wtsapi32[.]dll | Triage™

General

Target
wtsapi32.dll
Size 125KB
Sample260817-j56fmsweqa
SHA256 6b426cca5c74b2901a31e92cd63faafc1f0a51b3f348fe78f60af1b708142bfd
MD5 384d6ed247d2d38113d0b6b6e274d863
SHA1 1d9d57ada885aed51be19d5cf56aa5a6881b7d7a
SHA512 b55385d9fcc170d9a46a76d348e861c7bf4c8734da46d49e0d36212ee7ff95935317f48fd8b85a24fcdf7e69faaef0823a837fb8fcb7295be41f9563496b9235
SSDEEP 3072:gk/gb4lq1NYcjVW92Ju8c/WFvjypSkcWDe0MIh:gBkU1u0u2Ju8+RHz
TLSH
T155C3495762A411BBE1B6823CC4A34A01E771B814D361DFEF03A0465A5F373E19E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wtsapi32.dll

File Explorer

wtsapi32.dll

.dll 125KB

wtsapi32.dll

IMPHASH 9fc471d988103ebf0e24e97f0b9968a5
SHA256 6b426cca5c74b2901a31e92cd63faafc1f0a51b3f348fe78f60af1b708142bfd
MD5 384d6ed247d2d38113d0b6b6e274d863
SHA1 1d9d57ada885aed51be19d5cf56aa5a6881b7d7a
SHA512 b55385d9fcc170d9a46a76d348e861c7bf4c8734da46d49e0d36212ee7ff95935317f48fd8b85a24fcdf7e69faaef0823a837fb8fcb7295be41f9563496b9235
SSDEEP 3072:gk/gb4lq1NYcjVW92Ju8c/WFvjypSkcWDe0MIh:gBkU1u0u2Ju8+RHz
TLSH
T155C3495762A411BBE1B6823CC4A34A01E771B814D361DFEF03A0465A5F373E19E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

RtlAddFunctionTable GetEnvironmentVariableA CreateDirectoryA CreateFileA GetFileSize ReadFile GetVolumeInformationA CloseHandle WaitForSingleObject CreateEventA CreateThread TlsAlloc GetSystemDirectoryA VirtualAlloc VirtualProtect VirtualFree DisableThreadLibraryCalls GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource LoadLibraryA lstrcmpA lstrcmpiA lstrcpyA lstrcatA lstrlenA FindResourceA GetComputerNameA WriteConsoleW CreateFileW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx

user32

wsprintfA

CrashReporter_Init CrashReporter_SetAppID CrashReporter_Shutdown CrashReporter_Submit IsInteractiveUserSession QueryActiveSession QueryUserToken RegisterUsertokenForNoWinlogon WTSCloseServer WTSConnectSessionA WTSConnectSessionW WTSCreateListenerA WTSCreateListenerW WTSDisconnectSession WTSEnableChildSessions WTSEnumerateListenersA WTSEnumerateListenersW WTSEnumerateProcessesA WTSEnumerateProcessesExA WTSEnumerateProcessesExW WTSEnumerateProcessesW WTSEnumerateServersA WTSEnumerateServersW WTSEnumerateSessionsA WTSEnumerateSessionsExA WTSEnumerateSessionsExW WTSEnumerateSessionsW WTSFreeMemory WTSFreeMemoryExA WTSFreeMemoryExW WTSGetChildSessionId WTSGetListenerSecurityA WTSGetListenerSecurityW WTSIsChildSessionsEnabled WTSLogoffSession WTSOpenServerA WTSOpenServerExA WTSOpenServerExW WTSOpenServerW WTSQueryListenerConfigA WTSQueryListenerConfigW WTSQuerySessionInformationA WTSQuerySessionInformationW WTSQueryUserConfigA WTSQueryUserConfigW WTSQueryUserToken WTSRegisterSessionNotification WTSRegisterSessionNotificationEx WTSSendMessageA WTSSendMessageW WTSSetListenerSecurityA WTSSetListenerSecurityW WTSSetRenderHint WTSSetSessionInformationA WTSSetSessionInformationW WTSSetUserConfigA WTSSetUserConfigW WTSShutdownSystem WTSStartRemoteControlSessionA WTSStartRemoteControlSessionW WTSStopRemoteControlSession WTSTerminateProcess WTSUnRegisterSessionNotification WTSUnRegisterSessionNotificationEx WTSVirtualChannelClose WTSVirtualChannelOpen WTSVirtualChannelOpenEx WTSVirtualChannelPurgeInput WTSVirtualChannelPurgeOutput WTSVirtualChannelQuery WTSVirtualChannelRead WTSVirtualChannelWrite WTSWaitSystemEvent

Name

.text

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

wtsapi32.dll

kernel32

user32

generic