encapi[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

encapi.dll
Size

25KB
MD5

5af5a63344b5ad84a4463c7051014417
SHA1

5c92556d65a30817749e06ded9b2bf704c43b8d6
SHA256

06f2b918f30dd7d5f04b7764bc13d5c45f233761c694f9fbf5e06a342762d2d7
SHA512

14d18f3330a0ce2142ab46327609afaabd6d3cb7fffc3598a9c5fd91a8b27694f9f38fb96277d518332162d99d7b9f41d1d4ddaeb03c1266d9458df802cc6a6b
SSDEEP

768:+hSC4Yxhe0M4LKah9+vhcPDQLHK93pnXW1Vx9VS:ydLjD0+YXVS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
encapi.dll

Files

encapi.dll
.dll regsvr32 windows:6 windows x64 arch:x64

66d894a1b9715202c459bc3e20f9206e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

encapi.pdb

Imports

msvcrt

_vsnwprintf
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memcmp
memset

oleaut32

SysStringByteLen
SysStringLen
SysAllocString
SysFreeString

api-ms-win-core-synch-l1-2-0

InitializeCriticalSection
SetEvent
EnterCriticalSection
CreateEventA
DeleteCriticalSection
CreateEventW
LeaveCriticalSection
ResetEvent
WaitForSingleObject

api-ms-win-core-com-l1-1-1

CoTaskMemFree
IIDFromString
CoInitializeEx
CoFreeUnusedLibraries
CoCreateInstance
CoTaskMemAlloc
StringFromGUID2
CoUninitialize

api-ms-win-core-io-l1-1-1

GetOverlappedResult
DeviceIoControl

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameA
GetProcAddress

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
CreateThread
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-2-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-kernel32-legacy-l1-1-1

WaitForMultipleObjects

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66d894a1b9715202c459bc3e20f9206e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-registry-l2-1-0

Exports

Exports

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 804B

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 512B - Virtual size: 192B

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 804B

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 512B - Virtual size: 192B