DeviceCenter[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

DeviceCenter.dll
Size

471KB
MD5

9c98f1732b13c92ac5af3d09a4f93002
SHA1

9fcc2a655b7f53b1b2d33afe57a9b2ba3e6a5026
SHA256

b1a7b78b139fa65a75294deb1af7bc30e5007c93397b7ba6774dd3c9e56f5448
SHA512

84badc5661191f3397dce1c08bcaed19d859c11adaabe7a995c290596c2d97b10eaa36ade0ef7b8413c06a0543bcc7b9d3f891cea060f06b9276aaa2847f85be
SSDEEP

6144:2OIWRvKfp+RdWtxq/7OVcxrVznEz12zYyH6C4NQFnIx1Ka:2OZRvo+R41GrVbMkUdZN6Iv5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DeviceCenter.dll

Files

DeviceCenter.dll
.dll windows:6 windows x86 arch:x86

8c3188bef0925b5d76fa049c9ea05dbc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DeviceCenter.pdb

Imports

msvcrt

memcpy
_except_handler4_common
__CxxFrameHandler3
realloc
_errno
wcsncpy_s
memcmp
__dllonexit
_XcptFilter
_amsg_exit
_initterm
_lock
_onexit
memset
wcsncmp
wcstok_s
_wcsicmp
wcsstr
_vsnwprintf
memcpy_s
free
malloc
_unlock

advapi32

RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
EventUnregister
EventRegister
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
EventEnabled
EventWrite
TraceMessage

gdi32

DeleteObject
SelectObject
CreateCompatibleDC
DeleteDC
CreateDIBSection

kernel32

Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
CompareStringOrdinal
ResetEvent
WaitForSingleObject
GetCurrentThreadId
LocalAlloc
CreateThread
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
lstrcmpiW
GetModuleHandleW
FreeLibrary
LocalFree
WaitForMultipleObjects
SetEvent
CloseHandle
AcquireSRWLockExclusive
FindResourceW
LockResource
lstrlenW
LoadLibraryW
FormatMessageW
GetLocaleInfoW
SleepConditionVariableSRW
WakeConditionVariable
ReleaseSRWLockExclusive
GetTickCount64
ExpandEnvironmentStringsW
LoadLibraryExW
GetProcAddress
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
DisableThreadLibraryCalls
InitializeSRWLock
DeleteCriticalSection
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
CreateEventW
InitializeConditionVariable

ntdll

WinSqmIncrementDWORD
WinSqmSetDWORD
WinSqmAddToStream
WinSqmAddToStreamEx
WinSqmIsOptedIn

ole32

CoWaitForMultipleHandles
CoGetApartmentType
PropVariantCopy
PropVariantClear
StringFromGUID2
CoTaskMemRealloc
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoGetMalloc
CoTaskMemAlloc

oleaut32

SafeArrayGetElement
SysFreeString
VarUI4FromStr
VariantInit
SysAllocString
VariantClear

shell32

ord893
DuplicateIcon
SHCreateItemFromIDList
SHCreateShellItemArrayFromDataObject
ord16
SHCreateShellItemArrayFromIDLists
SHChangeNotify
SHGetDesktopFolder
ShellExecuteExW
SHGetIconOverlayIndexW
SHCreateDefaultExtractIcon
SHCreateDataObject
AssocCreateForClasses
SHGetIDListFromObject
SHCreateDefaultContextMenu
ord256
SHBindToFolderIDListParent
ord19
ord25
ord155
ShellExecuteW
ord100
ord18
ord702
ord763
SHBindToParent
SHBindToFolderIDListParentEx
ord819
ord153
ord727
ord77

shlwapi

ord219
SHStrDupW
PathParseIconLocationW
StrToIntW
ord176
ord158
ord199
ord615
UrlUnescapeW
UrlEscapeW
StrChrW
ord384
ord619
ord476
ord344
ord215
ord12
ord184
ord213
StrRetToBufW
StrPBrkW
ord197
ord16

user32

GetSystemMetrics
GetMenuInfo
SetMenuInfo
GetDC
ReleaseDC
BeginDeferWindowPos
MapWindowPoints
DeferWindowPos
EndDeferWindowPos
UnregisterClassA
ScreenToClient
GetWindowRect
SendMessageW
PostMessageW
GetDlgItem
EnableWindow
SetDlgItemTextW
SetWindowLongW
GetParent
DestroyIcon
DestroyMenu
RemoveMenu
GetSubMenu
LoadMenuW
LoadStringW
GetForegroundWindow
CharNextW
SetMenuItemInfoW

comctl32

ord381
ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
HIMAGELIST_QueryInterface
ord386
ord334
CreatePropertySheetPageW
DestroyPropertySheetPage
ord332
ord329
ord328

propsys

PSCreateMemoryPropertyStore
PSPropertyBag_WriteStr
PSPropertyBag_WriteDWORD
PropVariantCompareEx
PropVariantToString
PSGetPropertyDescription
InitPropVariantFromResource
PropVariantToVariant
PropVariantChangeType
PSPropertyBag_ReadBOOL
ord408
ord417
PropVariantToStringAlloc
InitPropVariantFromStringAsVector
PSGetPropertyFromPropertyStorage
VariantCompare

dui70

UnInitProcessPriv
UnInitThread
InitThread
InitProcessPriv

cfgmgr32

DevCloseObjectQuery
DevCreateObjectQuery
DevFreeObjectProperties
DevGetObjectProperties

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 333KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8c3188bef0925b5d76fa049c9ea05dbc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

gdi32

kernel32

ntdll

ole32

oleaut32

shell32

shlwapi

user32

comctl32

propsys

dui70

cfgmgr32

Exports

Exports

Sections

.text Size: 111KB - Virtual size: 111KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 333KB - Virtual size: 332KB

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 111KB - Virtual size: 111KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 333KB - Virtual size: 332KB

.reloc
Size: 19KB - Virtual size: 18KB