wmfclearkey[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wmfclearkey.dll
Size 871KB
Sample260724-2mlydst1ft
SHA256 aee24a3cfcb602be6ebfe55a4e41d0ae77961ddfac971a8e7c63df8bda97ae7c
MD5 90fe13d6d26e65a7379b2dc50a973020
SHA1 86ef0c15aa0ca446d01075599625b2c76795b835
SHA512 c79ea3d1a8dcca4878ec6a3c051a82d69e1c04a22d2541e3245a85dce67b9d619e6bbabf744821195379560e06bc962f2928d7ef7e06dd2d53dca713778d11ed
SSDEEP 12288:Cdx5MGOiUCdepPWn6Fw9ldiuuBpYHimbi678x7TQ:YXyCsRY9Liu4puiA78x
TLSH
T1F9159C53B695A27ED24AE07493478A7EB536B0CA0231BCBF11E4A6343F96F550F1CB18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wmfclearkey.dll

File Explorer

wmfclearkey.dll

.dll 871KB

wmfclearkey.dll

IMPHASH 60b399fb592cebf52807ed01b20d5a37
SHA256 aee24a3cfcb602be6ebfe55a4e41d0ae77961ddfac971a8e7c63df8bda97ae7c
MD5 90fe13d6d26e65a7379b2dc50a973020
SHA1 86ef0c15aa0ca446d01075599625b2c76795b835
SHA512 c79ea3d1a8dcca4878ec6a3c051a82d69e1c04a22d2541e3245a85dce67b9d619e6bbabf744821195379560e06bc962f2928d7ef7e06dd2d53dca713778d11ed
SSDEEP 12288:Cdx5MGOiUCdepPWn6Fw9ldiuuBpYHimbi678x7TQ:YXyCsRY9Liu4puiA78x
TLSH
T1F9159C53B695A27ED24AE07493478A7EB536B0CA0231BCBF11E4A6343F96F550F1CB18
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

d:\agent\_work\7\s\out\Release\wmfclearkey.pdb

accessiblemarshal

AccessibleMarshal_Configure

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

comctl32

InitCommonControlsEx

gdi32

GetDeviceCaps GetStockObject

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeProcThreadAttributeList LeaveCriticalSection LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnmapViewOfFile UpdateProcThreadAttribute VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW

msvcrt

__iob_func _amsg_exit _initterm _lock _unlock abort calloc free fwrite memcmp memcpy memmove memset realloc strlen strncmp vfprintf

ntdll

NtCreateFile NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

ole32

CoCreateGuid CoInitializeEx CoUninitialize

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

user32

GetDesktopWindow GetSystemMetrics IsWindowVisible

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoSizeW

ws2_32

GetHostNameW WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown

Name

.text

Size

654KB

Virtual Size

653KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

169B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.debug

Size

512B

Virtual Size

99B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.lcfg

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

wmfclearkey.dll

accessiblemarshal

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

bcrypt

comctl32

gdi32

kernel32

msvcrt

ntdll

ole32

shell32

shlwapi

user32

userenv

version

ws2_32

generic