themeui[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

themeui.dll
Size

477KB
MD5

7484235ac7c5a926110845cd851d5d32
SHA1

4d5b4db3f84264c77939b71c45fff9c0b9f7ad4b
SHA256

b9e42c6a98f261881ccf75dd7d5bce090ecb0bfe4eefba0010060a1e43320d71
SHA512

b0b0c5c4ebe289b35b353ec5be7c3ba4dbfa6816c3af16758623dbbd1f809ec84c3a98936ee9ddf8762872f94a1a1c66e1890a66447de1841e93587b2645c816
SSDEEP

12288:S3NWcHELjB8/+SKp8CFvJq36gKeYSr1NWHHd6MZvmj9f/2V/eo:S3NWcm8/nWBi36gvYgUHv+j9no/e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
themeui.dll

Files

themeui.dll
.dll windows:10 windows x64 arch:x64

5933a152322f2191b4aee30c90c6609c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ThemeUI.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
wcscspn

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wtoi
_o_memcpy_s
_o_terminate
_o_toupper
_o_towupper
_o_wcsncpy_s
__C_specific_handler
__CxxFrameHandler3
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
wcschr
__std_terminate
__CxxFrameHandler4
_CxxThrowException
memcmp
memcpy

shcore

ord292
ord142
IStream_Reset
ord170
IUnknown_QueryService
SHCreateThreadWithHandle
SHGetValueW
ord190
SHCreateStreamOnFileEx
SHStrDupW
SHUnicodeToUnicode
IsOS
ord162
ord290
SHRegSetPathW
SHDeleteValueW
SHRegGetValueW
SHSetValueW
SHRegGetPathW
ord222
SHCreateThread
ord123
SHDeleteKeyW
IUnknown_SetSite
IUnknown_Set
IStream_Size

shell32

SHGetFolderPathEx
SHGetKnownFolderPath
SHCreateItemFromParsingName
ExtractIconW
ord92
SHGetIDListFromObject
ord155
SHGetNameFromIDList
ord100
SHParseDisplayName
SHQueryRecycleBinW
ord147
ord28
SHCreateItemFromIDList
SHFileOperationW
ord102
SHChangeNotify
SHCreateItemWithParent
ord27
ord25
ord152
ord24
SHCreateShellItemArrayFromShellItem
SHCreateShellItemArrayFromIDLists
ord18
ord846

shlwapi

StrCmpIW
PathQuoteSpacesW
StrToIntW
PathAppendW
StrStrW
StrToIntExW
StrRChrW
StrChrW
StrDupW
ord460
PathFindFileNameW
ord23
StrCmpW
ord154
ord158
ord219
PathFileExistsW
StrCmpNW
UrlCompareW
PathFindExtensionW
PathRemoveFileSpecW
StrRStrIW
PathIsPrefixW
ord487
PathIsRelativeW
ord466
SHRegGetUSValueW
StrRChrA
ord456
PathStripPathA
PathRemoveFileSpecA
PathStripToRootW
StrTrimW
StrFormatByteSizeW
PathFindNextComponentW
PathIsDirectoryW
ord448
PathCombineW
PathAddBackslashW
PathIsUNCW
PathIsURLW
ord433
PathCommonPrefixW
StrStrIW
PathUnExpandEnvStringsW
StrCmpNIW
ord464
PathIsFileSpecW
PathRemoveExtensionW

api-ms-win-core-libraryloader-l1-2-0

FindStringOrdinal
FreeLibrary
GetModuleFileNameA
GetProcAddress
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
LoadStringW
GetModuleHandleW
DisableThreadLibraryCalls
FreeLibraryAndExitThread

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSection
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSemaphore
WaitForSingleObjectEx
CreateEventW
SetEvent
AcquireSRWLockShared
OpenSemaphoreW
EnterCriticalSection
ReleaseSRWLockShared
ResetEvent
OpenEventW
CreateMutexExW
CreateEventExW
CreateMutexW
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
HeapReAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CloseThreadpoolWork
WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWork

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentThread
TerminateProcess
GetCurrentProcessId
GetExitCodeThread
CreateThread
GetCurrentProcess
ResumeThread
GetCurrentThreadId
CreateProcessW
OpenThreadToken

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
LCMapStringW
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
StringFromCLSID
PropVariantClear
CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
StringFromGUID2
CLSIDFromString
CreateStreamOnHGlobal
CoIncrementMTAUsage
CoCreateInstance
CoTaskMemFree
CoGetMalloc
CoTaskMemRealloc
CoCreateFreeThreadedMarshaler
CoUninitialize
CoCreateGuid
CoInitializeEx

