vaultcli[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

vaultcli.dll
Size

360KB
MD5

5cf7dcf91ab3371cab367b0b54d4e306
SHA1

61a3b815da6d58ddb04fb5e755f069b5e35b2d46
SHA256

a271fe19b43a2c1ae780859e9cfb50c2585db0c3982d50fd161c1a684e4369c4
SHA512

f0a081a3007ecdbbba01408c23f76c91b1df260bf57a41c0afb5d7e0d5d8c7b93b14d4dab0176cc32049d273decdeaad73458a125725f0afdb916b50942cada1
SSDEEP

6144:BlvdHBoK3Y20ccAl7yeLDkXHddG2j5f2lGwOZIh7rRHKqVWy:jvt2aY2TzMefkXdsC5f2llh7rRqqW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vaultcli.dll

Files

vaultcli.dll
.dll windows:10 windows x64 arch:x64

Password: infected

40977f72cc99dd9943a02d4d46c53930

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

vaultcli.pdb

Imports

msvcrt

memcmp
_unlock
_vsnwprintf
__dllonexit
_onexit
memcpy_s
__CxxFrameHandler4
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
realloc
memmove_s
wcsncmp
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
??1type_info@@UEAA@XZ
??_V@YAXPEAX@Z
??1exception@@UEAA@XZ
_lock
__CxxFrameHandler3
?terminate@@YAXXZ
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
??3@YAXPEAX@Z
__C_specific_handler
memset

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc
HeapSize

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
InitOnceExecuteOnce
InitOnceBeginInitialize

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
RegisterTraceGuidsW
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceEnableLevel

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventActivityIdControl
EventSetInformation
EventWriteTransfer
EventRegister

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleW
LoadStringW
GetProcAddress
FreeLibrary

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
CreateMutexExW
ReleaseSRWLockShared
InitializeSRWLock
ReleaseMutex
WaitForSingleObject
AcquireSRWLockShared
ReleaseSRWLockExclusive
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseSemaphore
WaitForSingleObjectEx

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
SetThreadToken
OpenProcessToken
TerminateProcess
GetCurrentProcess
OpenThreadToken

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-security-base-l1-1-0

DuplicateToken
GetTokenInformation
RevertToSelf

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-security-base-l1-2-0

CheckTokenCapability

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns
CreateThreadpool
CreateThreadpoolWork
CloseThreadpool

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
VaultAddItem
VaultCloseVault
VaultCreateItemType
VaultDeleteItemType
VaultEnumerateItemTypes
VaultEnumerateItems
VaultEnumerateVaults
VaultFindItems
VaultFree
VaultGetInformation
VaultGetItem
VaultGetItemType
VaultOpenVault
VaultRemoveItem

Sections

.text
Size: 224KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

40977f72cc99dd9943a02d4d46c53930

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 224KB - Virtual size: 220KB

.rdata Size: 96KB - Virtual size: 94KB

.data Size: 4KB - Virtual size: 3KB

.pdata Size: 16KB - Virtual size: 12KB

.didat Size: 4KB - Virtual size: 568B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 224KB - Virtual size: 220KB

.rdata
Size: 96KB - Virtual size: 94KB

.data
Size: 4KB - Virtual size: 3KB

.pdata
Size: 16KB - Virtual size: 12KB

.didat
Size: 4KB - Virtual size: 568B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 6KB