USERENV[.]dll | Triage™

General

Target
USERENV.dll
Size 80.0MB
Sample260804-drdwkscb52
SHA256 0627318f8a8ed95776f02e93b2d4f34ef98cf81a8b03e827dcaffacd45a1dd62
MD5 b86a87a1d04099babff3cb41fd507912
SHA1 e0de269a2581b8094f76e0cd7eb0b917eb79cbd1
SHA512 51beb68d14a6304ed5c9f9ede11e6a4752edd162649912017b4ae629b4bfa3fab6152a684f4f3cf15cdc057a2a5d6d390b6bb635212372d641d645709abf5630
SSDEEP 1572864:IDBK+kp0v4/vdd8tbPMC7jvjtZDT98rcSu+MuoHvTyE9+BH:MkpqQvz8lf7jjtZDJ8rIHuoOEMH
TLSH
T12C08337C00B3A4C4F7E06DBAE1ABE719780ECA559D5D1684B91CB4C5BB3C6320BA742D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
USERENV.dll

File Explorer

USERENV.dll

.dll 80.0MB

USERENV.dll

SHA256 0627318f8a8ed95776f02e93b2d4f34ef98cf81a8b03e827dcaffacd45a1dd62
MD5 b86a87a1d04099babff3cb41fd507912
SHA1 e0de269a2581b8094f76e0cd7eb0b917eb79cbd1
SHA512 51beb68d14a6304ed5c9f9ede11e6a4752edd162649912017b4ae629b4bfa3fab6152a684f4f3cf15cdc057a2a5d6d390b6bb635212372d641d645709abf5630
SSDEEP 1572864:IDBK+kp0v4/vdd8tbPMC7jvjtZDT98rcSu+MuoHvTyE9+BH:MkpqQvz8lf7jjtZDJ8rIHuoOEMH
TLSH
T12C08337C00B3A4C4F7E06DBAE1ABE719780ECA559D5D1684B91CB4C5BB3C6320BA742D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

AreThereVisibleLogoffScripts AreThereVisibleShutdownScripts CreateAppContainerProfile CreateEnvironmentBlock CreateProfile DeleteAppContainerProfile DeleteProfileA DeleteProfileW DeriveAppContainerSidFromAppContainerName DeriveRestrictedAppContainerSidFromAppContainerSidAndRestrictedName DestroyEnvironmentBlock DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer EnterCriticalPolicySection ExpandEnvironmentStringsForUserA ExpandEnvironmentStringsForUserW ForceSyncFgPolicy FreeGPOListA FreeGPOListW GenerateGPNotification GetAllUsersProfileDirectoryA GetAllUsersProfileDirectoryW GetAppContainerFolderPath GetAppContainerRegistryLocation GetAppliedGPOListA GetAppliedGPOListW GetDefaultUserProfileDirectoryA GetDefaultUserProfileDirectoryW GetGPOListA GetGPOListW GetNextFgPolicyRefreshInfo GetPreviousFgPolicyRefreshInfo GetProfileType GetProfilesDirectoryA GetProfilesDirectoryW GetUserProfileDirectoryA GetUserProfileDirectoryW HasPolicyForegroundProcessingCompleted LeaveCriticalPolicySection LoadProfileExtender LoadUserProfileA LoadUserProfileW ProcessGroupPolicyCompleted ProcessGroupPolicyCompletedEx RefreshPolicy RefreshPolicyEx RegisterGPNotification RsopAccessCheckByType RsopFileAccessCheck RsopLoggingEnabled RsopResetPolicySettingStatus RsopSetPolicySettingStatus UnloadProfileExtender UnloadUserProfile UnregisterGPNotification WaitForMachinePolicyForegroundProcessing WaitForUserPolicyForegroundProcessing

Sharing

General

Malware Config

Signatures

File Explorer

USERENV.dll

generic