SHCore[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SHCore.dll
Size

536KB
MD5

8c37ee19c4fde878547d6bb2935da6df
SHA1

1c072c6b4418258826f7075e8d6b2fc7139ee62c
SHA256

bb1ddd05f4aaf84a586768464ad45eab8c889427a0ef89f6bfd2d73389524a68
SHA512

3bc75f812a47aca2edca7c20edbf45f52c8611ac6fca90885c6313196b603fae2b7c0d1d321ef628ba6764fab6563fd0b1c665d9c445045b2a7b123c5a0bd017
SSDEEP

12288:uXKj374xa9C3zpZUJFryj6sLDHron6lxS:8Kj37Wa9xyj6erron6q

Score

1^/10

Malware Config

Signatures

Files

SHCore.dll
.dll windows:10 windows x86 arch:x86

6df3e31673d2ccedabfbe5a79390b72d

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:b1:c0:c1:f2:46:ad:c3:0d:f9:31:3f:7a:92:42:25:69:93:e0:07:b7:47:93:00:c4:51:45:94:cc:74:6a:16
Signer

Actual PE Digest

41:b1:c0:c1:f2:46:ad:c3:0d:f9:31:3f:7a:92:42:25:69:93:e0:07:b7:47:93:00:c4:51:45:94:cc:74:6a:16

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

shcore.pdb

Imports

msvcrt

__dllonexit
_unlock
_onexit
_except_handler4_common
memcpy
memcmp
floor
_ftol2_sse
_ftol2
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
__CxxFrameHandler3
_callnewh
wcsrchr
_vsnwprintf
memcpy_s
_purecall
memmove_s
memmove
wcsncmp
wcschr
memset

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventSetInformation
EventUnregister
EventWriteTransfer

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-1

RoOriginateErrorW
SetRestrictedErrorInfo
RoTransformError
GetRestrictedErrorInfo
RoOriginateError

api-ms-win-core-synch-l1-2-0

CreateMutexW
InitializeCriticalSection
AcquireSRWLockExclusive
CreateEventW
AcquireSRWLockShared
WaitForSingleObject
ReleaseSRWLockShared
ReleaseMutex
OpenSemaphoreW
InitOnceExecuteOnce
InitOnceComplete
TryAcquireSRWLockExclusive
EnterCriticalSection
CreateSemaphoreExW
InitOnceBeginInitialize
WaitForSingleObjectEx
WaitForMultipleObjectsEx
OpenEventW
ReleaseSemaphore
InitializeCriticalSectionEx
Sleep
LeaveCriticalSection
InitializeSRWLock
DeleteCriticalSection
CreateEventExW
CreateMutexExW
ReleaseSRWLockExclusive
SetEvent

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadResource
GetProcAddress
FreeLibraryAndExitThread
LoadLibraryExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW
SizeofResource
GetModuleFileNameA
GetModuleFileNameW
FindResourceExW
GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
TerminateProcess
OpenThreadToken
OpenProcessToken
OpenProcess
GetCurrentThreadId
GetCurrentProcessId
TlsSetValue
TlsFree
TlsGetValue
GetProcessId
GetStartupInfoW
GetCurrentThread
TlsAlloc
CreateThread

api-ms-win-core-sysinfo-l1-2-1

GetOsSafeBootMode
GetVersionExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-1

RaiseException
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-heap-l1-2-0

HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
SetThreadpoolWait
SetThreadpoolTimer
DisassociateCurrentThreadFromCallback
FreeLibraryWhenCallbackReturns
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CallbackMayRunLong
WaitForThreadpoolTimerCallbacks

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetLocaleInfoW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegOpenKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegDeleteValueA
RegQueryValueExW
RegDeleteKeyExA
RegCreateKeyExA
RegQueryValueExA
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyExW
RegEnumValueW
RegGetValueW
RegEnumValueA
RegEnumKeyExA
RegEnumKeyExW

api-ms-win-security-base-l1-2-0

GetTokenInformation
CheckTokenMembership
RevertToSelf
AdjustTokenPrivileges
ImpersonateLoggedOnUser

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-file-l1-2-1

UnlockFileEx
SetEndOfFile
SetFilePointerEx
GetFileAttributesExW
GetFileSizeEx
CreateFile2
SetFilePointer
SetFileInformationByHandle
GetFileInformationByHandle
FlushFileBuffers
CreateDirectoryW
DeleteFileW
CreateFileW
WriteFile
ReadFile
GetDriveTypeW
GetVolumeInformationByHandleW
LockFileEx
GetFileAttributesW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
ExpandEnvironmentStringsA

