SHCore[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

SHCore.dll
Size

465KB
MD5

fca4d9d06c44ba66878dd01d132cd816
SHA1

0d0d8a0e5717ad5c32b557ed0ebc0f237bc9e1b8
SHA256

3cf39bd49ac009b528c2788bc433a8e1f2860400bba9cc39022308c8f8f5ead9
SHA512

ff57c3263845aa116519a2690f8dc68a6198ab7ed3118fbcfb87fa8fb46c3626ba0c2c3a17ff091250dccb80d259efc49eb68adb82944a9d470ffea50490c990
SSDEEP

6144:J4xHLkZfUDBWCAbSprq60XXsGvRBn9Er4FQTv+ewXLISMLY2qWvzrDIJ:9Z0BLAbSQXXs0Er4FQTv+hIS12FvzW

Score

1^/10

Malware Config

Signatures

Files

SHCore.dll
.dll windows:6 windows x86 arch:x86

9761ec67777fc378d4a62bcf5dcb7e48

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17-06-2013 21:43

Not After

17-09-2014 21:43

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ec:aa:53:2e:09:cc:2e:dd:48:36:c1:f0:7c:64:e1:1a:55:aa:dd:34:ac:2f:4f:94:0f:d7:7d:af:54:6a:22:84
Signer

Actual PE Digest

ec:aa:53:2e:09:cc:2e:dd:48:36:c1:f0:7c:64:e1:1a:55:aa:dd:34:ac:2f:4f:94:0f:d7:7d:af:54:6a:22:84

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

shcore.pdb

Imports

msvcrt

memcpy_s
_vsnwprintf
memmove
_amsg_exit
wcsncmp
_lock
__CxxFrameHandler3
_purecall
memcpy
strchr
memcmp
_unlock
wcsrchr
_ftol2
__dllonexit
free
wcschr
_onexit
_except_handler4_common
??2@YAPAXI@Z
malloc
_initterm
??3@YAXPAX@Z
_XcptFilter
memset
_ftol2_sse

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

ReleaseMutex
TryAcquireSRWLockExclusive
InitializeCriticalSection
ReleaseSRWLockExclusive
InitOnceExecuteOnce
SetEvent
InitializeSRWLock
CreateEventExW
CreateMutexW
AcquireSRWLockShared
CreateEventW
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSemaphore
Sleep
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
ReleaseSRWLockShared
WaitForMultipleObjectsEx
OpenSemaphoreW
InitializeCriticalSectionEx
LeaveCriticalSection
OpenEventW

api-ms-win-core-winrt-error-l1-1-1

SetRestrictedErrorInfo
RoOriginateError
GetRestrictedErrorInfo
RoOriginateErrorW
RoTransformError

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
FreeLibraryAndExitThread
FindResourceExW
LoadResource
FreeLibrary
LockResource
SizeofResource
GetModuleHandleExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetProcessId
GetCurrentProcessId
OpenProcess
GetCurrentThreadId
OpenThreadToken
TlsSetValue
GetCurrentThread
GetCurrentProcess
TerminateProcess
TlsAlloc
OpenProcessToken
TlsFree
CreateThread
TlsGetValue
GetStartupInfoW

api-ms-win-core-sysinfo-l1-2-1

GetOsSafeBootMode
GetVersionExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-memory-l1-1-2

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
OpenFileMappingW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
ExpandEnvironmentStringsA

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegSetValueExW
RegGetValueW
RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteKeyExA
RegDeleteValueA
RegOpenKeyExW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
TrySubmitThreadpoolCallback
DisassociateCurrentThreadFromCallback
CloseThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolTimer
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CallbackMayRunLong
CreateThreadpoolWait
FreeLibraryWhenCallbackReturns

api-ms-win-security-base-l1-2-0

GetTokenInformation
CheckTokenMembership
AdjustTokenPrivileges

api-ms-win-core-file-l1-2-1

GetFileInformationByHandle
FlushFileBuffers
GetFileSizeEx
ReadFile
DeleteFileW
LockFileEx
SetFileInformationByHandle
GetFileAttributesExW
CreateFileW
SetFilePointer
GetFileAttributesW
UnlockFileEx
GetVolumeInformationByHandleW
GetDriveTypeW
SetFilePointerEx
SetEndOfFile
WriteFile

