DataExchange[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

DataExchange.dll
Size

252KB
MD5

3498e2b48061f2922ebe86ec1b2ab5a9
SHA1

b4b2ca66a0f49a38017b70abc229a3712f97edbe
SHA256

18a5ac03227379aaea033ee45466ab5ab330c83c4bd2506df97e3d44c0734053
SHA512

43d9daf2f88054343eb2284c6af8c65bb22f830b5d58d261d66dec44fa19406f181b90e4ff86de09b5f87862fc3f409a8a965533f1e78284175824368ba58ff3
SSDEEP

3072:WTQ6zFbvk9fsxcc/S5BU5QBV19e++iWWUHiRnnD9GX8ezvI11rV6DObgHH2+Vzcn:n6z5WfaK5BLX+bWUCdO7I17qf2+Vq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DataExchange.dll

Files

DataExchange.dll
.dll windows:10 windows x86 arch:x86

d87e30b18f53fe55c5b018af0882adc7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DataExchange.pdb

Imports

msvcrt

_lock
_unlock
_onexit
_vsnwprintf
_purecall
memcpy_s
__CxxFrameHandler3
_initterm
malloc
free
_amsg_exit
_XcptFilter
_except_handler4_common
??3@YAXPAX@Z
__dllonexit
memcmp
_ftol2_sse
??1type_info@@UAE@XZ
_callnewh
memmove
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memset

shcore

CreateStreamOverRandomAccessStream
SHCreateThreadRef
SHSetThreadRef
GetScaleFactorForMonitor
GetProcessDpiAwareness
SHGetThreadRef
ord244
ord270

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsIsStringEmpty
WindowsDuplicateString
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError
RoGetMatchingRestrictedErrorInfo
RoTransformError
IsErrorPropagationEnabled
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoReportFailedDelegate
RoOriginateErrorW

api-ms-win-core-synch-l1-2-0

CreateEventW
LeaveCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
InitializeSRWLock
Sleep
InitOnceExecuteOnce
WaitForSingleObject
SetEvent
AcquireSRWLockShared
CreateMutexExW
InitializeCriticalSectionEx
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSemaphore
DeleteCriticalSection
CreateEventExW
CreateSemaphoreExW
InitializeCriticalSection
EnterCriticalSection

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetProcAddress
SizeofResource
FreeLibraryAndExitThread
LoadResource
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
LockResource

api-ms-win-core-processthreads-l1-1-2

TlsSetValue
TlsFree
TlsAlloc
CreateThread
GetCurrentProcessId
GetCurrentThreadId
TlsGetValue
GetCurrentProcess
OpenProcessToken
TerminateProcess
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-1

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
RoGetAgileReference
CoMarshalInterface
CreateStreamOnHGlobal
CoWaitForMultipleHandles
CoUninitialize
CoReleaseMarshalData
CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoCreateInstance
PropVariantClear

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
FreeLibraryWhenCallbackReturns
CallbackMayRunLong

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-libraryloader-l1-2-2

FindResourceW

api-ms-win-core-kernel32-legacy-l1-1-1

MulDiv

combase

ord90

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice2

ntdll

ZwQueryWnfStateData
RtlNtStatusToDosError

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d87e30b18f53fe55c5b018af0882adc7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shcore

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-kernel32-legacy-l1-1-1

combase

api-ms-win-core-delayload-l1-1-1

d3d11

dcomp

ntdll

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 115KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 108B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 118KB - Virtual size: 118KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 116KB - Virtual size: 115KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 108B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 118KB - Virtual size: 118KB

.reloc
Size: 9KB - Virtual size: 8KB