SHCore[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SHCore.dll
Size

533KB
MD5

c6a5a346568265d22412f9f3c4603537
SHA1

bada9f9827e49610ac79c16326a7ff52370e3ba8
SHA256

564aff92071b53281da4466fa742229e4356b9ef54e575ea99e62211430fbb34
SHA512

2b8747e68edc50195b0940d745d08b998925f9c18236a300f870ab3026b798a2b38e3eb0edfc40d26ae1b91a9b4af5640254d7ba7dd48d3a7072ca6ebef5565a
SSDEEP

12288:mwRx8P44ozFbLWI/9cYC9D+C71Ety9UKzpIIgA6BoUD94PXOpVDznSPBLJi2j6ce:mwROw4oItjPgD9SPhNPpxv/p6dVy+

Score

1^/10

Malware Config

Signatures

Files

SHCore.dll
.dll windows:10 windows x86 arch:x86

0ddcdd6020d74ca7555fb0d07cfd262b

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f0:fd:0f:f4:62:c5:c7:5f:47:4c:d2:59:52:b3:1b:26:69:44:f9:6e:d2:74:42:aa:af:5d:c8:67:31:04:9d:20
Signer

Actual PE Digest

f0:fd:0f:f4:62:c5:c7:5f:47:4c:d2:59:52:b3:1b:26:69:44:f9:6e:d2:74:42:aa:af:5d:c8:67:31:04:9d:20

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

shcore.pdb

Imports

msvcrt

_callnewh
__CxxFrameHandler3
_ftol2
_vsnwprintf
_ftol2_sse
memcmp
memcpy
memmove
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
_purecall
memcpy_s
floor
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadLibraryExW
DisableThreadLibraryCalls
FreeLibraryAndExitThread
FindResourceExW
GetModuleHandleExW
GetModuleFileNameA
LoadResource
FreeLibrary
GetModuleFileNameW
GetProcAddress
SizeofResource
LockResource

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
OpenSemaphoreW
ReleaseSRWLockShared
ReleaseMutex
InitializeCriticalSectionEx
SetEvent
CreateMutexExW
WaitForSingleObject
InitializeSRWLock
CreateMutexW
WaitForSingleObjectEx
ReleaseSemaphore
OpenEventW
AcquireSRWLockShared
LeaveCriticalSection
CreateSemaphoreExW
TryAcquireSRWLockExclusive
InitializeCriticalSection
WaitForMultipleObjectsEx
CreateEventW
EnterCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
CreateEventExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventProviderEnabled
EventWriteTransfer
EventRegister

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
SetThreadPriority
OpenProcessToken
GetThreadPriority
TlsAlloc
CreateThread
OpenThreadToken
GetCurrentThreadId
GetProcessId
TlsFree
ResumeThread
TerminateProcess
GetStartupInfoW
GetCurrentThread
GetCurrentProcessId
TlsSetValue
TlsGetValue

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
TrySubmitThreadpoolCallback
DisassociateCurrentThreadFromCallback
SetThreadpoolTimer
FreeLibraryWhenCallbackReturns
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolTimer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalReAlloc
LocalAlloc

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNIW
StrChrW
StrCmpICW
QISearch
StrDupW
StrToIntW
StrDupA
StrCmpNICW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegEnumKeyExW
RegDeleteKeyExW
RegSetValueExA
RegQueryInfoKeyW
RegEnumValueA
RegQueryInfoKeyA
RegDeleteKeyExA
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegEnumValueW
RegDeleteValueA
RegDeleteValueW
RegCreateKeyExA
RegEnumKeyExA
RegCloseKey
RegCreateKeyExW

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
GetTokenInformation
RevertToSelf
AdjustTokenPrivileges
CheckTokenMembership

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
MapViewOfFile

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-file-l1-1-0

GetFileInformationByHandle
GetFileAttributesExW
GetFileSizeEx
WriteFile
CreateDirectoryW
FlushFileBuffers
CreateFileW
ReadFile
GetDriveTypeW
SetFilePointer
GetVolumeInformationByHandleW
LockFileEx
SetEndOfFile
SetFilePointerEx
UnlockFileEx
SetFileInformationByHandle
GetFileAttributesW
DeleteFileW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsUNCW
PathUnExpandEnvStringsA
PathGetDriveNumberW
PathUnExpandEnvStringsW
PathIsRelativeW
PathRemoveFileSpecW
PathCombineW
PathFindFileNameW
PathFindExtensionW
PathFileExistsW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsA
ExpandEnvironmentStringsW

api-ms-win-core-sysinfo-l1-2-0

GetOsSafeBootMode

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-largeinteger-l1-1-0

MulDiv

ntdll

_vsnprintf_s
wcsncmp
wcschr
wcsrchr
RtlAreLongPathsEnabled
toupper
RtlWakeAllConditionVariable
RtlSleepConditionVariableSRW
NtQuerySystemInformation
memmove_s
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtQueryInformationProcess
NtCreateFile
RtlInitUnicodeString
RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult
CancelIoEx

api-ms-win-core-file-l2-1-0

ReplaceFileW
GetFileInformationByHandleEx

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem
DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-atoms-l1-1-0

