api-ms-win-downlevel-shell32-l1-1-0[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

api-ms-win-downlevel-shell32-l1-1-0.dll
Size

3KB
MD5

7b565d9225178585c80f6d84debcb0d7
SHA1

9e895b60f3572e83247ac3c4d3d84f55b796134e
SHA256

646c4b4eb775fb2b3f41b4b95a73e75f96b6fa0f1bbdf6247d4315c459e7ff69
SHA512

b676cb23674535da02720e25c86a9e9f12d3410136121a17f0f648f301f2aec521638d87fa3140cc3d850c3d7d77d5456282ef655fc6ee5ba931c6edea9f7e6b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
api-ms-win-downlevel-shell32-l1-1-0.dll

Files

api-ms-win-downlevel-shell32-l1-1-0.dll
.dll windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-downlevel-shell32-l1-1-0.pdb

Exports

Exports

CommandLineToArgvW
GetCurrentProcessExplicitAppUserModelID
SetCurrentProcessExplicitAppUserModelID

Sections

.text
Size: 512B - Virtual size: 353B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 26B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