imagehlp[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
imagehlp.dll
Size 106KB
Sample260809-afx9aser9s
SHA256 509ef25f9bac59ebf1c19ec141cb882e5c1a8cb61ac74a10a9f2bd43ed1f0585
MD5 75f0c1356bd7234ee70a3b661588985e
SHA1 2436bd0d1fb34302f4187f6e8986159e7dd7dc24
SHA512 f74688513b70e559316e4f583b36365126e5904c24eff65b70c9ae2d86b43a5258e29732d7f00d758e2271db283d549459180b26e90d3e552c264c9e9b681b5e
SSDEEP 3072:bx5E08bT6MN2fMbPw7+BrrDBm8GTeKzYJT708fCMrt9W:w08bT6MNGMbPwGJ/0KW
TLSH
T127B38D6A7BAC58A5E864C27888539F16C7B2F825135147EF42C8C57E1F03BD0AE387C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

imagehlp.dll

.dll 106KB

imagehlp.dll

IMPHASH dc585c2d8b916631658d19f42efe3eb6
SHA256 509ef25f9bac59ebf1c19ec141cb882e5c1a8cb61ac74a10a9f2bd43ed1f0585
MD5 75f0c1356bd7234ee70a3b661588985e
SHA1 2436bd0d1fb34302f4187f6e8986159e7dd7dc24
SHA512 f74688513b70e559316e4f583b36365126e5904c24eff65b70c9ae2d86b43a5258e29732d7f00d758e2271db283d549459180b26e90d3e552c264c9e9b681b5e
SSDEEP 3072:bx5E08bT6MN2fMbPw7+BrrDBm8GTeKzYJT708fCMrt9W:w08bT6MNGMbPwGJ/0KW
TLSH
T127B38D6A7BAC58A5E864C27888539F16C7B2F825135147EF42C8C57E1F03BD0AE387C9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

ae:aa:f8:ac:d3:da:d7:3a:f1:97:b9:af:18:4c:8d:b6:ae:17:29:43:59:3a:0b:57:6c:d6:c9:b7:4c:b0:01:8e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 20, 2023

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 3, 2023 - Feb 1, 2024

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:d2:21:24:31:4a:58:bf:2d:11:00:01:00:00:01:d2

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 25, 2023 - Feb 1, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

9136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

imagehlp.pdb

api-ms-win-crt-string-l1-1-0

memset strncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__cexit _o__configure_narrow_argv _o__execute_onexit_table _o__initialize_narrow_environment _o__initialize_onexit_table _o__seh_filter_dll _o__splitpath_s memmove _o__stricmp _o__ultoa_s _o_atoi _o_strcat_s _o_strcpy_s _o_strncpy_s __CxxFrameHandler3 _o___std_type_info_destroy_list strrchr _o__strnicmp __C_specific_handler memcmp memcpy

ntdll

RtlRunOnceExecuteOnce RtlCaptureContext RtlImageNtHeaderEx RtlLookupFunctionEntry RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId GetCurrentThreadId TlsGetValue GetCurrentProcess TerminateProcess TlsAlloc TlsFree TlsSetValue

api-ms-win-core-heap-l1-1-0

HeapAlloc HeapFree GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetLastError RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError

api-ms-win-core-file-l1-1-0

CreateFileA SetFileTime GetFileSize SetFilePointer SetEndOfFile

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeCriticalSection

api-ms-win-core-memory-l1-1-0

MapViewOfFileEx CreateFileMappingW VirtualQuery UnmapViewOfFile FlushViewOfFile MapViewOfFile VirtualProtect

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime SystemTimeToFileTime GetSystemTimeAsFileTime GetVersionExA GetSystemInfo GetVersion

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-1-0

FreeLibrary LoadLibraryExW LoadLibraryExA GetProcAddress GetModuleHandleExA GetModuleFileNameA

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-misc-l1-1-0

lstrcmpiA

api-ms-win-core-processenvironment-l1-1-0

SearchPathW

api-ms-win-core-localregistry-l1-1-0

RegOpenKeyExW RegCloseKey RegQueryValueExW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-eventing-provider-l1-1-0

