KB - Virtual size: 7KB

minATL Size: 512B - Virtual size: 96B

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 44KB - Virtual size: 44KB

.text
Size: 709KB - Virtual size: 709KB

.orpc
Size: 1024B - Virtual size: 523B

.data
Size: 11KB - Virtual size: 10KB

.idata
Size: 7KB - Virtual size: 7KB

minATL
Size: 512B - Virtual size: 96B

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 44KB - Virtual size: 44KB