ExecModelClient[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ExecModelClient.dll
Size

197KB
MD5

f4b9a05faf056fa210b617b7a978da03
SHA1

a55ed3439c51e7f0e9e0ee0f640a6ba36a79805b
SHA256

56ab20fa178333dce5a0ae5effbed8926ccdb4904cd773a31299f19aa6d718e8
SHA512

b32134e103bb660b5a3b33736ba66e9d2e330ac6b5498de7dd6b7989dc2d679d7a4834c78ab2e9e60a93dbf84279dd41686907437dceddd82740943c6249838d
SSDEEP

3072:WFhawrDXwgOHtsskZcwPL0mY3mBhTAv/nBbwJ9QT57vh:yE3Nsv/PLn4pKPk5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExecModelClient.dll

Files

ExecModelClient.dll
.dll windows:10 windows x86 arch:x86

0378699786beb2cce2d76e19746c82ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ExecModelClient.pdb

Imports

msvcrt

_unlock
_lock
_initterm
__dllonexit
_onexit
_amsg_exit
_XcptFilter
_purecall
free
malloc
memcpy_s
__CxxFrameHandler3
_except_handler4_common
memcmp
wcscpy_s
_callnewh
_vsnwprintf
memset

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleExW
GetProcAddress

api-ms-win-core-synch-l1-2-0

CreateSemaphoreExW
WaitForSingleObject
ReleaseMutex
InitOnceInitialize
CreateEventExW
InitOnceExecuteOnce
WaitForSingleObjectEx
OpenSemaphoreW
InitializeSRWLock
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
CreateEventW
CreateMutexExW
ReleaseSemaphore
SetEvent
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-2-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-1

SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
TlsAlloc
OpenProcess
TlsGetValue
TlsSetValue
GetThreadId
OpenProcessToken
CreateThread
TerminateProcess
GetCurrentProcess
TlsFree
GetCurrentThreadId

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

rpcrt4

I_RpcMapWin32Status
NdrClientCall4
RpcBindingCreateW
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFree
RpcBindingBind
RpcBindingFromStringBindingW
I_RpcExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventSetInformation
EventUnregister
EventWriteTransfer

api-ms-win-core-winrt-error-l1-1-1

RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoOriginateError
RoReportFailedDelegate
RoTransformError
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDuplicateString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-com-l1-1-1

CoGetApartmentType
CoUninitialize
CoCreateInstance
StringFromGUID2
RoGetAgileReference
CoReleaseMarshalData
CoInitializeEx
CoUnmarshalInterface
CoWaitForMultipleHandles
CoTaskMemRealloc
CoTaskMemFree
CoGetCallContext
CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateGuid
CoMarshalInterface
CoGetMalloc
CoCreateFreeThreadedMarshaler

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-security-accesshlpr-l1-1-0

BuildSecurityDescriptorForSharingAccess
QueryTransientObjectSecurityDescriptor
FreeTransientObjectSecurityDescriptor

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks
CallbackMayRunLong
FreeLibraryWhenCallbackReturns

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

ntdll

RtlLengthSid
RtlCopySid
NtQueryInformationToken
RtlValidSid
NtQuerySystemInformation
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabledForPackage

api-ms-win-core-psm-key-l1-1-0

PsmGetPackageFullNameFromKey
PsmGetApplicationNameFromKey
PsmCreateKey

coremessaging

CoreUICreate

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-service-private-l1-1-1

UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
OpenServiceW

api-ms-win-service-winsvc-l1-2-0

QueryServiceStatus

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

CreateForegroundTaskManager
CreateModernVoipPolicy
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
PlmGetHostIdForDesktopAppxProcess
PlmGetHostIdForDynamicProcess
PlmGetHostIdForMixedHost
PlmGetHostIdForPple
TestHook_CancelShutdown

Sections

.text
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0378699786beb2cce2d76e19746c82ba

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

rpcrt4

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-accesshlpr-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-synch-l1-2-1

ntdll

api-ms-win-core-winrt-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-psm-key-l1-1-0

coremessaging

api-ms-win-core-apiquery-l1-1-0

api-ms-win-service-private-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-2-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 173KB - Virtual size: 172KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 136B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 173KB - Virtual size: 172KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 136B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 12KB