IdCtrls[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

IdCtrls.dll
Size

92KB
MD5

9e6fdde34f190f08d7925d8ffb1cc2eb
SHA1

055abe1bb529d94ca735302091d5cd4ca8fb66e5
SHA256

b1256079e0056222c44c64e480b25eb392b4694ecfa95e37dca4d097881487bf
SHA512

5b0c2fa61fca20c916343e1ca366dce458f206ace4b6f8807c01e1d290767a42c1ca45307a713c4f8f34f63cbe4479e6af77e35324fbdd98695f5a24add7f6c9
SSDEEP

1536:iKJYdVplneIBMP2UhIvBprDu9bX93QR9MQHCt1cHfiP+aZ6yTh0L83aJ/YV1yA2s:MVplneCaIvryXFQR9S1ufiWa1mVMAz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IdCtrls.dll

Files

IdCtrls.dll
.dll windows:10 windows x86 arch:x86

c438053dc239ddc55933d49ed696be90

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

IdCtrls.pdb

Imports

msvcrt

_vsnwprintf
memmove
__CxxFrameHandler3
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
wcsrchr
wcschr
wcsstr
_purecall
_get_errno
_set_errno
_callnewh
memcpy_s
memcpy
memset

shlwapi

ord172
ord487
ord199
ord165
SHStrDupW
ord437
StrChrW
ord204
ord176
UrlEscapeW
ord219

api-ms-win-core-libraryloader-l1-2-0

LoadResource
LockResource
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetModuleFileNameA
FindResourceExW
LoadLibraryExW

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
ReleaseMutex
CreateEventW
LeaveCriticalSection
WaitForSingleObjectEx
SetEvent
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
ResetEvent
WaitForMultipleObjectsEx
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetGeoInfoW
GetUserGeoID
GetThreadPreferredUILanguages

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-com-l1-1-0

CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
CoWaitForMultipleHandles
CoCreateInstance
PropVariantClear
StringFromGUID2
CoGetMalloc
CoGetInterfaceAndReleaseStream
CoGetApartmentType
CoTaskMemAlloc
CoTaskMemRealloc

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventUnregister
EventRegister

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
Sleep
InitOnceComplete

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlGetSuiteMask
NtPowerInformation
WinSqmAddToStream

wininet

InternetCrackUrlW

dui70

InitThread
?Create@TouchHWNDElement@DirectUI@@SGJPAUHWND__@@_NIPAVElement@2@PAKPAPAV42@@Z
?Create@FillLayout@DirectUI@@SGJPAPAVLayout@2@@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?Destroy@Element@DirectUI@@QAEJ_N@Z
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?SetAccRole@Element@DirectUI@@QAEJH@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?SetBackgroundColor@Element@DirectUI@@QAEJK@Z
?SetHeight@Element@DirectUI@@QAEJH@Z
?SetWidth@Element@DirectUI@@QAEJH@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
CreateTouchTooltip
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
StrToID
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
UnInitProcessPriv
InitProcessPriv
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?EndDefer@Element@DirectUI@@QAEXK@Z
UnInitThread

gdi32

DeleteObject
CreateSolidBrush

user32

GetParent
CreateWindowExW
SetWindowPos
DestroyWindow
KillTimer
GetFocus
LoadCursorW
GetClientRect
MsgWaitForMultipleObjectsEx
PeekMessageW
UpdateWindow
PostQuitMessage
IsWindowVisible
TranslateMessage
EnableWindow
SetWindowLongW
SetCursor
IsWindowUnicode
DefWindowProcW
DefWindowProcA
ShowWindow
SetTimer
DispatchMessageW
RegisterClassW
SetFocus
GetKeyState
GetWindowLongW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c438053dc239ddc55933d49ed696be90

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shlwapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-profile-l1-1-0

ntdll

wininet

dui70

gdi32

user32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 67KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 172B

.rsrc Size: 11KB - Virtual size: 10KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 68KB - Virtual size: 67KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 172B

.rsrc
Size: 11KB - Virtual size: 10KB

.reloc
Size: 4KB - Virtual size: 4KB