comrepl[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

comrepl.dll
Size

111KB
MD5

9b2e10b04cf758216093f3fea656e41d
SHA1

3330d02759e226aed925059d8a96a166d3ca46d1
SHA256

721574b44b5e22d0e2071c6f45aec8505c83662119bac54835db56cd45b1ba92
SHA512

0f101769f7b288e8995f48ec79a71ce44209472775520e7784fcd4031721f169eaa3e432af25936afbb934a2d11056ff8175fcbbae11fec12be54ecb542b1a25
SSDEEP

1536:rYlVFTb2euQuL9d/b6z89VHKc090ljVEaPauZCL01TcsNc8KpJkC3C:wPuLj+jc0OlBTlcI196pJkqC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
comrepl.dll

Files

comrepl.dll
.dll regsvr32 windows:6 windows x64 arch:x64

ac7ccae3690c7f676158455c4f470785

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

comrepl.pdb

Imports

msvcrt

wcsrchr
_wstrtime
_XcptFilter
__C_specific_handler
_waccess
?terminate@@YAXXZ
printf
_lock
_wcsicmp
_wsetlocale
_amsg_exit
_unlock
_onexit
memcpy
memcmp
_local_unwind
__CxxFrameHandler3
free
_initterm
wcscpy_s
realloc
wcscat_s
_vsnwprintf
_wstrdate
malloc
__dllonexit
memset

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

oleaut32

SysFreeString
VariantClear
SysAllocStringLen
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
SysAllocString
SysStringLen
RegisterTypeLi

api-ms-win-core-libraryloader-l1-2-0

SizeofResource
GetModuleFileNameW
DisableThreadLibraryCalls
LoadResource
LoadLibraryExW
FindResourceExW
FreeLibrary
GetProcAddress
LockResource
GetModuleHandleW
LoadStringW

api-ms-win-core-com-l1-1-1

CoCreateInstanceEx
StringFromGUID2
CLSIDFromString
CoCreateGuid
StringFromCLSID
CoGetObjectContext
CoTaskMemFree
CoTaskMemAlloc
CoSetProxyBlanket
CoTaskMemRealloc
CoCreateInstance

api-ms-win-core-string-l2-1-0

CharNextW
CharPrevW

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-sysinfo-l1-2-1

GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetSystemInfo
GetVersionExW

api-ms-win-core-memory-l1-1-2

VirtualQuery
VirtualProtect
VirtualAlloc

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
Sleep
InitializeCriticalSection

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-heap-l1-2-0

HeapDestroy

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
WriteConsoleW

api-ms-win-core-localization-l1-2-1

FormatMessageW
SetThreadUILanguage

api-ms-win-core-file-l1-2-1

DeleteFileW
FlushFileBuffers
SetFileAttributesW
FindFirstFileW
FindClose
CreateDirectoryW
CreateFileW
SetFilePointer
WriteFile
FindNextFileW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
GetStdHandle

api-ms-win-core-file-l2-1-1

CopyFileExW

api-ms-win-core-processthreads-l1-1-2

GetThreadContext
GetCurrentProcessId
OpenProcessToken
TerminateProcess
CreateProcessW
GetCurrentProcess
GetCurrentThread
GetExitCodeProcess
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernel32

DelayLoadFailureHook
GetComputerNameW
lstrcpynW
lstrcpyW
lstrlenW
LocalFree
ResolveDelayLoadedAPI
lstrcmpiW

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-security-base-l1-2-0

GetTokenInformation

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac7ccae3690c7f676158455c4f470785

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

kernel32

api-ms-win-core-debug-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-security-base-l1-2-0

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 95KB

.data Size: 512B - Virtual size: 9KB

.pdata Size: 2KB - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 32B

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 436B

.text
Size: 96KB - Virtual size: 95KB

.data
Size: 512B - Virtual size: 9KB

.pdata
Size: 2KB - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 436B