biwinrt[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

biwinrt.dll
Size

136KB
MD5

4197b806f8b80a78322918933defbe96
SHA1

3a444d6f0f725de05bcde9399ab67288ed64f45d
SHA256

3c1be23d56513566c20342f60737c252e65b1ecf713787589e4f836a65d4d6b4
SHA512

98d82c8f2d7579bfd2c629d602a55a5b3d99f41dded488cfee5a841e1e74da019f0489f6aa1582cc139765e9d542bb64bd897a92a7e138c45857f5f841f494fe
SSDEEP

1536:73T5Zph+mpg5tex8VmHbmqFmENbvkLgA17dWRyBeWzXSCPnhNNoZ6ZS2:xZphIA/9bvWWIeWzXSCAYS2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
biwinrt.dll

Files

biwinrt.dll
.dll windows:6 windows x64 arch:x64

7af0d248020b6451e0980f1f6b623019

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

biwinrt.pdb

Imports

msvcrt

_unlock
?terminate@@YAXXZ
__C_specific_handler
__CxxFrameHandler3
__dllonexit
??2@YAPEAX_K@Z
_amsg_exit
_purecall
_XcptFilter
realloc
memmove_s
_initterm
_onexit
wcschr
malloc
free
_lock
??3@YAXPEAX@Z
memcpy
memset

ntdll

NtQueryInformationToken
RtlCompareUnicodeString
RtlInitUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
NtQueryWnfStateData
WinSqmAddToStreamEx
RtlAllocateHeap
RtlFreeHeap
RtlCompareMemory
RtlNtStatusToDosErrorNoTeb
RtlRunOnceInitialize
RtlRunOnceComplete
RtlNtStatusToDosError
RtlRunOnceBeginInitialize

api-ms-win-core-com-l1-1-1

CoMarshalInterface
CoTaskMemFree
RoGetAgileReference
CoReleaseMarshalData
CoUnmarshalInterface
CreateStreamOnHGlobal
CoCreateFreeThreadedMarshaler
CoDecrementMTAUsage
CoTaskMemAlloc
CoGetClassObject
CoGetApartmentType
CoIncrementMTAUsage

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsDuplicateString
WindowsCreateStringReference

api-ms-win-core-synch-l1-2-0

Sleep
SetEvent
WaitForSingleObject
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
CreateEventW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
TraceMessage
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoOriginateError
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoOriginateErrorW
RoTransformError

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

GetProcessHeap

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
OpenProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
OpenProcessToken

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoActivateInstance
RoInitialize

rpcrt4

RpcBindingFree
RpcBindingBind
RpcBindingCreateW
NdrClientCall3
RpcExceptionFilter

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-heap-obsolete-l1-1-0

GlobalFree
GlobalAlloc

api-ms-win-service-private-l1-1-1

WaitServiceState

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7af0d248020b6451e0980f1f6b623019

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-com-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-winrt-l1-1-0

rpcrt4

api-ms-win-service-management-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-service-private-l1-1-1

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 118KB - Virtual size: 118KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 5KB - Virtual size: 5KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 118KB - Virtual size: 118KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 5KB - Virtual size: 5KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB