ext-ms-win-advapi32-eventingcontroller-l1-1-0[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ext-ms-win-advapi32-eventingcontroller-l1-1-0.dll
Size

3KB
MD5

7cfa9d85721621e33c486206999fa446
SHA1

f45cbaa843a2b0bdfe5ad41dffe2347c24b173de
SHA256

79ab96143d20c3b32be6e15f2a92d2d202071c8eba2ccdaea4a761a33e343afb
SHA512

4dc2700a1070b7bcfadcf800e9b38210e0bbc94e83deee7551d603286fe26e0b3c87d4a20af9c63f54db7c5db2e0a16377ef6002960cf257cd5e6a48f6b6bef2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ext-ms-win-advapi32-eventingcontroller-l1-1-0.dll

Files

ext-ms-win-advapi32-eventingcontroller-l1-1-0.dll
.dll windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

EXT-MS-Win-advapi32-EventingController-l1-1-0.pdb

Exports

Exports

EtwLogSysConfigExtension

Sections

.text
Size: 512B - Virtual size: 285B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 26B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