comsvcs[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

comsvcs.dll
Size

1.6MB
MD5

782b980d3a4b00472199d93dbd201420
SHA1

2d92f23ffbd176cabaf2e052f753f2b6fdf285ee
SHA256

63067023ee27550c16bb1ae5bda501266ca04f27ec04e7d5d45bc72d9f915dcd
SHA512

ecef1fa8a594973eadd01c7047d3306b57b492ceaed83bfc13f70e185a97d6877c94248b2d2a9ca241b5fa0d5212121d50ba977c8a28b0e6908cd1b61c5fbd4d
SSDEEP

24576:oP36e8MnQmtvSJ3dZaEEeRApuEURRU437CToT+MMA3m2yr6d8x2rhku:88SXt+ExpTURRU27+3/2g1Yrh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
comsvcs.dll

Files

comsvcs.dll
.dll regsvr32 windows:6 windows x64 arch:x64

a746f4907aaf00e3174a5f0447fa37a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

comsvcs.pdb

Imports

msvcrt

_wcsdup
time
__dllonexit
_unlock
_lock
memmove_s
wcstombs
_beginthreadex
wcsstr
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBV0@@Z
memcpy_s
?terminate@@YAXXZ
_wcsupr
memmove
_vsnprintf
wcsrchr
iswdigit
_onexit
wcstok_s
_CxxThrowException
??1type_info@@UEAA@XZ
sqrt
wcscpy_s
iswalpha
_wstrtime
_waccess
_wstrdate
__CxxFrameHandler3
_vsnwprintf
memset
exp
realloc
wcscat_s
_XcptFilter
_amsg_exit
__C_specific_handler
_local_unwind
_initterm
memcpy
memcmp
_ultow
mbstowcs
_purecall
malloc
wcschr
free
_wtoi
_wcsicmp
__doserrno
wcscmp

ntdll

RtlSplay
RtlDllShutdownInProgress
RtlDeleteCriticalSection
RtlInitializeCriticalSectionAndSpinCount
RtlReportException
NtQueryInformationProcess
RtlImageNtHeader
RtlAllocateHeap
RtlFreeHeap
WinSqmSetDWORD
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwTraceMessage
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwGetTraceLoggerHandle
NtQuerySystemInformation
RtlNtStatusToDosError
EtwNotificationUnregister
ShipAssertMsgA
EtwNotificationRegister
RtlInitUnicodeString
RtlCreateServiceSid
EtwLogTraceEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlDelete

api-ms-win-core-com-l1-1-1

StringFromCLSID
CoTaskMemFree
StringFromIID
CoGetMarshalSizeMax
ProgIDFromCLSID
CoReleaseMarshalData
CoCreateGuid
CreateStreamOnHGlobal
CoMarshalInterface
StringFromGUID2
CoGetCurrentLogicalThreadId
CLSIDFromString
CLSIDFromProgID
CoUninitialize
CoTaskMemRealloc
CoCreateInstance
CoFreeUnusedLibraries
CoGetObjectContext
CoGetCallContext
CoInitializeEx
CoSetProxyBlanket
CoDisconnectObject
CoGetClassObject
CoCreateFreeThreadedMarshaler
CoGetDefaultContext
GetHGlobalFromStream
CoTaskMemAlloc
CoWaitForMultipleHandles
CoCreateInstanceEx
CoImpersonateClient
CoRevertToSelf
CoUnmarshalInterface
IIDFromString

api-ms-win-core-processthreads-l1-1-2

GetExitCodeThread
GetThreadPriority
SetThreadToken
SetThreadStackGuarantee
OpenProcess
TlsGetValue
OpenThreadToken
ExitProcess
GetCurrentThread
CreateThread
CreateProcessAsUserW
GetThreadContext
GetCurrentThreadId
OpenProcessToken
GetExitCodeProcess
GetCurrentProcess
GetCurrentProcessId
TlsFree
TerminateProcess
TlsSetValue
SetThreadPriority
CreateProcessW
TlsAlloc

oleaut32

SafeArrayUnaccessData
VariantCopy
SysAllocStringLen
VARIANT_UserUnmarshal
VARIANT_UserSize
SafeArrayDestroy
SafeArrayAccessData
SafeArrayCreateVector
VARIANT_UserUnmarshal64
VariantClear
SysAllocString
VARIANT_UserSize64
VARIANT_UserFree
LoadRegTypeLi
BSTR_UserSize
SysFreeString
CreateErrorInfo
SetErrorInfo
GetErrorInfo
LPSAFEARRAY_UserUnmarshal64
VARIANT_UserMarshal
VarUI4FromStr
BSTR_UserSize64
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserSize64
BSTR_UserFree64
LPSAFEARRAY_UserFree64
VARIANT_UserFree64
LoadTypeLi
VariantChangeType
SysStringByteLen
SafeArrayCreate
VariantInit
VARIANT_UserMarshal64
BSTR_UserMarshal
LPSAFEARRAY_UserMarshal
SysStringLen
BSTR_UserUnmarshal64
LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
BSTR_UserMarshal64
BSTR_UserUnmarshal
BSTR_UserFree
SysAllocStringByteLen

api-ms-win-core-memory-l1-1-2

VirtualAlloc
VirtualQuery
VirtualProtect

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
FreeLibraryAndExitThread
GetModuleHandleExW
SizeofResource
FreeLibrary
LockResource
LoadResource
LoadLibraryExW
GetModuleHandleW
LoadStringW
GetProcAddress
GetModuleFileNameW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegCloseKey
RegGetValueW

api-ms-win-core-synch-l1-2-0

SetEvent
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
SetWaitableTimerEx
ResetEvent
ReleaseSemaphore
EnterCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
DeleteCriticalSection
Sleep
CreateEventW
OpenEventW
WaitForSingleObject

api-ms-win-core-sysinfo-l1-2-1

GetComputerNameExW
GetLocalTime
GetSystemInfo
GetSystemWindowsDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
GlobalMemoryStatusEx
GetTickCount64

api-ms-win-core-file-l1-2-1

SetFileAttributesW
GetFileAttributesExW
CreateDirectoryW
GetDriveTypeW
FindFirstFileW
CreateFileW
GetFileAttributesW
FindClose
FindNextFileW
GetLongPathNameW
GetDiskFreeSpaceExW
DeleteFileW
WriteFile
GetVolumeInformationW
SetFilePointer
CompareFileTime

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter

api-ms-win-core-string-l2-1-0

CharPrevW
CharNextW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-security-base-l1-2-0

InitializeAcl
FreeSid
GetSecurityDescriptorDacl
SetKernelObjectSecurity
GetSidSubAuthorityCount
AddAccessAllowedAce
GetSidSubAuthority
GetSecurityDescriptorLength
RevertToSelf
GetTokenInformation
DeleteAce
SetSecurityDescriptorGroup
AddAccessAllowedAceEx
EqualSid
GetAce
SetSecurityDescriptorOwner
IsValidSid
AddAce
CheckTokenMembership
IsValidSecurityDescriptor
SetSecurityDescriptorControl
InitializeSecurityDescriptor
DuplicateTokenEx
SetSecurityDescriptorDacl
ImpersonateSelf
CopySid
GetAclInformation
AllocateAndInitializeSid
GetLengthSid
AccessCheck
GetSidIdentifierAuthority

rpcrt4

CStdStubBuffer_IsIIDSupported
I_RpcBindingInqLocalClientPID
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
UuidFromStringW
NdrStubCall3
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
RpcStringFreeW
UuidToStringW
I_RpcBindingInqTransportType
CStdStubBuffer_CountRefs
NdrOleAllocate
NdrClientCall3
UuidToStringA
NdrStubForwardingFunction
I_RpcTurnOnEEInfoPropagation
UuidCreate
RpcStringFreeA
NdrOleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
UuidCreateSequential
MesEncodeDynBufferHandleCreate
MesDecodeBufferHandleCreate
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
MesHandleFree
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrMesTypeDecode3
NdrMesTypeEncode3

authz

AuthzInitializeContextFromSid
AuthzFreeContext
AuthzAccessCheck
AuthzInitializeResourceManager
AuthzFreeResourceManager

api-ms-win-core-path-l1-1-0

PathCchRemoveExtension
PathCchStripToRoot

api-ms-win-core-io-l1-1-1

GetQueuedCompletionStatus
CreateIoCompletionPort
PostQueuedCompletionStatus
DeviceIoControl

