NPSM[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NPSM.dll
Size

144KB
MD5

5ac20a4f59d5be6ce5cc25e33277d8e9
SHA1

d8e37ebef356b40ed7bfe47be66e979af9382875
SHA256

e1dde7ad3c9079d9ebef415fe15ebb74d904100cc0d420550750618c1a9a5e0c
SHA512

9abc1e748ac1d08d2de51bbec3e5344307748e198e758979c090c22fcc068eb82aea6ca43e1b45d84eaef84c60c71a19cfb2cf064d9bf1e050c9fea5585f435d
SSDEEP

3072:S+tK+N+0BwQhMnV7cybl8pzrSzTGay0gvIyfmm0+3KDzCe:S+tKO0vuzrV0W5OtD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NPSM.dll

Files

NPSM.dll
.dll windows:10 windows x86 arch:x86

083a2e927c9470fb98af463069100eb3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

NPSM.pdb

Imports

msvcrt

?terminate@@YAXXZ
_onexit
__dllonexit
_except_handler4_common
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
_unlock
_lock
_initterm
memcpy
malloc
free
memmove
_amsg_exit
_XcptFilter
_callnewh
??1type_info@@UAE@XZ
__CxxFrameHandler3
_CxxThrowException
??3@YAXPAX@Z
??0exception@@QAE@ABQBD@Z
_purecall
_vsnwprintf
??_V@YAXPAX@Z
memcpy_s
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
difftime
time
wcschr
memset

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
WaitOnAddress
WakeByAddressAll
InitOnceExecuteOnce
Sleep

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-eventing-obsolete-l1-1-0

RegisterTraceGuidsA

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
UnregisterTraceGuids
TraceMessage
GetTraceEnableLevel
GetTraceEnableFlags

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW
RoTransformError

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
AcquireSRWLockShared
CreateEventW
ReleaseSRWLockShared
CreateSemaphoreExW
WaitForSingleObject
CreateMutexExW
ReleaseMutex
SetEvent
OpenSemaphoreW
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
WaitForSingleObjectEx
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleW
GetProcAddress
GetModuleFileNameA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
ProcessIdToSessionId
GetCurrentProcess
GetProcessId
TerminateProcess
OpenProcessToken
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-com-l1-1-0

CoIncrementMTAUsage
CoCancelCall
CoEnableCallCancellation
CoDisableCallCancellation
CoGetCallContext
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoTaskMemAlloc
CoGetMalloc
CLSIDFromString
CoRevertToSelf
CoImpersonateClient
CoSetProxyBlanket
CoTaskMemFree
CoDecrementMTAUsage
CoUninitialize
CoDisconnectContext
CoResumeClassObjects
CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx

ntdll

RtlFreeHeap
NtQueryInformationToken
RtlInitUnicodeString
RtlEqualSid
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlQueryPackageClaims
RtlPublishWnfStateData

api-ms-win-core-winrt-l1-1-0

RoRevokeActivationFactories
RoRegisterActivationFactories
RoGetActivationFactory

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventActivityIdControl
EventWriteTransfer

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks

api-ms-win-core-featurestaging-l1-1-0

UnsubscribeFeatureStateChangeNotification
RecordFeatureUsage
SubscribeFeatureStateChangeNotification
GetFeatureEnabledState

api-ms-win-core-processthreads-l1-1-1

OpenProcess

rpcrt4

I_RpcBindingInqLocalClientPID

api-ms-win-security-base-l1-1-0

GetTokenInformation
GetLengthSid
CopySid

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-shcore-thread-l1-1-0

SHCreateThread

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

combase

ord68
ord66
ord67

propsys

PSCreateMemoryPropertyStore

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
RegisterNowPlayingSessionManagerFactory
ServiceMain
SvchostPushServiceGlobals
UnregisterNowPlayingSessionManagerFactory

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

083a2e927c9470fb98af463069100eb3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-eventing-obsolete-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

ntdll

api-ms-win-core-winrt-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-processthreads-l1-1-1

rpcrt4

api-ms-win-security-base-l1-1-0

api-ms-win-security-capability-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-heap-l2-1-0

combase

propsys

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 123KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 64B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 124KB - Virtual size: 123KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 64B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB