api-ms-win-eventing-legacy-l1-1-0[.]dll | Triage

Sharing

General

Target

api-ms-win-eventing-legacy-l1-1-0.dll
Size

3KB
MD5

5c9ca143f675010138d468f9fe44c67e
SHA1

dc35803101803e4b49a4c945cb4f1c3a8d44130a
SHA256

c4569eff990dc243d83c3d58ad6799cfccb7f7e63de8dbacc186cdb0e4197c61
SHA512

8e525863692091900c89f1acf81cfb4d303df2cbd5f8f5036b92c2ed8784ed84603893f074ba04b3313959e236f60dccef6a3734c4f90297267d5bc6ae8adc58

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
api-ms-win-eventing-legacy-l1-1-0.dll

Files

api-ms-win-eventing-legacy-l1-1-0.dll
.dll windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

API-MS-Win-Eventing-Legacy-L1-1-0.pdb

Exports

Exports

ControlTraceA
EnableTrace
EnableTraceEx
EnumerateTraceGuids
FlushTraceA
FlushTraceW
OpenTraceA
QueryAllTracesA
QueryTraceA
QueryTraceW
StartTraceA
StopTraceA
UpdateTraceA
UpdateTraceW

Sections

.text
Size: 1024B - Virtual size: 546B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