EventUnregister

BindImage BindImageEx CheckSumMappedFile EnumerateLoadedModules EnumerateLoadedModules64 EnumerateLoadedModulesEx EnumerateLoadedModulesExW EnumerateLoadedModulesW64 FindDebugInfoFile FindDebugInfoFileEx FindExecutableImage FindExecutableImageEx FindFileInPath FindFileInSearchPath GetImageConfigInformation GetImageUnusedHeaderBytes GetSymLoadError GetTimestampForLoadedLibrary ImageAddCertificate ImageDirectoryEntryToData ImageDirectoryEntryToDataEx ImageEnumerateCertificates ImageGetCertificateData ImageGetCertificateDataEx ImageGetCertificateHeader ImageGetDigestStream ImageLoad ImageNtHeader ImageRemoveCertificate ImageRvaToSection ImageRvaToVa ImageUnload ImagehlpApiVersion ImagehlpApiVersionEx IsBufferCleanOfInvalidMarkers MakeSureDirectoryPathExists MapAndLoad MapFileAndCheckSumA MapFileAndCheckSumW ReBaseImage ReBaseImage64 RemoveInvalidModuleList RemovePrivateCvSymbolic RemovePrivateCvSymbolicEx RemoveRelocations ReportSymbolLoadSummary SearchTreeForFile SetCheckUserInterruptShared SetImageConfigInformation SetSymLoadError SplitSymbols StackWalk StackWalk64 StackWalkEx SymAddrIncludeInlineTrace SymAllocDiaString SymCleanup SymCompareInlineTrace SymEnumSym SymEnumSymbols SymEnumSymbolsEx SymEnumSymbolsExW SymEnumSymbolsForAddr SymEnumTypes SymEnumTypesByName SymEnumTypesByNameW SymEnumTypesW SymEnumerateModules SymEnumerateModules64 SymEnumerateSymbols SymEnumerateSymbols64 SymEnumerateSymbolsW SymEnumerateSymbolsW64 SymFindFileInPath SymFindFileInPathW SymFreeDiaString SymFromAddr SymFromInlineContext SymFromInlineContextW SymFromName SymFunctionTableAccess SymFunctionTableAccess64 SymFunctionTableAccess64AccessRoutines SymGetDiaSession SymGetExtendedOption SymGetLineFromAddr SymGetLineFromAddr64 SymGetLineFromInlineContext SymGetLineFromInlineContextW SymGetLineFromName SymGetLineFromName64 SymGetLineNext SymGetLineNext64 SymGetLinePrev SymGetLinePrev64 SymGetModuleBase SymGetModuleBase64 SymGetModuleInfo SymGetModuleInfo64 SymGetModuleInfoW SymGetModuleInfoW64 SymGetOptions SymGetSearchPath SymGetSourceFileChecksumW SymGetSourceFileFromTokenW SymGetSourceFileTokenW SymGetSourceVarFromTokenW SymGetSymFromAddr SymGetSymFromAddr64 SymGetSymFromName SymGetSymFromName64 SymGetSymNext SymGetSymNext64 SymGetSymPrev SymGetSymPrev64 SymGetSymbolFile SymGetSymbolFileW SymGetTypeFromName SymGetTypeFromNameW SymGetTypeInfo SymGetTypeInfoEx SymInitialize SymLoadModule SymLoadModule64 SymMatchFileName SymMatchFileNameW SymMatchString SymMatchStringA SymMatchStringW SymQueryInlineTrace SymRegisterCallback SymRegisterCallback64 SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64 SymSetContext SymSetDiaSession SymSetExtendedOption SymSetOptions SymSetScopeFromAddr SymSetScopeFromIndex SymSetScopeFromInlineContext SymSetSearchPath SymSrvGetFileIndexString SymSrvGetFileIndexStringW SymSrvGetFileIndexes SymSrvGetFileIndexesW SymUnDName SymUnDName64 SymUnloadModule SymUnloadModule64 TouchFileTimes UnDecorateSymbolName UnMapAndLoad UpdateDebugInfoFile UpdateDebugInfoFileEx

Name

.text

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mrdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

imagehlp.dll

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

ntdll

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-eventing-provider-l1-1-0

generic