ExSMime[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

ExSMime.dll
Size

219KB
MD5

49a2801a148793f244a92c7a8dc4239f
SHA1

5b9c5cd2480e379e70264ac3e49fae8f7df42bc8
SHA256

e9c0d9879b03cd09433e3109847cc8266b1b80170e116b10fd48dbd0a268bca0
SHA512

6ec177915ebc05127805316a91ec4f9991023f1d563de06f0e7c356ece9f9dc12f7301e1a18af6c68254e518d09dc5ef6d5f569bb4847a38da76825a0d01fa55
SSDEEP

3072:Qgj9eW7kJQZXOod0GY9BfcZcpM6bFuOuTa20sZHx6A16/BSQj4VGoRSmA9y0iVb+:QgjRXVkpM6bnuTvX61EA9yTS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExSMime.dll

Files

ExSMime.dll
.dll regsvr32 windows:10 windows x86 arch:x86

3e9e3488497edb4829e91bef07e72538

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

exsmime.pdb

Imports

msvcrt

__dllonexit
_unlock
_lock
_onexit
_except_handler4_common
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
memset
_callnewh
_ultoa_s
strchr
_snprintf_s
memchr
wcscat_s
free
strcpy_s
malloc
wcscpy_s
_purecall
memcpy_s
wcsncpy_s
memcmp

oleaut32

VariantCopy
SysFreeString
VariantClear
VarCmp
SysAllocString
VarUI4FromStr
SysStringLen
VariantChangeType
VariantInit

api-ms-win-core-errorhandling-l1-1-1

SetLastError
RaiseException
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

DeleteCriticalSection
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-memory-l1-1-2

VirtualAlloc
VirtualFree

api-ms-win-core-url-l1-1-0

PathCreateFromUrlW
UrlIsW
PathIsURLW

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FindResourceExW
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameW
LoadResource
SizeofResource
FreeLibrary
GetProcAddress

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExA
RegCloseKey

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-file-l1-2-1

GetTempFileNameW
SetFilePointerEx
GetFileInformationByHandle
SetEndOfFile
WriteFile
GetTempPathW
CreateFileW
FileTimeToLocalFileTime
FlushFileBuffers
ReadFile

api-ms-win-core-localization-l1-2-1

IsDBCSLeadByteEx

api-ms-win-core-shlwapi-obsolete-l1-2-0

StrCmpNA
StrCmpNIA

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e9e3488497edb4829e91bef07e72538

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-url-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-shlwapi-obsolete-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 201KB - Virtual size: 200KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 192B

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 201KB - Virtual size: 200KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 192B

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 10KB - Virtual size: 10KB