AudioSes[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AudioSes.dll
Size

488KB
MD5

34ce046e760bc993cfc1ab12e4ece6b9
SHA1

e66a1c5cfdec30c037a1c558cbbf35e0ad2bf49b
SHA256

97a95dbb0744b28cfbb6be3fa7a70e0c3ee4f417006d974c6e4663ea846a32aa
SHA512

227029ed7b0e81937279533705ade9d8e419ab43a3ee9071afae00324683a098a6875f3d5afad7d0d1c84cb52e19337a2586b84adfe7d214f1f82331d9d01cbc
SSDEEP

6144:WI0Z7g337YVgOVNe5ZQmPJhz+94WQNFaEqKgXQ2ELJtJ6OnUEOIG:WXgnyVAnnhXFcEO

Score

1^/10

Malware Config

Signatures

Files

AudioSes.dll
.dll regsvr32 windows:6 windows x64 arch:x64

ebc875892c76a76e1c24aea4a7fe8c09

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/07/2018, 20:45

Not After

26/07/2019, 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:33:0c:2d:4d:97:9f:22:37:fb:ff:6c:69:75:84:72:b1:bd:6b:38:58:44:45:bf:a4:f6:a0:a3:1f:db:7b:62
Signer

Actual PE Digest

13:33:0c:2d:4d:97:9f:22:37:fb:ff:6c:69:75:84:72:b1:bd:6b:38:58:44:45:bf:a4:f6:a0:a3:1f:db:7b:62

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

AudioSes.pdb

Imports

msvcrt

_amsg_exit
_initterm
__C_specific_handler
memset
_lock
_wsplitpath_s
wcschr
_wcsnicmp
_unlock
_vsnwprintf
__dllonexit
calloc
_localtime64_s
_time64
_wcsicmp
_resetstkoflw
_onexit
_errno
memmove_s
realloc
??1type_info@@UEAA@XZ
__CxxFrameHandler3
_purecall
wcscpy_s
wcsncpy_s
wcscat_s
memcpy
memcmp
memcpy_s
malloc
free
floor
ceil
_CxxThrowException
_XcptFilter
pow

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
AlpcInitializeMessageAttribute
RtlInitUnicodeStringEx
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
AlpcGetMessageAttribute
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
RtlFreeHeap
RtlInitUnicodeString
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtQueryInformationToken
RtlDestroyMemoryZone
RtlDestroyMemoryBlockLookaside
RtlUnlockMemoryZone
RtlAllocateMemoryBlockLookaside
RtlCreateMemoryZone
RtlAllocateMemoryZone
RtlLockMemoryZone
RtlCreateMemoryBlockLookaside
RtlFreeMemoryBlockLookaside
RtlExtendMemoryBlockLookaside
ShipAssert
NtSetInformationThread
NtQueryInformationThread
NtQueryInformationProcess
RtlNtStatusToDosError

rpcrt4

CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
RpcSmDestroyClientContext
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
NdrDllUnregisterProxy
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
RpcStringBindingComposeW
RpcBindingFromStringBindingW
I_RpcExceptionFilter
RpcBindingFree
NdrClientCall3
RpcStringFreeW
NdrDllGetClassObject

oleaut32

BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal64
BSTR_UserUnmarshal64
LPSAFEARRAY_UserUnmarshal64
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserSize64
VariantTimeToSystemTime
BSTR_UserMarshal
LPSAFEARRAY_UserFree64
VarUI4FromStr
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserMarshal64
BSTR_UserFree64
BSTR_UserSize64
SystemTimeToVariantTime
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
BSTR_UserSize

api-ms-win-core-com-l1-1-1

CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoCreateFreeThreadedMarshaler
PropVariantClear
CoCreateGuid
StringFromGUID2

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
TraceEvent
RegisterTraceGuidsW
TraceMessage
GetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

LockResource
GetModuleHandleExW
SizeofResource
GetModuleHandleW
FindResourceExW
DisableThreadLibraryCalls
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
FreeLibrary
LoadResource

api-ms-win-core-heap-l1-2-0

HeapReAlloc
GetProcessHeap
HeapAlloc
HeapDestroy
HeapSize
HeapFree

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
TrySubmitThreadpoolCallback

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegEnumKeyExW

api-ms-win-core-synch-l1-2-0

InitOnceInitialize
SetEvent
InitializeCriticalSection
CreateWaitableTimerExW
CreateEventExW
SetWaitableTimer
EnterCriticalSection
InitOnceExecuteOnce
InitOnceBeginInitialize
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
OpenEventW
Sleep
CreateEventW
ResetEvent

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventRegister

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-1

GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-localization-l1-2-1

SetThreadLocale
GetThreadLocale

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-processthreads-l1-1-2

GetCurrentThread
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
CreateThread
GetCurrentThreadId
OpenProcessToken

api-ms-win-power-base-l1-1-0

PowerRegisterSuspendResumeNotification
PowerUnregisterSuspendResumeNotification

api-ms-win-core-memory-l1-1-2

MapViewOfFileEx
OpenFileMappingW
MapViewOfFile
PrefetchVirtualMemory
VirtualLock
GetProcessWorkingSetSizeEx
VirtualUnlock
UnmapViewOfFile
SetProcessWorkingSetSizeEx
CreateFileMappingW

api-ms-win-core-file-l1-2-1

GetFileSize

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-kernel32-legacy-l1-1-1

WaitForMultipleObjects
FindResourceW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

mmdevapi

ord11
ord10

combase

ord21
ord18
ord23
ord17
ord22
ord20
ord19
ord13
ord11
ord14
ord6
ord16
ord15
ord10
ord12
ord3
ord8
ord5
ord7
ord4
ord9
ord2

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 388KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 48B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_CONST
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

RT_DATA
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ebc875892c76a76e1c24aea4a7fe8c09

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

13:33:0c:2d:4d:97:9f:22:37:fb:ff:6c:69:75:84:72:b1:bd:6b:38:58:44:45:bf:a4:f6:a0:a3:1f:db:7b:62Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

rpcrt4

oleaut32

api-ms-win-core-com-l1-1-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-power-base-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-file-l1-2-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

mmdevapi

combase

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 388KB - Virtual size: 387KB

.orpc Size: 1KB - Virtual size: 1KB

RT_CODE Size: 1KB - Virtual size: 1KB

RT_BSS Size: - Virtual size: 48B

.data Size: 3KB - Virtual size: 3KB

.pdata Size: 24KB - Virtual size: 23KB

.idata Size: 11KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 24B

RT_CONST Size: 1024B - Virtual size: 888B

RT_DATA Size: 512B - Virtual size: 160B

.rsrc Size: 35KB - Virtual size: 34KB

.reloc Size: 8KB - Virtual size: 8KB

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

13:33:0c:2d:4d:97:9f:22:37:fb:ff:6c:69:75:84:72:b1:bd:6b:38:58:44:45:bf:a4:f6:a0:a3:1f:db:7b:62
Signer

.text
Size: 388KB - Virtual size: 387KB

.orpc
Size: 1KB - Virtual size: 1KB

RT_CODE
Size: 1KB - Virtual size: 1KB

RT_BSS
Size: - Virtual size: 48B

.data
Size: 3KB - Virtual size: 3KB

.pdata
Size: 24KB - Virtual size: 23KB

.idata
Size: 11KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 24B

RT_CONST
Size: 1024B - Virtual size: 888B

RT_DATA
Size: 512B - Virtual size: 160B

.rsrc
Size: 35KB - Virtual size: 34KB

.reloc
Size: 8KB - Virtual size: 8KB