pcicapi[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
pcicapi.dll
Size 48KB
Sample260701-lqfmsac18x
SHA256 a580826b0cdd59387b77f41015a2c54c8bfcdf359c0edc72993a50299918f404
MD5 394fbd2ae1a6cb460f27d6ff7badf6fc
SHA1 3574b44482d2fcf61d09d54dd777e9184e171699
SHA512 b052a4ed0662b21737840e4aaf8bfd8df5200439e8b533588c080a7c8779476740f4c378dc76c16f6717216b1785c2502c82f1e78245cda1eaa6f30ea3feed2c
SSDEEP 768:3YGznfNnu0sbqmuebcTYCBU1wn+Pam8Arr2pe/PZDXHDHf/ckMr2pe/snHDHf/cO:3YGzfFDmmTYCtMawee/BjHgee/wjHrH
TLSH
T1A2238D82BAB85153EBA24DBCB4D599036C7CF6B25BEC50C7B107465929093F23A7831B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

pcicapi.dll

.dll 48KB

pcicapi.dll

IMPHASH c09dcd07c8e93b972e6530c73f8ec4bf
SHA256 a580826b0cdd59387b77f41015a2c54c8bfcdf359c0edc72993a50299918f404
MD5 394fbd2ae1a6cb460f27d6ff7badf6fc
SHA1 3574b44482d2fcf61d09d54dd777e9184e171699
SHA512 b052a4ed0662b21737840e4aaf8bfd8df5200439e8b533588c080a7c8779476740f4c378dc76c16f6717216b1785c2502c82f1e78245cda1eaa6f30ea3feed2c
SSDEEP 768:3YGznfNnu0sbqmuebcTYCBU1wn+Pam8Arr2pe/PZDXHDHf/ckMr2pe/snHDHf/cO:3YGzfFDmmTYCtMawee/BjHgee/wjHrH
TLSH
T1A2238D82BAB85153EBA24DBCB4D599036C7CF6B25BEC50C7B107465929093F23A7831B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

10:55:97:7b:97:9b:ca:e6:1c:dc:bb:94:4c:4f:da:4e:0e:9f:11:8c:07:b8:e1:c5:c9:ae:e3:e7:f7:49:4d:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=02386638,CN=NETSUPPORT LTD.,O=NETSUPPORT LTD.,STREET=Netsupport House Towngate East\, Market Deeping,L=Peterborough,ST=Cambridgeshire,C=GB,1.2.840.113549.1.9.1=#0c196973406e6574737570706f7274736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 6, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Digest

21:b7:af:69:aa:b2:7f:17:6b:7d:8a:71:a5:d8:6c:50:98:73:0f:dc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Dec 6, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

1f:6c:98:ca:ad:2a:e7:c1:8a:bb:ca:ad

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 17, 2022 - Jun 17, 2025

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

16622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\nsmsrc\nsm\1410\1410\ctl32\release_unicode\pcicapi.pdb

kernel32

GetModuleFileNameW GetProcAddress GetModuleHandleW OutputDebugStringW LoadLibraryW FreeLibrary CloseHandle OpenProcess GetCurrentProcessId CreateEventW InterlockedIncrement GetVersionExW GetLocalTime GetTempPathW GetSystemTimeAsFileTime GetProcessTimes GetCurrentProcess GetCurrentThreadId GetTickCount GetLastError SetLastError GetVersion DisableThreadLibraryCalls Sleep LeaveCriticalSection EnterCriticalSection SetEvent InterlockedDecrement WaitForSingleObject DeleteCriticalSection CreateThread InitializeCriticalSection IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess InterlockedCompareExchange InterlockedExchange DecodePointer EncodePointer MultiByteToWideChar ExitProcess WideCharToMultiByte QueryPerformanceCounter

user32

DispatchMessageW TranslateMessage GetMessageW GetGuiResources SetTimer MessageBoxW KillTimer PeekMessageW PostQuitMessage wvsprintfW wsprintfW

advapi32

GetTokenInformation OpenProcessToken

msvcr100

_except_handler4_common _onexit _lock malloc wcsrchr wcsncmp fclose _wfopen wcsncat fputws strrchr memset iswctype memcpy free _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter _crt_debugger_hook __clean_type_info_names_internal _unlock __dllonexit

Sharing

General

Malware Config

Signatures

File Explorer

pcicapi.dll

kernel32

user32

advapi32

msvcr100

generic