WsmAgent[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

WsmAgent.dll
Size

24KB
MD5

d26500cbc34d5b6c9641e6427ed3e8e2
SHA1

d8cfd8c856cfc11a9a79d4fa8200ae3b7fb54ac7
SHA256

ffba68ca72b3105562fdafd32ae4ecbbc84f3d587afa5a397b6915a03eaee102
SHA512

5a90ab8f75bac21b2beaf36cba8a7cb9334a24370be15e0e6ede151e32d7bc6e9fc968dff3a9d5ca193812dda1fcfc04f1cfb9a025aa00aeb34e81d2848d1d2e
SSDEEP

384:dh7SrcIvtLMTQPJNCpFamXegGypUOwtG/Dgaw7eDnHwaHMoPYWkLhWqdo5:dM6qCmf+yMpP6Xo5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WsmAgent.dll

Files

WsmAgent.dll
.dll regsvr32 windows:6 windows x86 arch:x86

103d5e3e92a70e6b6373c367841e9f68

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

wsmagent.pdb

Imports

msvcrt

_except_handler4_common
swprintf_s
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_purecall
malloc
free
_onexit
__CxxFrameHandler3
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadLibraryExW
FreeLibrary
GetProcAddress

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids
GetTraceEnableLevel

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
OpenThreadToken
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetCurrentThread

api-ms-win-security-base-l1-2-0

CheckTokenMembership

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

wsmsvc

?Alloc@WSManMemory@@SGPAXIHW4_NitsFaultMode@@@Z
??1CWSManCriticalSection@@QAE@XZ
?GetSid@CSecurity@@SGPAXXZ
??1?$AutoDelete@U_SID@@@@QAE@XZ
??1AutoImpersonateUser@@QAE@XZ
??0?$AutoDelete@U_SID@@@@QAE@PAU_SID@@@Z
?Free@WSManMemory@@SGXPAXH@Z
?BeginRevertToSelf@CSecurity@@SGHPAPAXK@Z
??0AutoImpersonateUser@@QAE@XZ
?StringIsBlank@@YGHPBG@Z
?IsLocalSystemSid@CSecurity@@SGHPAX@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

??1CWSManCriticalSectionWithConditionVar@@QAE@XZ
?GetInitError@CWSManCriticalSection@@QBEKXZ
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

103d5e3e92a70e6b6373c367841e9f68

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

wsmsvc

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 16KB - Virtual size: 15KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB