api-ms-win-core-firmware-l1-1-0[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

api-ms-win-core-firmware-l1-1-0.dll
Size

2KB
MD5

deb438611b29f331d13c7a5f92ed1519
SHA1

044f4f4d3e4bea9e6db27c58d5a4d74569d9aa81
SHA256

f14d59948546b14b33b25cbc9019c85378745fa736f73461aab42859556ba2eb
SHA512

50361a26418f744776f31dd0c5d33690146cfc4bd822eb1ae0a70c1f1d6fbc2a7d4f4d9513ba1d0d46528f36b473cfdafc9c5791646b333b3dbdf477631fd739

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
api-ms-win-core-firmware-l1-1-0.dll

Files

api-ms-win-core-firmware-l1-1-0.dll
.dll windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

API-MS-Win-Core-Firmware-L1-1-0.pdb

Exports

Exports

GetFirmwareEnvironmentVariableExW
GetFirmwareEnvironmentVariableW
SetFirmwareEnvironmentVariableExW
SetFirmwareEnvironmentVariableW

Sections

.text
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