GlobalAddAtomExW
GlobalGetAtomNameW
GlobalDeleteAtom

api-ms-win-core-path-l1-1-0

PathCchAddBackslashEx

combase

ord134

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CommandLineToArgvW
CreateRandomAccessStreamOnFile
CreateRandomAccessStreamOverStream
CreateStreamOverRandomAccessStream
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetCurrentProcessExplicitAppUserModelID
GetDpiForMonitor
GetDpiForShellUIComponent
GetFeatureEnabledState
GetFeatureVariant
GetProcessDpiAwareness
GetProcessReference
GetScaleFactorForDevice
GetScaleFactorForMonitor
IStream_Copy
IStream_Read
IStream_ReadStr
IStream_Reset
IStream_Size
IStream_Write
IStream_WriteStr
IUnknown_AtomicRelease
IUnknown_GetSite
IUnknown_QueryService
IUnknown_Set
IUnknown_SetSite
IsOS
IsProcessInIsolatedContainer
IsProcessInWDAGContainer
RecordFeatureError
RecordFeatureUsage
RegisterScaleChangeEvent
RegisterScaleChangeNotifications
RevokeScaleChangeNotifications
SHAnsiToAnsi
SHAnsiToUnicode
SHCopyKeyA
SHCopyKeyW
SHCreateMemStream
SHCreateStreamOnFileA
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
SHCreateThread
SHCreateThreadRef
SHCreateThreadWithHandle
SHDeleteEmptyKeyA
SHDeleteEmptyKeyW
SHDeleteKeyA
SHDeleteKeyW
SHDeleteValueA
SHDeleteValueW
SHEnumKeyExA
SHEnumKeyExW
SHEnumValueA
SHEnumValueW
SHGetThreadRef
SHGetValueA
SHGetValueW
SHOpenRegStream2A
SHOpenRegStream2W
SHOpenRegStreamA
SHOpenRegStreamW
SHQueryInfoKeyA
SHQueryInfoKeyW
SHQueryValueExA
SHQueryValueExW
SHRegDuplicateHKey
SHRegGetIntW
SHRegGetPathA
SHRegGetPathW
SHRegGetValueA
SHRegGetValueFromHKCUHKLM
SHRegGetValueW
SHRegSetPathA
SHRegSetPathW
SHReleaseThreadRef
SHSetThreadRef
SHSetValueA
SHSetValueW
SHStrDupA
SHStrDupW
SHTaskPoolAllowThreadReuse
SHTaskPoolDoNotWaitForMoreTasks
SHTaskPoolGetCurrentThreadLifetime
SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask
SHTaskPoolSetThreadReuseAllowed
SHUnicodeToAnsi
SHUnicodeToUnicode
SetCurrentProcessExplicitAppUserModelID
SetProcessDpiAwareness
SetProcessReference
SubscribeFeatureStateChangeNotification
UnregisterScaleChangeEvent
UnsubscribeFeatureStateChangeNotification

Sections

.text
Size: 472KB - Virtual size: 472KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0ddcdd6020d74ca7555fb0d07cfd262b

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

f0:fd:0f:f4:62:c5:c7:5f:47:4c:d2:59:52:b3:1b:26:69:44:f9:6e:d2:74:42:aa:af:5d:c8:67:31:04:9d:20Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-largeinteger-l1-1-0

ntdll

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-version-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-path-l1-1-0

combase

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 472KB - Virtual size: 472KB

.data Size: 1024B - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 1024B - Virtual size: 516B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 32KB - Virtual size: 32KB

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

f0:fd:0f:f4:62:c5:c7:5f:47:4c:d2:59:52:b3:1b:26:69:44:f9:6e:d2:74:42:aa:af:5d:c8:67:31:04:9d:20
Signer

.text
Size: 472KB - Virtual size: 472KB

.data
Size: 1024B - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 1024B - Virtual size: 516B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 32KB - Virtual size: 32KB