CoreMessaging[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CoreMessaging.dll
Size

472KB
MD5

781c3706c3dc3c025ca5b9cd69be2d0f
SHA1

f140fefa867fc02ad0045d52969a0491be971761
SHA256

2d89c86d60ca7a2598c18c56f8588532e254d4327a7028038e8b192dbf17f844
SHA512

582e7c80586708deea43c380cd554c34519291f17fea0e11d5848e8ff4f8af32cb178e84b9382b8093e24eb79a7148ad6e3175141edb080e5d40a535621614d5
SSDEEP

12288:B1gvuO4lyCExyWNty7bFr4dMM+N9vppOIl6BD4ApAO4H7f7tR:B1gvuOgydxUb5NxppOw6BsApAO4H7fB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CoreMessaging.dll

Files

CoreMessaging.dll
.dll windows:6 windows x86 arch:x86

f26a28a9d0757bf7aec2f3110300f26c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CoreMessaging.pdb

Imports

msvcrt

_purecall
_wcsicmp
_CxxThrowException
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_ftol2
_libm_sse2_sqrt_precise
memcmp
memmove
memchr
memcpy
_aligned_offset_malloc
_aligned_free
realloc
swprintf_s
wcscpy_s
_callnewh
?terminate@@YAXXZ
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
??1type_info@@UAE@XZ
??3@YAXPAX@Z
memset

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
WaitForMultipleObjectsEx
ReleaseSRWLockShared
WaitForSingleObjectEx
AcquireSRWLockShared
WakeByAddressAll
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
Sleep
InitializeSRWLock
WaitOnAddress
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
CreateEventW
ResetEvent
SetEvent
EnterCriticalSection

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-processthreads-l1-1-2

OpenThreadToken
TerminateProcess
SetThreadPriority
GetThreadPriority
GetCurrentProcess
TlsSetValue
TlsGetValue
CreateThread
TlsFree
TlsAlloc
GetCurrentThread
OpenThread
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo

api-ms-win-core-rtlsupport-l1-2-0

RtlCaptureStackBackTrace

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
DisableThreadLibraryCalls
LoadLibraryExW
FreeLibrary
GetModuleHandleExW
LoadLibraryExA
GetProcAddress
GetModuleFileNameW

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree
HeapCreate
HeapSize
HeapDestroy
HeapAlloc

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle
GetHandleInformation
SetHandleInformation

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
DebugBreak

api-ms-win-core-localization-l1-2-1

GetLocaleInfoW
LCMapStringW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
CompareStringW
WideCharToMultiByte

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-file-l1-2-1

LocalFileTimeToFileTime
FlushFileBuffers
WriteFile

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventRegister

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolWait
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
IsThreadpoolTimerSet
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpoolWait

api-ms-win-core-memory-l1-1-2

VirtualFree
VirtualProtect
VirtualQuery
VirtualAlloc

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
StartServiceW
OpenServiceW

api-ms-win-service-winsvc-l1-2-0

QueryServiceStatus

rpcrt4

RpcBindingCreateW
I_RpcExceptionFilter
RpcBindingFree
RpcServerUseProtseqW
RpcServerInqBindings
RpcBindingVectorFree
RpcServerUnregisterIf
RpcEpUnregister
NdrServerCall2
RpcEpRegisterW
RpcBindingBind
RpcServerRegisterIf3
NdrClientCall4

api-ms-win-core-interlocked-l1-2-0

InterlockedFlushSList
QueryDepthSList
InterlockedPopEntrySList
InterlockedPushEntrySList
InitializeSListHead

api-ms-win-security-base-l1-2-0

RevertToSelf
GetTokenInformation

api-ms-win-core-localization-obsolete-l1-3-0

GetNumberFormatW

ntdll

NtAlpcConnectPortEx
NtAlpcImpersonateClientOfPort
NtAlpcAcceptConnectPort
NtAlpcCreatePort
RtlInitUnicodeString
NtAlpcDisconnectPort
AlpcInitializeMessageAttribute
RtlClearThreadWorkOnBehalfTicket
RtlSetThreadWorkOnBehalfTicket
AlpcGetMessageAttribute
NtAlpcSendWaitReceivePort
NtClose
RtlFreeUnicodeString
RtlGetAppContainerNamedObjectPath
NtQuerySystemInformation

api-ms-win-security-accesshlpr-l1-1-0

FreeTransientObjectSecurityDescriptor
QueryTransientObjectSecurityDescriptor

api-ms-win-core-errorhandling-l1-1-3

RaiseFailFastException

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-service-core-l1-1-1

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

Exports

Exports

CoreUICallCreateConversationHost
CoreUICallCreateEndpointHost
CoreUICallReceive
CoreUICallSend
CoreUIConfigureTestHost
CoreUICreate
CoreUICreateAnonymousStream
CoreUICreateClientWindowIDManager
CoreUICreateSystemWindowIDManager
CoreUICreateWindowValidator
CoreUIFailFastOOM
CoreUIOpenExisting
CoreUIRouteToTestRegistrar
InitializeServices
MsgBlobCreateShared
MsgBlobCreateStack
MsgBufferShare
MsgRelease
MsgStringCreateShared
MsgStringCreateStack
ServiceMain
SvchostPushServiceGlobals
UninitializeServices

Sections

.text
Size: 310KB - Virtual size: 310KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f26a28a9d0757bf7aec2f3110300f26c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-synch-l1-2-1

api-ms-win-security-sddl-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-2-0

rpcrt4

api-ms-win-core-interlocked-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-localization-obsolete-l1-3-0

ntdll

api-ms-win-security-accesshlpr-l1-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-apiquery-l1-1-0

api-ms-win-service-core-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

Exports

Exports

Sections

.text Size: 310KB - Virtual size: 310KB

.rdata Size: 95KB - Virtual size: 94KB

.data Size: 1KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 116B

.rsrc Size: 39KB - Virtual size: 38KB

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 310KB - Virtual size: 310KB

.rdata
Size: 95KB - Virtual size: 94KB

.data
Size: 1KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 116B

.rsrc
Size: 39KB - Virtual size: 38KB

.reloc
Size: 25KB - Virtual size: 24KB