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks

api-ms-win-eventing-controller-l1-1-0

StartTraceW
ControlTraceW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-eventing-consumer-l1-1-0

CloseTrace
OpenTraceW
ProcessTrace

api-ms-win-core-string-obsolete-l1-1-0

lstrcpyW
lstrlenW
lstrcmpiW
lstrcpynW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
GlobalLock
GlobalUnlock
LocalAlloc
GlobalFree
GlobalAlloc

api-ms-win-core-com-private-l1-1-0

CoRetireServer
CoReactivateObject
CoPopServiceDomain
CoPushServiceDomain
CoGetApartmentID
CoGetProcessIdentifier
CoDeactivateObject

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

kernel32

UnregisterWaitEx
DeleteTimerQueueTimer
ChangeTimerQueueTimer
RegisterWaitForSingleObject
LoadLibraryW
CreateWaitableTimerW
WaitForMultipleObjects
GetComputerNameW
GetCurrentPackageId
CreateSemaphoreW
CreateTimerQueueTimer
QueueUserWorkItem
UnregisterWait
MoveFileW

ole32

NdrProxyForwardingFunction10
ObjectStublessClient13
NdrProxyForwardingFunction8
NdrProxyForwardingFunction7
ObjectStublessClient14
NdrProxyForwardingFunction5
ObjectStublessClient9
ObjectStublessClient5
ObjectStublessClient3
NdrProxyForwardingFunction11
NdrProxyForwardingFunction3
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient4
NdrProxyForwardingFunction4
NdrProxyForwardingFunction6
ReadClassStm
OleSaveToStream
OleLoadFromStream
WriteClassStm
NdrProxyForwardingFunction12
NdrProxyForwardingFunction9
ObjectStublessClient12
CoGetObject
MkParseDisplayName
CreateAntiMoniker
MonikerRelativePathTo
CreateGenericComposite
MonikerCommonPrefixWith
CoGetInterceptor
CreateBindCtx
ObjectStublessClient11
ObjectStublessClient10
ObjectStublessClient26
ObjectStublessClient17
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient18
ObjectStublessClient24
ObjectStublessClient21
ObjectStublessClient22
ObjectStublessClient25
ObjectStublessClient28
ObjectStublessClient27
ObjectStublessClient20
ObjectStublessClient16
ObjectStublessClient19
ObjectStublessClient6

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveFileSpecW
PathStripToRootW
PathStripPathW

api-ms-win-core-heap-l1-2-0

HeapDestroy

api-ms-win-core-localization-l1-2-1

GetThreadLocale
FormatMessageW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
CreateActCtxW
ActivateActCtx
ReleaseActCtx

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

CoCreateActivity
CoEnterServiceDomain
CoLeaveServiceDomain
CoLoadServices
ComSvcsExceptionFilter
ComSvcsLogError
CosGetCallContext
DispManGetContext
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetMTAThreadPoolMetrics
GetManagedExtensions
GetObjectContext
GetTrkSvrObject
MTSCreateActivity
MiniDumpW
RecycleSurrogate
SafeRef

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 3B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a746f4907aaf00e3174a5f0447fa37a4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-com-l1-1-1

api-ms-win-core-processthreads-l1-1-2

oleaut32

api-ms-win-core-memory-l1-1-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-security-base-l1-2-0

rpcrt4

authz

api-ms-win-core-path-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

kernel32

ole32

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.orpc Size: 4KB - Virtual size: 4KB

.data Size: 16KB - Virtual size: 40KB

.pdata Size: 44KB - Virtual size: 43KB

.idata Size: 18KB - Virtual size: 17KB

.didat Size: 1024B - Virtual size: 672B

.tls Size: - Virtual size: 3B

.rsrc Size: 133KB - Virtual size: 132KB

.reloc Size: 34KB - Virtual size: 33KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.orpc
Size: 4KB - Virtual size: 4KB

.data
Size: 16KB - Virtual size: 40KB

.pdata
Size: 44KB - Virtual size: 43KB

.idata
Size: 18KB - Virtual size: 17KB

.didat
Size: 1024B - Virtual size: 672B

.tls
Size: - Virtual size: 3B

.rsrc
Size: 133KB - Virtual size: 132KB

.reloc
Size: 34KB - Virtual size: 33KB