api-ms-win-rtcore-ntuser-windowstation-l1-1-0[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

api-ms-win-rtcore-ntuser-windowstation-l1-1-0.dll
Size

3KB
MD5

ad3d1efc6e645a48ac2176f841c56825
SHA1

7bb0648efd1579108702a1b1999afe1a66a4b626
SHA256

8af633c59417db3a582952d0bfe07fcff68c9768995cb5f7e52b863908919cf1
SHA512

e5f7b8a7e56860c481dc459437846c106a58e5fdb6b566269d3e57a6f99b277c28f7c431cde13c772489a8d3c4dd7fdb24061de35f11942fc2165f7c8d9fe85b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
api-ms-win-rtcore-ntuser-windowstation-l1-1-0.dll

Files

api-ms-win-rtcore-ntuser-windowstation-l1-1-0.dll
.dll windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-rtcore-ntuser-windowstation-l1-1-0.pdb

Exports

Exports

CloseDesktop
CloseWindowStation
CreateDesktopW
CreateWindowStationW
EnumDesktopWindows
GetProcessWindowStation
GetThreadDesktop
GetUserObjectInformationW
OpenInputDesktop
OpenWindowStationW
SetProcessWindowStation
SetThreadDesktop
SwitchDesktop

Sections

.text
Size: 1024B - Virtual size: 625B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 26B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