wtsapi32[.]dll

General

Target

wtsapi32.dll
Size

24KB
MD5

d904b6f8c14f93e6bd8d6ba3aec454fb
SHA1

8892aa1aff26032a067afb3d5611f57fcecc786c
SHA256

8c72e40e713fb83e603d9830edec912f474a1e02fe554bbb01a828cb0caa370d
SHA512

3cc47bc3446b911919729225a926298a479842040972fb703c980933c2a98d46cac3af554c4c08e1ff28cfcb4771f943237058ad8fe17c5a3f817da86c3d1882
SSDEEP

768:CoR2pZkxKo0P1G9ZdNpU6xZ3Wgq9pOHv:C6bxv0NGFNp5D3xq9pOP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wtsapi32.dll

Files

wtsapi32.dll
.dll windows:6 windows x86 arch:x86

1793f83f6d3d5f8ce77039054ef60394

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

wsprintfW

shell32

SHGetSpecialFolderPathW

advapi32

RegOpenKeyExA

Exports

Exports

WTSCloseServer
WTSDisconnectSession
WTSEnumerateProcessesA
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSEnumerateServersW
WTSEnumerateSessionsA
WTSEnumerateSessionsW
WTSFreeMemory
WTSLogoffSession
WTSOpenServerA
WTSOpenServerW
WTSQuerySessionInformationA
WTSQuerySessionInformationW
WTSQueryUserConfigA
WTSQueryUserConfigW
WTSQueryUserToken
WTSRegisterSessionNotification
WTSSendMessageA
WTSSendMessageW
WTSSetSessionInformationA
WTSSetSessionInformationW
WTSSetUserConfigA
WTSSetUserConfigW
WTSShutdownSystem
WTSTerminateProcess
WTSUnRegisterSessionNotification
WTSVirtualChannelClose
WTSVirtualChannelOpen
WTSVirtualChannelPurgeInput
WTSVirtualChannelPurgeOutput
WTSVirtualChannelQuery
WTSVirtualChannelRead
WTSVirtualChannelWrite
WTSWaitSystemEvent

Sections

.text
Size: 18KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1793f83f6d3d5f8ce77039054ef60394

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

advapi32

Exports

Exports

Sections

.text Size: 18KB - Virtual size: 52KB

.rsrc Size: 5KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 512B

.text
Size: 18KB - Virtual size: 52KB

.rsrc
Size: 5KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 512B