api-ms-win-core-io-l1-1-1

DeviceIoControl
CancelIoEx
GetOverlappedResult

api-ms-win-core-path-l1-1-0

PathAllocCanonicalize

api-ms-win-core-file-l2-1-1

ReplaceFileW
GetFileInformationByHandleEx

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsUNCW
PathGetDriveNumberW
PathFindFileNameW
PathUnExpandEnvStringsW
PathFileExistsW
PathRemoveFileSpecW
PathCombineW
PathUnExpandEnvStringsA
PathFindExtensionW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
QueueUserWorkItem
CreateTimerQueueTimer

api-ms-win-core-kernel32-legacy-l1-1-1

RaiseFailFastException
CreateSemaphoreW
MulDiv

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW
GlobalDeleteAtom
GlobalAddAtomExW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalReAlloc
LocalAlloc

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch
StrDupW
StrDupA
StrCmpICW
StrChrW
StrCmpNIW
StrCmpNICW
StrToIntW
SHLoadIndirectString

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

ntdll

RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlNtStatusToDosError
NtQueryInformationProcess
NtCreateFile
NtQuerySystemInformation
RtlInitUnicodeString

combase

ord134

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

CommandLineToArgvW
CreateRandomAccessStreamOnFile
CreateRandomAccessStreamOverStream
CreateStreamOverRandomAccessStream
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetCurrentProcessExplicitAppUserModelID
GetDpiForMonitor
GetProcessDpiAwareness
GetProcessReference
GetScaleFactorForDevice
GetScaleFactorForMonitor
IStream_Copy
IStream_Read
IStream_ReadStr
IStream_Reset
IStream_Size
IStream_Write
IStream_WriteStr
IUnknown_AtomicRelease
IUnknown_GetSite
IUnknown_QueryService
IUnknown_Set
IUnknown_SetSite
IsOS
RegisterScaleChangeEvent
RegisterScaleChangeNotifications
RevokeScaleChangeNotifications
SHAnsiToAnsi
SHAnsiToUnicode
SHCopyKeyA
SHCopyKeyW
SHCreateMemStream
SHCreateStreamOnFileA
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
SHCreateThread
SHCreateThreadRef
SHCreateThreadWithHandle
SHDeleteEmptyKeyA
SHDeleteEmptyKeyW
SHDeleteKeyA
SHDeleteKeyW
SHDeleteValueA
SHDeleteValueW
SHEnumKeyExA
SHEnumKeyExW
SHEnumValueA
SHEnumValueW
SHGetThreadRef
SHGetValueA
SHGetValueW
SHOpenRegStream2A
SHOpenRegStream2W
SHOpenRegStreamA
SHOpenRegStreamW
SHQueryInfoKeyA
SHQueryInfoKeyW
SHQueryValueExA
SHQueryValueExW
SHRegDuplicateHKey
SHRegGetIntW
SHRegGetPathA
SHRegGetPathW
SHRegGetValueA
SHRegGetValueFromHKCUHKLM
SHRegGetValueW
SHRegSetPathA
SHRegSetPathW
SHReleaseThreadRef
SHSetThreadRef
SHSetValueA
SHSetValueW
SHStrDupA
SHStrDupW
SHUnicodeToAnsi
SHUnicodeToUnicode
SetCurrentProcessExplicitAppUserModelID
SetProcessDpiAwareness
SetProcessReference
UnregisterScaleChangeEvent

Sections

.text
Size: 413KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 9B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

minATL
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9761ec67777fc378d4a62bcf5dcb7e48

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

ec:aa:53:2e:09:cc:2e:dd:48:36:c1:f0:7c:64:e1:1a:55:aa:dd:34:ac:2f:4f:94:0f:d7:7d:af:54:6a:22:84Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

combase

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 413KB - Virtual size: 413KB

.data Size: 2KB - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 8KB

.tls Size: - Virtual size: 9B

minATL Size: 512B - Virtual size: 48B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 25KB - Virtual size: 25KB

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

ec:aa:53:2e:09:cc:2e:dd:48:36:c1:f0:7c:64:e1:1a:55:aa:dd:34:ac:2f:4f:94:0f:d7:7d:af:54:6a:22:84
Signer

.text
Size: 413KB - Virtual size: 413KB

.data
Size: 2KB - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 8KB

.tls
Size: - Virtual size: 9B

minATL
Size: 512B - Virtual size: 48B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 25KB - Virtual size: 25KB