dskquoui[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

dskquoui.dll
Size

211KB
MD5

da46bacd3f7c02bb203e5bf1d65d2279
SHA1

9d4c8474055dd61232d832a25f4d4f06a0671021
SHA256

2256e974d0b15ddbeac89eede15fe62af5c410f0eaa3d88192b9ee506cf424c3
SHA512

1b9a37ff98d4ec22d7496a22a281fed0ab41d2e8cd1b5fef44811b9b07140969431ce6112b50c6bde27e5abc308cdf21b274e1e8a05d25dee5beb602ecdc4223
SSDEEP

3072:7V9NXNNLQYlYuVdIDtHuk96l+9GAucyfwq2nVZMhvxTycakSnhzSnhH:71JZVSBHuk8sGoLqZvxycanW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dskquoui.dll

Files

dskquoui.dll
.dll windows:6 windows x64 arch:x64

ca4e342eec1788cfe03f11c72b598893

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dskquoui.pdb

Imports

msvcrt

_CxxThrowException
__CxxFrameHandler3
memcpy
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memmove
_purecall
_vsnprintf
_vsnwprintf
memset

ntdll

NtFsControlFile
NtClose
NtQueryInformationFile
RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
NtCreateFile
RtlFreeHeap
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQueryVolumeInformationFile

kernel32

DeactivateActCtx
CreateActCtxW
GetModuleFileNameW
ReleaseActCtx
ActivateActCtx
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
CreateThread
CloseHandle
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetUserPreferredUILanguages
LocalAlloc
GetLocaleInfoEx
LocalFree
lstrlenW
CompareStringW
Sleep
WideCharToMultiByte
lstrlenA
GetVolumeInformationW
DisableThreadLibraryCalls
GetVolumeNameForVolumeMountPointW
GetLastError
CheckElevationEnabled
GetDiskFreeSpaceW
WaitForSingleObject
lstrcmpiW
GetFileAttributesW
GetCurrentThread
GetCurrentProcess
GlobalLock
GlobalUnlock
UnhandledExceptionFilter
GetModuleHandleW
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
lstrcmpW
FormatMessageW
GetThreadLocale
SetLastError
GetLocaleInfoW
CreateFileW
CreateFileMappingW
MapViewOfFile
GetFileSize
UnmapViewOfFile
SetUnhandledExceptionFilter
GetProcAddress

user32

MoveWindow
LoadStringW
EnableWindow
EnableMenuItem
GetWindowTextW
RegisterClipboardFormatW
GetParent
GetTopWindow
GetWindow
GetClassNameW
SetWindowPos
EndDialog
IsWindowEnabled
PeekMessageW
IsDialogMessageW
SetWindowTextW
DrawTextW
SendDlgItemMessageW
IsDlgButtonChecked
CheckDlgButton
SetDlgItemTextW
SetTimer
KillTimer
FindWindowW
SetForegroundWindow
GetWindowTextLengthW
CharUpperW
IsWindowVisible
CharNextW
MessageBoxW
GetSystemMetrics
GetDlgItemTextW
MessageBeep
IsCharAlphaW
IsCharAlphaNumericW
LoadAcceleratorsW
DestroyMenu
TrackPopupMenu
ClientToScreen
SetMenuDefaultItem
GetSubMenu
LoadMenuW
PtInRect
GetWindowRect
SetFocus
CallWindowProcW
DefWindowProcW
DestroyWindow
InvalidateRect
DestroyIcon
GetMenu
CheckMenuItem
GetWindowLongPtrW
GetClientRect
ReleaseDC
GetDC
RegisterClassExW
CreateWindowExW
LoadIconW
SendMessageTimeoutW
SetWindowLongPtrW
GetDesktopWindow
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
PostMessageW
UpdateWindow
SendMessageW
ShowCursor
LoadCursorW
SetCursor
CreateDialogParamW
DialogBoxParamW
ShowWindow
GetDlgItem

gdi32

GetTextMetricsW
GetDeviceCaps

advapi32

AllocateAndInitializeSid
ConvertSidToStringSidW
RegSetValueExW
EqualSid
OpenThreadToken
OpenProcessToken
GetTokenInformation
GetLengthSid
CopySid
IsValidSid
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetFileSecurityW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
FreeSid

ole32

CoLockObjectExternal
OleFlushClipboard
RegisterDragDrop
OleUninitialize
CoCreateInstance
OleInitialize
RevokeDragDrop
OleSetClipboard
DoDragDrop
StgCreateDocfile
ReleaseStgMedium
CreateStreamOnHGlobal
GetHGlobalFromStream
StgIsStorageFile
StgOpenStorage
StringFromGUID2
CoGetObject
OleIsCurrentClipboard

shell32

ShellAboutW
SHGetDesktopFolder
SHGetSpecialFolderLocation
DragQueryFileW
SHGetMalloc
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW

shlwapi

PathStripToRootW
PathSkipRootW
PathRemoveFileSpecW
ord219
StrRetToBufW
PathIsUNCW
PathIsRootW
ord158
SHGetValueW
PathAddBackslashW
StrCmpNW
PathFindFileNameW
PathAppendW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca4e342eec1788cfe03f11c72b598893

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

user32

gdi32

advapi32

ole32

shell32

shlwapi

Exports

Exports

Sections

.text Size: 135KB - Virtual size: 135KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 5KB - Virtual size: 5KB

.idata Size: 8KB - Virtual size: 7KB

.rsrc Size: 60KB - Virtual size: 59KB

.reloc Size: 1024B - Virtual size: 516B

.text
Size: 135KB - Virtual size: 135KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 5KB - Virtual size: 5KB

.idata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 60KB - Virtual size: 59KB

.reloc
Size: 1024B - Virtual size: 516B