energytask[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

energytask.dll
Size

19KB
MD5

84d939785757b2c6e8262ef89506beb4
SHA1

5bbac44b1d77cbac34f94f2fc6e03a7e5850218d
SHA256

e598c10a949b61723b5a52932cc04e680ed0240455105303437ccab859052c69
SHA512

84b2ce660f3944c9d90421e4e496bed685cacce8b2e4267a4a6bddb72bdd7018f62fd38f245d73ba5f1451f87d743f05d836b3b0b7b8bdccbd4a50baff71996e
SSDEEP

384:4+JeSUEJtnw7GoM4u2bF63NaAkbssuTL0mpxOyJiaWTHuJ1WyEuW:4ZdXMb22aKTR4aaF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
energytask.dll

Files

energytask.dll
.dll regsvr32 windows:6 windows x64 arch:x64

ed76aa13f08fdd2c5e6e6108d5ad3f63

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

energytask.pdb

Imports

msvcrt

free
_vsnwprintf
??3@YAXPEAX@Z
_wcsdup
__C_specific_handler
_initterm
malloc
_amsg_exit
_XcptFilter
??2@YAPEAX_K@Z

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

ole32

CoTaskMemFree

advapi32

RegGetValueW

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-file-l1-2-1

CompareFileTime
DeleteFileW
FindNextFileW
FindClose
FindFirstFileW

api-ms-win-core-file-l2-1-0

CopyFileExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleExW
FreeLibraryAndExitThread
DisableThreadLibraryCalls

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
ResumeThread
CreateThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

Sleep
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetLocalTime

energy

EnergyWizard_DestroyEnergyWizard
EnergyWizard_SaveReport
EnergyWizard_CollectTrace
EnergyWizard_CreateEnergyWizard
EnergyWizard_Analyze
EnergyWizard_CancelTrace
SaveSleepStudyReport
EnergyWizard_TransformReport
EnergyWizard_SqmAnalysis
TransformSleepStudyReport

shell32

SHGetFolderPathAndSubDirW
SHGetKnownFolderPath
SHCreateDirectoryExW

api-ms-win-core-path-l1-1-0

PathCchAppend

kernel32

CopyFileW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed76aa13f08fdd2c5e6e6108d5ad3f63

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

ole32

advapi32

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-file-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

energy

shell32

api-ms-win-core-path-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 504B

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 68B

.text
Size: 11KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 504B

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 68B