wmiclnt[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

wmiclnt.dll
Size

11KB
MD5

59252b93d0f3120dbb5dcf93765f1c9e
SHA1

41d14d79074c6f5d33a56e604fb76a7a426843a3
SHA256

547e291c9fd59bb4dd831d2c2cb5ad2a03a239a1fb6a35ac542f3f3f80f4536f
SHA512

17148b93d7a3069ff6775f486ccb09ed071f9ddf33bc7b0d3cefe3f64684ec3f6741fa2974b9b9ef484d08ca7107b835babcc6af6860f3f9d236a14077c8a457
SSDEEP

192:u2DYgqTHiqylSfv4VPp7H+W7y/wYK8mRpQmWGcszW7VLW:uFn8HUjFGcYW7VLW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wmiclnt.dll

Files

wmiclnt.dll
.dll windows:6 windows x64 arch:x64

8d4eeb7446d6132b59aefc72ea2aab35

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

strrchr
_snprintf
_stricmp
printf
memset

kernel32

GetProcAddress
LoadLibraryA
GetModuleFileNameA
CreateFileA
SetEvent
GetProcessHeap
CreateProcessA
CreateEventA
GetLastError
OpenProcess
ResumeThread
GetSystemDirectoryW
LocalAlloc
GetCurrentProcess
SetConsoleCtrlHandler
CloseHandle
LocalFree

advapi32

GetTokenInformation
SetTokenInformation
EqualSid
AllocateAndInitializeSid
FreeSid
LookupPrivilegeValueA
ImpersonateLoggedOnUser
OpenProcessToken
CreateProcessAsUserW
DuplicateTokenEx
RevertToSelf
AdjustTokenPrivileges
ConvertSidToStringSidA

ntdll

NtOpenProcessToken
RtlAllocateHeap
NtTerminateProcess

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

psapi

EnumProcesses

Exports

Exports

BackupPerfRegistryToFileW
InstallPerfDllA
InstallPerfDllW
LoadPerfCounterTextStringsA
LoadPerfCounterTextStringsW
LpAcquireInstallationMutex
LpReleaseInstallationMutex
RestorePerfRegistryFromFileW
SetServiceAsTrustedA
SetServiceAsTrustedW
UnloadPerfCounterTextStringsA
UnloadPerfCounterTextStringsW
UpdatePerfNameFilesA
UpdatePerfNameFilesW
WmiCloseBlock
WmiDevInstToInstanceNameA
WmiDevInstToInstanceNameW
WmiEnumerateGuids
WmiExecuteMethodA
WmiExecuteMethodW
WmiFileHandleToInstanceNameA
WmiFileHandleToInstanceNameW
WmiFreeBuffer
WmiMofEnumerateResourcesA
WmiMofEnumerateResourcesW
WmiNotificationRegistrationA
WmiNotificationRegistrationW
WmiOpenBlock
WmiQueryAllDataA
WmiQueryAllDataMultipleA
WmiQueryAllDataMultipleW
WmiQueryAllDataW
WmiQueryGuidInformation
WmiQuerySingleInstanceA
WmiQuerySingleInstanceMultipleA
WmiQuerySingleInstanceMultipleW
WmiQuerySingleInstanceW
WmiReceiveNotificationsA
WmiReceiveNotificationsW
WmiSetSingleInstanceA
WmiSetSingleInstanceW
WmiSetSingleItemA
WmiSetSingleItemW

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8d4eeb7446d6132b59aefc72ea2aab35

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

advapi32

ntdll

userenv

psapi

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 624B

.pdata Size: 512B - Virtual size: 156B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 624B

.pdata
Size: 512B - Virtual size: 156B

.rsrc
Size: 1KB - Virtual size: 1KB