COLAPSO[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
COLAPSO.dll
Size 86.6MB
Sample261030-1ay7hsfe94
SHA256 832835081defedbc4dd1f71aff20ec0324a42ff0f0889828de7a460d0f9bc35a
MD5 10302a8c434dbd53b8907b0970fad2b6
SHA1 f37ece189a3137410519441baddfc53dc4ce8b2e
SHA512 7473b9e781bcdf1a2a92e9172be205d6cdf6c89583e72e52db521d8942da17b9fff1be1039aa6f9411683c969f902092fae884bee53a773386407d1d98ad8b78
SSDEEP 786432:zXiexiJGm3aMj/X6g5FQP4kd/b3jPyFFZpH7iJkHMMPWSBLnC:biRGm3aMLX6Lb3NJaMMPWS5nC
TLSH
T11618BE1777A50188D5BAD034CBA79627E772B882573097DF2194A3792F737E02E3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
COLAPSO.dll

File Explorer

COLAPSO.dll

.dll 86.6MB

COLAPSO.dll

IMPHASH 5d45fc48e173240f01844a34a09c51cb
SHA256 832835081defedbc4dd1f71aff20ec0324a42ff0f0889828de7a460d0f9bc35a
MD5 10302a8c434dbd53b8907b0970fad2b6
SHA1 f37ece189a3137410519441baddfc53dc4ce8b2e
SHA512 7473b9e781bcdf1a2a92e9172be205d6cdf6c89583e72e52db521d8942da17b9fff1be1039aa6f9411683c969f902092fae884bee53a773386407d1d98ad8b78
SSDEEP 786432:zXiexiJGm3aMj/X6g5FQP4kd/b3jPyFFZpH7iJkHMMPWSBLnC:biRGm3aMLX6Lb3NJaMMPWS5nC
TLSH
T11618BE1777A50188D5BAD034CBA79627E772B882573097DF2194A3792F737E02E3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

52:36:ac:c0:df:9a:59:f9:02:ab:d8:c6:70:e2:f5:4b:af:96:65:e5:10:7f:df:da:e1:1d:ad:b7:ad:46:d7:0b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=513089349,CN=IMAGINANDO\, LDA,O=IMAGINANDO\, LDA,STREET=Praça Manuel Fernandes da Silva\, Loja 97,L=Braga,ST=Braga,C=PT,1.2.840.113549.1.9.1=#0c12696e666f40696d6167696e616e646f2e7074,1.3.6.1.4.1.311.60.2.1.3=#13025054,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 16, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

3f:86:81:ff:69:a1:6e:06:b6:1e:67:ae

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 24, 2026 - Sep 13, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

36674096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

user32

AddClipboardFormatListener AdjustWindowRectEx AdjustWindowRectExForDpi AppendMenuW AreDpiAwarenessContextsEqual AttachThreadInput BeginPaint BringWindowToTop CallNextHookEx ChangeClipboardChain ChangeWindowMessageFilter ChangeWindowMessageFilterEx CharLowerBuffA CharPrevExA ChildWindowFromPointEx ClientToScreen CreateCaret CreateCursor CreateIconIndirect CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyCaret DestroyCursor DestroyIcon DestroyMenu DestroyWindow DispatchMessageW DisplayConfigGetDeviceInfo DrawIconEx DrawMenuBar EnableMenuItem EnableNonClientDpiScaling EndPaint EnumDisplayDevicesW EnumDisplayMonitors EnumWindows FindWindowA FlashWindowEx GetAncestor GetAsyncKeyState GetCapture GetCaretBlinkTime GetClassInfoW GetClientRect GetClipboardFormatNameW GetCursor GetCursorInfo GetCursorPos GetDC GetDesktopWindow GetDisplayConfigBufferSizes GetDoubleClickTime GetDpiForWindow GetFocus GetForegroundWindow GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardLayoutNameW GetKeyboardState GetMenu GetMenuItemInfoW GetMessageExtraInfo GetMessageTime GetMessageW GetMonitorInfoW GetParent GetPointerDeviceRects GetPointerFrameTouchInfo GetPointerFrameTouchInfoHistory GetPointerInfo GetPointerPenInfo GetPointerPenInfoHistory GetPointerType GetProcessWindowStation GetQueueStatus GetSysColor GetSystemMenu GetSystemMetrics GetSystemMetricsForDpi GetThreadDpiAwarenessContext GetUpdateRect GetUserObjectInformationW GetWindow GetWindowDpiAwarenessContext GetWindowLongPtrW GetWindowPlacement GetWindowRect GetWindowThreadProcessId HiliteMenuItem InsertMenuW InvalidateRect IsChild IsHungAppWindow IsIconic IsTouchWindow IsValidDpiAwarenessContext IsWindow IsWindowEnabled IsWindowVisible IsZoomed KillTimer LoadCursorW LoadIconW LoadImageW MapVirtualKeyW MapWindowPoints MessageBeep MessageBoxW ModifyMenuW MonitorFromPoint MonitorFromRect MonitorFromWindow MoveWindow MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostThreadMessageW QueryDisplayConfig RegisterClassExW RegisterClassW RegisterClipboardFormatW RegisterDeviceNotificationW RegisterPowerSettingNotification RegisterTouchWindow RegisterWindowMessageW ReleaseCapture ReleaseDC RemoveClipboardFormatListener RemoveMenu ScreenToClient SendInput SendMessageTimeoutW SendMessageW SetActiveWindow SetCapture SetCaretPos SetClipboardViewer SetCoalescableTimer SetCursor SetCursorPos SetDisplayAutoRotationPreferences SetFocus SetForegroundWindow SetLayeredWindowAttributes SetMenu SetMenuDefaultItem SetMenuItemInfoW SetParent SetProcessDpiAwarenessContext SetTimer SetWindowLongPtrW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowCaret ShowWindow SkipPointerFrameMessages SystemParametersInfoForDpi SystemParametersInfoW ToAscii ToUnicode TrackMouseEvent TrackPopupMenu TrackPopupMenuEx TranslateMessage UnhookWindowsHookEx UnregisterClassW UnregisterDeviceNotification UnregisterPowerSettingNotification UnregisterTouchWindow UpdateLayeredWindow UpdateLayeredWindowIndirect WindowFromPoint

shell32

CommandLineToArgvW SHBrowseForFolderW SHCreateItemFromIDList SHCreateItemFromParsingName ord6 SHGetFileInfoW ord727 SHGetKnownFolderIDList SHGetKnownFolderPath SHGetMalloc SHGetPathFromIDListW SHGetStockIconInfo ShellExecuteExW ShellExecuteW Shell_NotifyIconGetRect Shell_NotifyIconW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AllocConsole AttachConsole CancelIoEx CheckRemoteDebuggerPresent CloseHandle CloseThreadpoolWait CompareStringEx CompareStringW ConnectNamedPipe ConvertFiberToThread ConvertThreadToFiberEx CopyFileW CreateDirectoryW CreateEventW CreateFiberEx CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreateProcessW CreateSemaphoreA CreateThread CreateThreadpoolWait CreateWaitableTimerW DecodePointer DeleteCriticalSection DeleteFiber DeleteFileW DeviceIoControl DisconnectNamedPipe EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileExW FindFirstFileW FindNextChangeNotification FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeConsole FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetActiveProcessorCount GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrencyFormatW GetCurrentDirectoryW GetCurrentPackageFullName GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetGeoInfoW GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalDrives GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetOverlappedResult GetProcAddress GetProcessGroupAffinity GetProcessHeap GetProcessId GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadPriority GetTickCount GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetUserGeoID GetUserPreferredUILanguages GetVolumeInformationW GetVolumeNameForVolumeMountPointW GetVolumePathNameW GetVolumePathNamesForVolumeNameW GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetModuleFileNameExW LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LocaleNameToLCID MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenFile OpenProcess OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency QueueUserAPC RaiseException ReadConsoleA ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlDeleteFunctionTable RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleMode SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetLastError SetStdHandle SetThreadDescription SetThreadInformation SetThreadPriority SetThreadpoolWait SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToFiber SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WaitForMultipleObjects WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolWaitCallbacks WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpW

ws2_32

WSAAccept WSAAddressToStringW WSAAsyncSelect WSACleanup WSAConnect WSAGetLastError WSAHtonl WSAIoctl WSANtohl WSANtohs WSARecv WSARecvFrom WSASend WSASendTo WSASetLastError WSASocketA WSASocketW WSAStartup WSAStringToAddressW __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname getnameinfo getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

comctl32

ord413 ord412 ord410

crypt32

CertAddCertificateContextToStore CertAddStoreToCollection CertCloseStore CertCompareCertificate CertCreateCertificateContext CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertOpenStore CertOpenSystemStoreW CertSetCertificateContextProperty CertVerifyTimeValidity CryptAcquireCertificatePrivateKey CryptEncodeObject PFXImportCertStore

ole32

CLSIDFromString CoCreateFreeThreadedMarshaler CoCreateGuid CoCreateInstance CoGetMalloc CoInitialize CoInitializeEx CoLockObjectExternal CoTaskMemFree CoUninitialize CreateStreamOnHGlobal DoDragDrop OleFlushClipboard OleGetClipboard OleInitialize OleIsCurrentClipboard OleSetClipboard OleUninitialize PropVariantClear RegisterDragDrop ReleaseStgMedium RevokeDragDrop StringFromGUID2

advapi32

AddAccessAllowedAceEx AddAccessDeniedAceEx AllocateAndInitializeSid CopySid CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDestroyHash CryptDestroyKey CryptEnumProvidersW CryptExportKey CryptGenRandom CryptGetProvParam CryptGetUserKey CryptReleaseContext CryptSetHashParam CryptSignHashW DeregisterEventSource DuplicateToken FreeSid GetLengthSid GetNamedSecurityInfoW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetUserNameW InitializeAcl InitializeSecurityDescriptor LookupAccountNameW LookupAccountSidW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyA RegEnumKeyExW RegEnumValueW RegFlushKey RegNotifyChangeKeyValue RegOpenKeyA RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SystemFunction036

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

iphlpapi

ConvertInterfaceIndexToLuid ConvertInterfaceLuidToIndex ConvertInterfaceLuidToNameW ConvertInterfaceNameToLuidW GetAdaptersAddresses

gdi32

AddFontMemResourceEx AddFontResourceExW BitBlt ChoosePixelFormat CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateFontIndirectW CreateRectRgn DeleteDC DeleteObject DescribePixelFormat EnumFontFamiliesExW ExtTextOutW GdiFlush GetBitmapBits GetCharABCWidthsFloatW GetCharABCWidthsI GetCharABCWidthsW GetCharWidthI GetDIBits GetDeviceCaps GetFontData GetGlyphOutlineW GetObjectW GetOutlineTextMetricsW GetPixelFormat GetRegionData GetStockObject GetTextExtentPoint32W GetTextFaceW GetTextMetricsW OffsetRgn RemoveFontMemResourceEx RemoveFontResourceExW SelectClipRgn SelectObject SetBkMode SetGraphicsMode SetLayout SetPixelFormat SetTextAlign SetTextColor SetWorldTransform SwapBuffers

uxtheme

CloseThemeData ord47 GetCurrentThemeName GetThemeBackgroundRegion GetThemeBool GetThemeColor GetThemeEnumValue GetThemeInt GetThemeMargins GetThemePartSize GetThemePropertyOrigin GetThemeTransitionDuration IsAppThemed IsThemeActive IsThemeBackgroundPartiallyTransparent OpenThemeData SetWindowTheme

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmSetWindowAttribute

oleaut32

GetErrorInfo SafeArrayCreateVector SafeArrayPutElement SetErrorInfo SysAllocString SysFreeString SysStringLen VariantClear VariantInit

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptEnumContextFunctions BCryptFreeBuffer BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

ncrypt

NCryptExportKey NCryptFreeObject NCryptImportKey NCryptOpenStorageProvider NCryptSetProperty

secur32

AcceptSecurityContext AcquireCredentialsHandleW ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitSecurityInterfaceW InitializeSecurityContextW QueryContextAttributesW

icuuc

UCNV_FROM_U_CALLBACK_SUBSTITUTE UCNV_TO_U_CALLBACK_SUBSTITUTE ucnv_cbFromUWriteUChars ucnv_cbToUWriteUChars ucnv_close ucnv_fromUCountPending ucnv_fromUnicode ucnv_getFromUCallBack ucnv_getMaxCharSize ucnv_getName ucnv_getStandardName ucnv_getToUCallBack ucnv_open ucnv_reset ucnv_setFromUCallBack ucnv_setToUCallBack ucnv_toUCountPending ucnv_toUnicode

netapi32

NetApiBufferFree NetShareEnum

authz

AuthzAccessCheck AuthzFreeContext AuthzFreeResourceManager AuthzInitializeContextFromSid AuthzInitializeContextFromToken AuthzInitializeResourceManager

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

dwrite

DWriteCreateFactory

winmm

PlaySoundW midiInAddBuffer midiInClose midiInGetDevCapsW midiInGetNumDevs midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutClose midiOutGetDevCapsW midiOutGetNumDevs midiOutLongMsg midiOutOpen midiOutPrepareHeader midiOutReset midiOutShortMsg midiOutUnprepareHeader timeKillEvent timeSetEvent

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

d3d12

ord101 ord102 D3D12SerializeVersionedRootSignature

ntdll

NtCreateFile NtQueryKey NtQueryVolumeInformationFile RtlInitUnicodeString

mfplat

MFCreateMediaType MFCreateMemoryBuffer MFCreateSample MFShutdown MFStartup

mpr

WNetGetUniversalNameW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

d3d9

Direct3DCreate9

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiOpenDevRegKey SetupDiOpenDeviceInterfaceW

shlwapi

AssocQueryStringW

imm32

ImmAssociateContext ImmAssociateContextEx ImmGetCompositionStringW ImmGetContext ImmGetDefaultIMEWnd ImmGetOpenStatus ImmGetVirtualKey ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

uiautomationcore

UiaClientsAreListening UiaHostProviderFromHwnd UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaRaiseNotificationEvent UiaReturnRawElementProvider

winhttp

WinHttpCloseHandle WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen

comdlg32

GetOpenFileNameW GetSaveFileNameW

Name

.text

Size

35.4MB

Virtual Size

35.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29.7MB

Virtual Size

29.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19.1MB

Virtual Size

26.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmimed

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

36B

Characteristics

Name

.tls

Size

289KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1024B

Virtual Size

548B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

371KB

Virtual Size

370KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

COLAPSO.dll

PE Signature issue

user32

shell32

kernel32

ws2_32

comctl32

crypt32

ole32

advapi32

api-ms-win-core-synch-l1-2-0

iphlpapi

gdi32

uxtheme

dwmapi

oleaut32

bcrypt

ncrypt

secur32

icuuc

netapi32

authz

userenv

version

dwrite

winmm

d3d11

dxgi

d3d12

ntdll

mfplat

mpr

wtsapi32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

d3d9

api-ms-win-shcore-scaling-l1-1-1

setupapi

shlwapi

imm32

uiautomationcore

winhttp

comdlg32

generic