gcapi[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
gcapi.dll
Size 385KB
Sample260924-27menathqa
SHA256 73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
MD5 1ce7d5a1566c8c449d0f6772a8c27900
SHA1 60854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA512 7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
SSDEEP 6144:Tv/ioKdMF+LZD/ZRj1vwWrrUFMNoz4pFGxjEB1NYAOrabN2GZvFcD7:Td+LZrNwWrrwMNoz4vG1OYZabtK7
TLSH
T1F784AE11F48180B1E4BE057439B9BE6649BCAD11072896EBD7E80C2F5E746D1B733BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gcapi.dll

File Explorer

gcapi.dll

.dll 385KB

gcapi.dll

IMPHASH 18a9672c82a5e7523b8185670465b54e
SHA256 73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
MD5 1ce7d5a1566c8c449d0f6772a8c27900
SHA1 60854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA512 7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
SSDEEP 6144:Tv/ioKdMF+LZD/ZRj1vwWrrUFMNoz4pFGxjEB1NYAOrabN2GZvFcD7:Td+LZrNwWrrwMNoz4vG1OYZabtK7
TLSH
T1F784AE11F48180B1E4BE057439B9BE6649BCAD11072896EBD7E80C2F5E746D1B733BA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

134202

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\b\build\slave\win\build\src\out\Release\gcapi_dll.dll.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeGetTime

kernel32

GetCommandLineW LocalFree IsDebuggerPresent GetCurrentProcess WaitForSingleObject GetCurrentThreadId Sleep RaiseException CreateDirectoryW ReadFile GetTempPathW GetFileAttributesW GetCurrentDirectoryW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetModuleHandleExW GetProcAddress GetModuleHandleW GetVersionExW GetNativeSystemInfo TzSpecificLocalTimeToSystemTime FileTimeToSystemTime QueryPerformanceFrequency SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime QueryPerformanceCounter SetEndOfFile SetFilePointerEx FlushFileBuffers GetTickCount FindClose TlsSetValue TlsAlloc TlsGetValue TlsFree RtlCaptureStackBackTrace SetUnhandledExceptionFilter ExpandEnvironmentStringsW VirtualQuery GetSystemInfo HeapAlloc HeapReAlloc HeapFree OpenProcess FindResourceW SetHandleInformation HeapSize ReadConsoleW UnlockFileEx LockFileEx GetWindowsDirectoryW GetSystemDirectoryW GetUserDefaultUILanguage GetEnvironmentVariableW CreateProcessW ResumeThread AssignProcessToJobObject FormatMessageA GetCurrentProcessId CloseHandle DeleteFileW GetLastError CreateFileW GetModuleFileNameW OutputDebugStringA WriteFile SetLastError GetLocalTime lstrlenW LoadResource LockResource VirtualProtect FreeLibrary LoadLibraryExA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar InitializeCriticalSectionAndSpinCount CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwind InterlockedFlushSList LoadLibraryExW GetConsoleCP GetConsoleMode ExitProcess GetFullPathNameW SetStdHandle GetFileType GetProcessHeap GetModuleFileNameA IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetTimeZoneInformation GetACP WriteConsoleW GetDriveTypeW FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW OutputDebugStringW SizeofResource

ole32

CoInitializeSecurity CoCreateInstance CoSetProxyBlanket CoUninitialize CoInitializeEx CoTaskMemFree

user32

CharUpperW SetWindowPos GetShellWindow EnumWindows GetClassNameW GetWindowThreadProcessId

advapi32

CreateProcessAsUserW ConvertSidToStringSidW RevertToSelf ImpersonateLoggedOnUser GetTokenInformation FreeSid SystemFunction036 DuplicateTokenEx CheckTokenMembership AllocateAndInitializeSid OpenProcessToken RegCloseKey RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

oleaut32

SysAllocString SysFreeString VariantClear

rpcrt4

UuidCreate

Name

.text

Size

288KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

808B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

gcapi.dll

version

winmm

kernel32

ole32

user32

advapi32

userenv

oleaut32

rpcrt4

generic