wtsapi32[.]skinny[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

wtsapi32.skinny.dll
Size

1.0MB
MD5

fd3fee1a3b59f6a10ac217295b9e01e4
SHA1

be31bf358ffc070cf8e5256931e044793188cb23
SHA256

8e7d673b86a87c1b77a481d7cf79a1c9ba1d36f5a423b3d61099a6f5edf232fc
SHA512

5d18aae2b27bb48d059bafba253d441e0d347297f15fd92bc67860927a6953e538ccbf383b06cc576e3767e62b50020756a139c72164db421eaf60b3aa298683
SSDEEP

24576:bG7utVqoTZE1tZC0/K0EpZuYmsnbracgIL9Dan1lly:bGybXCHM0CpZuTsb4+ant

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wtsapi32.skinny.dll

Files

wtsapi32.skinny.dll
.dll windows:5 windows x86 arch:x86

9c0e3f1283b2b9ae3e9b1d48e8c36500

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
WriteFile
GetModuleFileNameW
IsProcessorFeaturePresent
Sleep
HeapFree
GetProcAddress
InterlockedDecrement
GetLastError
SetLastError
GetModuleHandleW
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetCommandLineA
DecodePointer
GetCurrentThreadId
RtlUnwind
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapSize
lstrcpyA

user32

CreateCaret
GetLayeredWindowAttributes
IsDlgButtonChecked
IsWindow
GetClipboardFormatNameA
DialogBoxParamA
WindowFromPoint
GetDC
GetSubMenu
ShowScrollBar
LookupIconIdFromDirectory
GetWindowContextHelpId
EnumDisplayDevicesA
EnableMenuItem
GetDialogBaseUnits
SetMenuContextHelpId
GetGuiResources
FindWindowExA
AdjustWindowRectEx
SetWindowTextA
CharNextA
ClientToScreen
ChildWindowFromPointEx
SetKeyboardState
GetWindow
GetFocus
GetWindowRgn
UnionRect
UpdateWindow
GetDoubleClickTime
GetComboBoxInfo
KillTimer
GetShellWindow
FindWindowA
GetCursorPos
SetWindowPlacement
TabbedTextOutA
ShowWindowAsync
GetPriorityClipboardFormat
GetDlgCtrlID
GetMenu
GetMenuCheckMarkDimensions

gdi32

GetBitmapDimensionEx
GetTextAlign
RoundRect
GetEnhMetaFileA
FlattenPath
GetCharABCWidthsA
SetMetaRgn
GetLayout
SaveDC
GetViewportExtEx
GetAspectRatioFilterEx
GetViewportOrgEx
SetMetaFileBitsEx
GetTextExtentPointA
GetCurrentObject
GetStretchBltMode
SetColorAdjustment
SetRectRgn
InvertRgn
GetBkMode
GdiAlphaBlend
GdiFlush
GetObjectType
SetBitmapDimensionEx
DPtoLP
Polyline
GetSystemPaletteUse
RemoveFontResourceExA
ResizePalette
LPtoDP
PolyDraw
Pie
BeginPath
GetBitmapBits
SetDCPenColor
ExtFloodFill
PlayMetaFile
GetRgnBox
SetWindowOrgEx
GetDCPenColor
ExtTextOutA
GetWindowOrgEx
GetCurrentPositionEx
PlgBlt
SelectClipPath
GetMapMode
UpdateColors
GetSystemPaletteEntries
SetWorldTransform
CancelDC
SetTextCharacterExtra

winspool.drv

AbortPrinter
WritePrinter
FindFirstPrinterChangeNotification
SetFormA
GetPrinterA
ConfigurePortA
SetPrinterDataExA
SetJobA
GetJobA
GetPrinterDataExA
EnumJobsA
EnumPrinterDataA
ConnectToPrinterDlg
GetFormA
EnumPrintersA
SetPrinterA
EnumPrinterKeyA
EnumFormsA

comdlg32

ChooseColorA
ReplaceTextA
PrintDlgExA
GetSaveFileNameA
FindTextA
GetFileTitleA
PrintDlgA
GetOpenFileNameA

version

VerQueryValueA
GetFileVersionInfoSizeA
VerFindFileA
VerInstallFileA

gdiplus

GdiplusStartup

userenv

GetProfilesDirectoryA
GetUserProfileDirectoryA

Exports

Exports

IsInteractiveUserSession
QueryActiveSession
QueryUserToken
RegisterUsertokenForNoWinlogon
WTSCloseServer
WTSConnectSessionA
WTSConnectSessionW
WTSCreateListenerA
WTSCreateListenerW
WTSDisconnectSession
WTSEnableChildSessions
WTSEnumerateListenersA
WTSEnumerateListenersW
WTSEnumerateProcessesA
WTSEnumerateProcessesExA
WTSEnumerateProcessesExW
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSEnumerateServersW
WTSEnumerateSessionsA
WTSEnumerateSessionsExA
WTSEnumerateSessionsExW
WTSEnumerateSessionsW
WTSFreeMemory
WTSFreeMemoryExA
WTSFreeMemoryExW
WTSGetChildSessionId
WTSGetListenerSecurityA
WTSGetListenerSecurityW
WTSIsChildSessionsEnabled
WTSLogoffSession
WTSOpenServerA
WTSOpenServerExA
WTSOpenServerExW
WTSOpenServerW
WTSQueryListenerConfigA
WTSQueryListenerConfigW
WTSQuerySessionInformationA
WTSQuerySessionInformationW
WTSQueryUserConfigA
WTSQueryUserConfigW
WTSQueryUserToken
WTSRegisterSessionNotification
WTSRegisterSessionNotificationEx
WTSSendMessageA
WTSSendMessageW
WTSSetListenerSecurityA
WTSSetListenerSecurityW
WTSSetRenderHint
WTSSetSessionInformationA
WTSSetSessionInformationW
WTSSetUserConfigA
WTSSetUserConfigW
WTSShutdownSystem
WTSStartRemoteControlSessionA
WTSStartRemoteControlSessionW
WTSStopRemoteControlSession
WTSTerminateProcess
WTSUnRegisterSessionNotification
WTSUnRegisterSessionNotificationEx
WTSVirtualChannelClose
WTSVirtualChannelOpen
WTSVirtualChannelOpenEx
WTSVirtualChannelPurgeInput
WTSVirtualChannelPurgeOutput
WTSVirtualChannelQuery
WTSVirtualChannelRead
WTSVirtualChannelWrite
WTSWaitSystemEvent

Sections

.text
Size: 915KB - Virtual size: 915KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9c0e3f1283b2b9ae3e9b1d48e8c36500

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

version

gdiplus

userenv

Exports

Exports

Sections

.text Size: 915KB - Virtual size: 915KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 103KB - Virtual size: 111KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 915KB - Virtual size: 915KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 103KB - Virtual size: 111KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 28KB - Virtual size: 27KB