aeinv[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aeinv.dll
Size

824KB
MD5

fc3e00dec49ac30c9458ba7b37ae7e6e
SHA1

e9c7adc1ceb2e57adccfaf439f7c5d729c20f4be
SHA256

49f9764ce5ae07071b26b2c0ec4909df69a19e6c275bf7dbdf98d4ec1a8ed9ed
SHA512

66dd665346065776e4a5d6236c09589330b6f0ed7798f261132b6c92890ed908aab4244ba80732de5463c3c1eb17dc2eafd207876b9a25d4937da954f982aca6
SSDEEP

12288:2TmVDOa2/F1mLwthlKkHG4G3iUGOVECjydx8UnXWapPZP5g08E4:2TmVa3AQGWaNICjyVXWatZP5g08P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aeinv.dll

Files

aeinv.dll
.dll windows:10 windows x64 arch:x64

eb6fa8ad01b9ec212d88e5e677ca77e5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

aeinv.pdb

Imports

msvcrt

wcscmp
wcstok_s
fgetc
wcstoul
_wsplitpath_s
strnlen
_wtoi64
towlower
fgetwc
fputwc
wcstombs
realloc
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
ungetc
_vsnwprintf_s
_vscwprintf
_wtoi
ungetwc
iscntrl
fflush
setvbuf
fsetpos
isspace
_fseeki64
fgetpos
tolower
_mktime64
_wctime64
strncmp
toupper
wcsncmp
wcsstr
_wcslwr
wcscat_s
wcscpy_s
wcsrchr
wcschr
strcpy_s
_vsnprintf
__mb_cur_max
fwrite
fclose
isdigit
setlocale
___mb_cur_max_func
___lc_handle_func
___lc_codepage_func
_ismbblead
__pctype_func
calloc
__uncaught_exception
___lc_collate_cp_func
memcmp
fseek
_wfsopen
abort
iswalpha
wcsspn
memset
_wcsdup
strcmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_wsetlocale
__crtLCMapStringW
__crtCompareStringW
??0bad_cast@@QEAA@AEBV0@@Z
_unlock
_lock
?terminate@@YAXXZ
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_wcsicmp
_wcsnicmp
?what@exception@@UEBAPEBDXZ
strchr
_set_errno
strtol
_errno
strncpy_s
sprintf_s
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
memcpy_s
_vsnwprintf
__CxxFrameHandler3

ntdll

ZwEnumerateKey
EtwTraceMessage
NtQueryLicenseValue
RtlGetVersion
RtlReleaseRelativeName
NtLoadKeyEx
RtlDosPathNameToRelativeNtPathName_U
RtlStringFromGUID
RtlRandomEx
NtQueryKey
RtlFreeSid
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlAdjustPrivilege
RtlImageDirectoryEntryToData
RtlVerifyVersionInfo
LdrResSearchResource
RtlTimeToTimeFields
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwQuerySystemInformation
RtlGetNativeSystemInformation
RtlNtPathNameToDosPathName
RtlpEnsureBufferSize
ZwQueryDirectoryFile
RtlUnicodeStringToAnsiString
RtlUpcaseUnicodeString
RtlAnsiStringToUnicodeString
RtlxAnsiStringToUnicodeSize
RtlInitString
EtwEventRegister
EtwEventWrite
EtwEventUnregister
RtlSecondsSince1970ToTime
ZwSetInformationProcess
ZwQueryInformationProcess
ZwCreateSection
ZwQueryInformationFile
ZwCreateFile
RtlFormatCurrentUserKeyPath
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwQueryValueKey
RtlInitUnicodeStringEx
RtlUpcaseUnicodeChar
ZwOpenKey
RtlFreeUnicodeString
ZwOpenFile
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U_WithStatus
ZwClose
RtlLeaveCriticalSection
RtlFreeHeap
RtlInitializeCriticalSection
RtlMultiByteToUnicodeN
RtlComputeCrc32
RtlCompareMemory
RtlInitAnsiString
RtlEnterCriticalSection
RtlReAllocateHeap
RtlEqualString
RtlRunOnceExecuteOnce
RtlCopyUnicodeString
RtlAllocateHeap
RtlDeleteCriticalSection
VerSetConditionMask
WinSqmIsOptedInEx
EtwEventWriteNoRegistration
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

