InkEd[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

InkEd.dll
Size

227KB
MD5

85cbcc3dd971cd914da5230be5448ebc
SHA1

80decf3675c3f4cd18527ade5f95d0f81e810d5e
SHA256

d299be8914a3f4369585412c1dd7c62decb2590df514e639f835f2d9abf4ddd9
SHA512

4eb2b9bdc75a5b32445a7fee8c7b9e4b70c0f0551d2ef4f74f89b91de38c468494391035a78627586a6115df3b27d3a21abfb3b8a40d175ecc40f6902609745f
SSDEEP

3072:0K7HH+WCl9Rc0AId+EmggLSo10dUE52Dsu5Yuxkd/p7xI4m2pXcKDagleBiSKSn0:XDzAXQEmnH14smN6qH0Sr23zJYnbzoI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InkEd.dll

Files

InkEd.dll
.dll regsvr32 windows:10 windows x86 arch:x86

cd15dfd0002e04f5e249aa1eeff3f62f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

InkEd.pdb

Imports

msvcrt

_ftol2_sse
__CxxFrameHandler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
free
_purecall
wcscat_s
wcscpy_s
realloc
memcmp
memset

oleaut32

OleTranslateColor
SysReAllocStringLen
VariantClear
OleCreatePictureIndirect
SysAllocStringByteLen
SysAllocStringLen
SysStringByteLen
SafeArrayCopy
VariantChangeType
OleCreateFontIndirect
VariantInit
OleLoadPicture
SysStringLen
SafeArrayAccessData
SafeArrayCreate
SafeArrayUnaccessData
DispCallFunc
SafeArrayPutElement
LoadRegTypeLi
SafeArrayGetVartype
OleCreatePropertyFrame
SafeArrayGetLBound
SysAllocString
SafeArrayGetElement
LoadTypeLi
SafeArrayGetUBound
SafeArrayCreateVector
RegisterTypeLi
SafeArrayDestroy
SysFreeString
VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
SizeofResource
LoadLibraryExA
DisableThreadLibraryCalls
FindResourceExW
LoadResource
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegEnumValueW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualProtect
VirtualQuery
VirtualAlloc

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSection
ReleaseSRWLockExclusive
DeleteCriticalSection
AcquireSRWLockExclusive
EnterCriticalSection

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemAlloc
GetHGlobalFromStream
CoTaskMemRealloc

api-ms-win-core-string-l2-1-0

CharPrevW
CharNextW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount
GetSystemInfo

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapDestroy
HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

GetUserDefaultLangID

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
FlushInstructionCache

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

gdi32

SetViewportExtEx
CreateEnhMetaFileW
CreateCompatibleBitmap
SetViewportOrgEx
DeleteObject
RestoreDC
LPtoDP
SetMapMode
SetWindowExtEx
CreateSolidBrush
CreateRectRgnIndirect
GetMapMode
GetObjectType
SaveDC
GetClipBox
CreateDCW
SetWindowOrgEx
GetDeviceCaps
CloseEnhMetaFile
StretchBlt
PatBlt
CreateCompatibleDC
DeleteDC
SelectObject

kernel32

GlobalLock
GlobalUnlock
lstrcpynW
lstrcmpiW
lstrcpyW

ole32

CreateILockBytesOnHGlobal
CreateDataAdviseHolder
CreateOleAdviseHolder
OleRegEnumVerbs
OleRegGetUserType
StgCreateDocfileOnILockBytes
OleRegGetMiscStatus

user32

DestroyWindow
GetFocus
CallWindowProcW
UnionRect
GetKeyState
DefWindowProcW
GetWindowLongW
ShowWindow
IsWindow
GetDoubleClickTime
RegisterClassW
DestroyAcceleratorTable
GetClassInfoW
RegisterClassExW
UnregisterClassW
GetSystemMetrics
SendMessageW
EnableWindow
UpdateWindow
GetParent
GetClassInfoExW
SetRect
GetClientRect
wsprintfW
SetParent
LoadCursorW
KillTimer
TranslateMessage
IsChild
SetFocus
IntersectRect
GetSysColor
ValidateRect
WindowFromDC
DispatchMessageW
OffsetRect
MessageBeep
CreateWindowExW
FillRect
SetWindowLongW
SetWindowRgn
EqualRect
SetWindowPos
IsWindowVisible
InflateRect
GetCursorPos
ShowCursor
ReleaseCapture
GetMessageExtraInfo
PtInRect
PostMessageW
InvalidateRect
ScreenToClient
GetDC
GetCapture
SetTimer
GetCursorInfo
ReleaseDC
SetCapture
IsWindowEnabled

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cd15dfd0002e04f5e249aa1eeff3f62f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

gdi32

kernel32

ole32

user32

Exports

Exports

Sections

.text Size: 107KB - Virtual size: 106KB

.data Size: 1KB - Virtual size: 2KB

.idata Size: 7KB - Virtual size: 6KB

.rsrc Size: 102KB - Virtual size: 102KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 107KB - Virtual size: 106KB

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 102KB - Virtual size: 102KB

.reloc
Size: 8KB - Virtual size: 7KB