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-io-l1-1-1

CancelIoEx
GetOverlappedResult
DeviceIoControl

api-ms-win-core-file-l2-1-1

ReplaceFileW
GetFileInformationByHandleEx

api-ms-win-core-path-l1-1-0

PathAllocCanonicalize
PathCchAddBackslash

rpcrt4

I_RpcBindingInqLocalClientPID

api-ms-win-core-errorhandling-l1-1-3

RaiseFailFastException

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW
GlobalAddAtomExW
GlobalDeleteAtom

api-ms-win-core-shlwapi-legacy-l1-1-0

PathUnExpandEnvStringsW
PathIsRelativeW
PathUnExpandEnvStringsA
PathFindExtensionW
PathFindFileNameW
PathGetDriveNumberW
PathIsUNCW
PathFileExistsW
PathRemoveFileSpecW
PathCombineW

api-ms-win-core-kernel32-legacy-l1-1-1

MulDiv

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
QueueUserWorkItem
CreateTimerQueueTimer

api-ms-win-core-shlwapi-obsolete-l1-2-0

StrChrW
StrToIntW
StrCmpNIW
StrCmpNICW
StrDupA
QISearch
StrCmpICW
StrDupW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-localization-obsolete-l1-3-0

GetUserDefaultUILanguage

combase

ord134

ntdll

NtQuerySystemInformation
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtQueryInformationProcess
NtCreateFile
RtlInitUnicodeString
RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

CommandLineToArgvW
CreateRandomAccessStreamOnFile
CreateRandomAccessStreamOverStream
CreateStreamOverRandomAccessStream
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetCurrentProcessExplicitAppUserModelID
GetDpiForMonitor
GetDpiForShellUIComponent
GetFeatureEnabledState
GetProcessDpiAwareness
GetProcessReference
GetScaleFactorForDevice
GetScaleFactorForMonitor
IStream_Copy
IStream_Read
IStream_ReadStr
IStream_Reset
IStream_Size
IStream_Write
IStream_WriteStr
IUnknown_AtomicRelease
IUnknown_GetSite
IUnknown_QueryService
IUnknown_Set
IUnknown_SetSite
IsOS
RecordFeatureError
RecordFeatureUsage
RegisterScaleChangeEvent
RegisterScaleChangeNotifications
RevokeScaleChangeNotifications
SHAnsiToAnsi
SHAnsiToUnicode
SHCopyKeyA
SHCopyKeyW
SHCreateMemStream
SHCreateStreamOnFileA
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
SHCreateThread
SHCreateThreadRef
SHCreateThreadWithHandle
SHDeleteEmptyKeyA
SHDeleteEmptyKeyW
SHDeleteKeyA
SHDeleteKeyW
SHDeleteValueA
SHDeleteValueW
SHEnumKeyExA
SHEnumKeyExW
SHEnumValueA
SHEnumValueW
SHGetThreadRef
SHGetValueA
SHGetValueW
SHOpenRegStream2A
SHOpenRegStream2W
SHOpenRegStreamA
SHOpenRegStreamW
SHQueryInfoKeyA
SHQueryInfoKeyW
SHQueryValueExA
SHQueryValueExW
SHRegDuplicateHKey
SHRegGetIntW
SHRegGetPathA
SHRegGetPathW
SHRegGetValueA
SHRegGetValueFromHKCUHKLM
SHRegGetValueW
SHRegSetPathA
SHRegSetPathW
SHReleaseThreadRef
SHSetThreadRef
SHSetValueA
SHSetValueW
SHStrDupA
SHStrDupW
SHUnicodeToAnsi
SHUnicodeToUnicode
SetCurrentProcessExplicitAppUserModelID
SetProcessDpiAwareness
SetProcessReference
SubscribeFeatureStateChangeNotification
UnregisterScaleChangeEvent
UnsubscribeFeatureStateChangeNotification

Sections

.text
Size: 476KB - Virtual size: 475KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6df3e31673d2ccedabfbe5a79390b72d

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

41:b1:c0:c1:f2:46:ad:c3:0d:f9:31:3f:7a:92:42:25:69:93:e0:07:b7:47:93:00:c4:51:45:94:cc:74:6a:16Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-path-l1-1-0

rpcrt4

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-version-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-3-0

combase

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 476KB - Virtual size: 475KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 412B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 33KB - Virtual size: 32KB

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

41:b1:c0:c1:f2:46:ad:c3:0d:f9:31:3f:7a:92:42:25:69:93:e0:07:b7:47:93:00:c4:51:45:94:cc:74:6a:16
Signer

.text
Size: 476KB - Virtual size: 475KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 412B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 33KB - Virtual size: 32KB