advapi32

EventUnregister
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
RegDeleteKeyValueW
RegOpenKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteTreeW
RegSaveKeyExW
RegCreateKeyExW
RegSetKeyValueW
RegDeleteKeyExW
RegLoadAppKeyW
RegFlushKey
RegDeleteKeyW
RegEnumKeyExW
RegLoadKeyW
RegUnLoadKeyW
SetSecurityDescriptorOwner
ConvertSidToStringSidW
GetTokenInformation
TraceEvent
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
EventWriteTransfer
RegGetValueW
EventRegister
CryptReleaseContext

ole32

CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoUninitialize

kernel32

HeapFree
GetCurrentThreadId
FormatMessageW
HeapAlloc
GetProcessHeap
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetThreadpoolTimer
IsDebuggerPresent
CloseHandle
GetLastError
SetLastError
GetTickCount
QueryThreadCycleTime
GetCurrentThread
FreeLibrary
GetProcAddress
GetModuleHandleExW
VerifyVersionInfoW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetSystemPowerStatus
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForSingleObject
WriteFile
LocalFree
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
OutputDebugStringA
GetModuleFileNameW
CreateFileW
GetModuleHandleExA
DebugBreak
LoadLibraryExW
GetFileAttributesW
GetSystemWindowsDirectoryW
DeleteCriticalSection
InitializeCriticalSectionEx
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
CreateMutexW
ReleaseMutex
GetTempPathW
GetTempFileNameW
GetModuleFileNameA
GetModuleHandleW
GetCommandLineW
MoveFileExW
OutputDebugStringW
LeaveCriticalSection
GetLongPathNameW
LocalAlloc
GetCurrentDirectoryW
GetDriveTypeW
GetSystemInfo
CreateEventW
GetFileTime
DeviceIoControl
GetVolumeInformationByHandleW
HeapReAlloc
RaiseException
LocaleNameToLCID
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
GetSystemDirectoryW
SetWaitableTimer
CreateWaitableTimerW
WaitForMultipleObjects
OpenWaitableTimerW
SetEvent
CreateSemaphoreW
GetSystemFirmwareTable
CreateActCtxW
QueryActCtxW
ReleaseActCtx
LoadLibraryW
GetLogicalDriveStringsW
QueryDosDeviceW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
K32EnumProcesses
OpenProcess
QueryFullProcessImageNameW
LoadLibraryExA
DelayLoadFailureHook
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
WakeAllConditionVariable
SleepConditionVariableSRW
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitOnceExecuteOnce
EnterCriticalSection

oleaut32

SysAllocString
VariantCopy
SysStringLen
VariantChangeType
VariantInit
VariantClear
SysFreeString

rpcrt4

UuidCreate

wintrust

CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminReleaseCatalogContext

bcrypt

BCryptGetProperty
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider

crypt32

CertGetNameStringW
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext

msi

ord141
ord217
ord8
ord113
ord32
ord159
ord166
ord115
ord118
ord248
ord173
ord160
ord92

shlwapi

PathFindFileNameW
PathFileExistsW
SHCreateStreamOnFileEx
PathUnExpandEnvStringsW
ord487
PathIsNetworkPathW
PathCommonPrefixW

shell32

SHGetKnownFolderPath
SHGetFolderPathW
CommandLineToArgvW
SHCreateItemFromIDList

xmllite

CreateXmlReader

Exports

Exports

CreateAppxPackageInventory
CreateAppxPackageInventoryExtracted
CreateSoftwareInventory
GetAppInfo
GetAppInventory
GetCachedAppInventory
GetDetailedAppInventory
GetDetailedAppInventoryFile
UpdateSoftwareInventoryW

Sections

.text
Size: 544KB - Virtual size: 540KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 228KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb6fa8ad01b9ec212d88e5e677ca77e5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

advapi32

ole32

kernel32

oleaut32

rpcrt4

wintrust

bcrypt

crypt32

msi

shlwapi

shell32

xmllite

Exports

Exports

Sections

.text Size: 544KB - Virtual size: 540KB

.rdata Size: 228KB - Virtual size: 225KB

.data Size: 8KB - Virtual size: 14KB

.pdata Size: 28KB - Virtual size: 24KB

.didat Size: 4KB - Virtual size: 72B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 544KB - Virtual size: 540KB

.rdata
Size: 228KB - Virtual size: 225KB

.data
Size: 8KB - Virtual size: 14KB

.pdata
Size: 28KB - Virtual size: 24KB

.didat
Size: 4KB - Virtual size: 72B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 2KB