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTime
GetSystemDirectoryW
GetWindowsDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal

api-ms-win-core-file-l1-1-0

FindClose
DeleteFileW
FindNextFileW
FindFirstFileExW
GetFileAttributesExW
FindFirstFileW
GetLongPathNameW
SetFilePointer
ReadFile
LocalFileTimeToFileTime
GetTempFileNameW
WriteFile
SetFileTime
SetFileAttributesW
CreateFileW
GetDiskFreeSpaceExW
CreateDirectoryW
FileTimeToLocalFileTime
GetFileSize
CompareFileTime

api-ms-win-core-string-l2-1-0

CharUpperBuffW
IsCharUpperW
CharLowerW
CharNextW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
InitOnceBeginInitialize

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-path-l1-1-0

PathCchAddExtension
PathCchCanonicalize
PathCchRenameExtension
PathCchCombine
PathCchAppend

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
EventProviderEnabled
EventActivityIdControl

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx
ActivateActCtx
DeactivateActCtx
CreateActCtxW

api-ms-win-core-kernel32-legacy-l1-1-0

FileTimeToDosDateTime
MulDiv
DosDateTimeToFileTime

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
GetNumberFormatW

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiW

api-ms-win-core-privateprofile-l1-1-1

WritePrivateProfileSectionW

ntdll

EtwEventSetInformation
EtwEventWriteTransfer
EtwGetTraceEnableLevel
EtwEventUnregister
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwEventRegister
EtwEventActivityIdControl
WinSqmIncrementDWORD
WinSqmSetDWORD
EtwGetTraceLoggerHandle
WinSqmIsOptedIn
WinSqmAddToStream
EtwTraceMessage

gdi32

DeleteObject
CreateRectRgn
RestoreDC
SaveDC
CreateCompatibleBitmap
StretchBlt
SetStretchBltMode
GetPixel
ExtFloodFill
GetStockObject
SetMagicColors
GetRegionData
GdiAlphaBlend
BitBlt
SetLayout
GetObjectW
SetTextColor
SetBkMode
CreateFontIndirectW
CreateSolidBrush
GetDeviceCaps
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC

user32

EnumWindows
GetClassNameW
ReleaseDC
GetDC
GetParent
PostMessageW
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
GetSysColor
SetSysColors
SetCursor
LoadCursorW
SendNotifyMessageW
RegisterClassExW
SetWindowLongPtrW
UnregisterClassW
SystemParametersInfoW
GetSystemMetrics
CreateWindowInBand
CreateWindowExW
GetMessageW
GetWindowLongPtrW
SetTimer
DestroyWindow
KillTimer
PostQuitMessage
BeginPaint
EndPaint
DefWindowProcW
GetClientRect
FillRect
ShowWindow
SetForegroundWindow
ValidateRect
MonitorFromPoint
GetMonitorInfoW
OffsetRect
GetWindowLongW
DrawTextW
WaitForInputIdle
LoadImageW
GetFocus
SendMessageW
EnableWindow
GetDlgItem
IsWindow
GetWindow
CallWindowProcW
RedrawWindow
GetClassInfoW
RegisterClassW
SendDlgItemMessageW
CheckDlgButton
SetDlgItemInt
SetDlgItemTextW
LoadIconW
SetWindowLongW
SendMessageTimeoutW
EndTask
EnumChildWindows
MoveWindow
DrawIconEx
InvalidateRect
GetDlgCtrlID
IsDlgButtonChecked
GetDlgItemInt
DestroyIcon
LoadBitmapW
GetSysColorBrush
GetShellWindow
FindWindowW
OpenIcon
CopyRect
InflateRect
MessageBoxW
FindWindowExW
PostThreadMessageW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-crt-math-l1-1-0

sqrtf

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall

Sections

.text
Size: 365KB - Virtual size: 364KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5933a152322f2191b4aee30c90c6609c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

shcore

shell32

shlwapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-file-l1-2-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-privateprofile-l1-1-1

ntdll

gdi32

user32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 365KB - Virtual size: 364KB

.rdata Size: 88KB - Virtual size: 87KB

.data Size: 2KB - Virtual size: 11KB

.pdata Size: 15KB - Virtual size: 14KB

.didat Size: 1024B - Virtual size: 656B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 365KB - Virtual size: 364KB

.rdata
Size: 88KB - Virtual size: 87KB

.data
Size: 2KB - Virtual size: 11KB

.pdata
Size: 15KB - Virtual size: 14KB

.didat
Size: 1024B - Virtual size: 656B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB