ActiveSyncProvider[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ActiveSyncProvider.dll
Size

1.6MB
MD5

e845ac66b7c5c0e525de7a3be02dea56
SHA1

0b94dddfb937008a95642c2e2b78b92ee5619ed5
SHA256

770f8744cf005b6b0e6e2bfe0295441443e104ca552e4452a171e9039f52ae06
SHA512

e6d5a57f6370a5c6068e833c2dd70b89af64762a3834b1a885e339e3da133ddce6dc9ebcc88c347de723523780601566b66e5c9797289480a92f6dc3534e745b
SSDEEP

24576:TWrq6/TiS0gaHd+aYUNzmgzuscMNVdd3XO9rpkA/4nAm8XiG:TxiiS0VHd+VUNzZd3m9PCUXiG

Score

1^/10

Malware Config

Signatures

Files

ActiveSyncProvider.dll
.dll windows x64

71de13c0bb143d06cad7973a4df93a64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_wcstoui64
_i64tow_s
iswspace
iswcntrl
_wcsdup
memmove_s
__CxxFrameHandler3
?terminate@@YAXXZ
wcstol
_vsnprintf
strnlen
_vsnprintf_s
wcspbrk
_vscwprintf
_vswprintf_p_l
_vscwprintf_p_l
_vsprintf_p_l
_vscprintf_p_l
wcsnlen
wcsstr
iswdigit
wcstok_s
_vsnwprintf_s
wcschr
_snwprintf_s
wcsncmp
wcstod
_ltow_s
swscanf_s
free
_wcsicmp
_ultow_s
wcstoul
_wtoi
_itow_s
_wtol
malloc
_callnewh
_strnicmp
_purecall
memcpy_s
_vsnwprintf
__C_specific_handler
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_wcstoi64
_onexit
_errno
realloc
memset
memmove
memcpy
memcmp
memchr
floor
_wcsnicmp
wcsrchr
swscanf
wcscmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlReportException

syncutil

ord268
ord35
GetSessionSyncStats
AggregateAccountSyncStats
GetAccountSyncStats
ord24
ord48
ord52
ord51
IsFirstSyncEver
GetCurrentSyncStats
ord21
ord453
DeviceNeedsProvisioning
ord89
CoCreateInstanceElevated
AcquireDataStoreLock
ord470
ord28
ord26
GetAuthCertTargetAndUser
CredVaultDelete
CredVaultWrite
CredVaultRead
ord702
IsMatchingClientCertificateEx
ord118
ord121
ord120
CreateAuthHandler
ord442
ord94
ord31
ord22
ord274
ord273
ord701
ord66
ord67
ord256
ReleaseDataStoreLock
ord18
GetAADToken
ord410
ord500
ord503
ord501
ord505
ord109
ord87
ord269
IsValidAADAuthUri
GetGoldenPartnershipId
ord23
ord461
ord464
GetDefaultStoreDirty
SetDefaultStoreDirty
GetMsaCustomerId
InitializeMeContact
ord462
ord463
ord242
ord33
ord296
ord744
ord743
ord745
ReadPasswordForPartnership
ord747
ord746
ord69
ord68
ord257
GetCurrentSyncStatsForStore
SetOutgoingMessageSizeLimit
GetOutgoingMessageSizeLimit
ord34
AcquireDataStoreLockEx
ord17
AggregateSessionSyncStats
InitializeSyncStatus
SyncSqmUpdateStats
ord106
ord53
ord103
ord105
ord502
ord29
ord275
ord93
ord15
ord739
ord56
ord111
ord451
ord452
ord440
InitializeMsaStore
VerifyDataStoreLockOwner
ord9
DeleteHttpTransport
GetSyncWorkOnBehalfTicket
SetSyncWorkOnBehalfTicket
ord10
ord86
ord88
ord287
ord285
ord27
ord471
ord30
ord44

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleW
LoadStringW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete
Sleep

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSection
WaitForSingleObject
OpenSemaphoreW
AcquireSRWLockExclusive
InitializeSRWLock
LeaveCriticalSection
ReleaseSRWLockExclusive
CreateMutexExW
DeleteCriticalSection
ResetEvent
CreateSemaphoreExW
ReleaseMutex
CreateEventW
SetEvent
CreateEventExW
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapSize
HeapValidate
HeapCompact
HeapDestroy
HeapCreate

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
RaiseException

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoInitializeEx
CoGetMalloc
CoTaskMemFree
CreateStreamOnHGlobal
CoCreateGuid
CoGetApartmentType
CoWaitForMultipleObjects
CoCreateFreeThreadedMarshaler
CoUninitialize
CoCreateInstance
CoTaskMemAlloc

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
EventActivityIdControl

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
CreateThread
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
IsValidCodePage
FormatMessageW
GetSystemDefaultLCID
GetACP

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VarBstrCat
SysAllocStringByteLen
SafeArrayGetElement
SystemTimeToVariantTime
SafeArrayLock
VariantTimeToSystemTime
SafeArrayCreateVector
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SysStringByteLen
SafeArrayDestroy
VariantChangeType
VariantCopyInd
SysAllocString
SafeArrayPutElement
SysAllocStringLen
SysStringLen
SafeArrayRedim
SafeArrayCreate
VariantInit
VariantCopy
VariantClear
SysFreeString
SafeArrayUnlock

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExW
GetTickCount64
GetSystemTime
GetTickCount
GetLocalTime

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW
RegDeleteTreeW
RegDeleteValueW
RegQueryValueExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
GlobalFree

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
CompareFileTime

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDuplicateString

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

accountaccessor

UnenrollAndMarkAccountForDeletion

cemapi

CreateMAPITableWalker
SetConversationId
IsMessageClassReadRequest
GetMAPIStorePropTags
MAPILogonEx
MAPIFreeBuffer
FreeProws
HrGetOneProp
MAPIUninitialize
HrSetOneProp
GetMsgClassEnum
GetNamedPropTag
MAPIInitialize
MAPIAllocateBuffer
GetMsgStoreFromMessage
USOIDfromCEENTRYID

userdatalanguageutil

GetNarrowSzCodepage
ConvertToWideStream
GetWideSzAlloc
UninitializeLanguageUtil
InitializeLanguageUtil
GetMultiLanguage2
IsLocalePseudoLoc

userdatatimeutil

AdjustGMTForAllDayAppts
AdjustForAllDayAppts
GetCurrentLocalTime
FileTimeToVariantTime
ConvertVariantTimeToFileTime
ConvertLocalVariantTimeToFileTime
FileTimeToLocalFileTimeEx
DaysBetweenFT
FileTimeToTzSpecificVariantTime
MinutesBetweenFT
FileTimeAdjustUTCToTz

userdatatypehelperutil

BytesToDigits
UsOidToTaskUdmId
UsOidToContactUdmId
UsOidToCalendarUdmId
EcUidToGlobalObjId
TrimWhiteSpaces
EcGlobalObjIdToUid
MapiIdToEmailUdmId
StringToBytes
CompressWhitespaceNW
SplitString
GetStreamSize
FormatPoomIdToString
StreamFromStringW
ReadStreamContent

networkhelper

SyncPdcReference_WatchdogReport
ReportSyncProgress
GetOrCreateNullPowerDependencyCoordinatorManager
CHttpTransport_CreateInstance
SyncWerReportGenerator
SyncPdcReference_WatchdogsEnabled
IsNetworkConnectionCostRestricted

pimstore

GetAppointmentUniqueId
GetBlankName
CreateOutlookApp

mccspal

ord31
ord30
ord32

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathMatchSpecW
PathFindExtensionW

Exports

Exports

CreateMassObject
CreateSyncServiceLayer
DllCanUnloadNow
DllGetClassObject
DownloadEmailAttachment
DownloadEmailBody
GetActiveSyncServerProbeInstance
GetConversationSyncEnabled
GetOutlookExtensionSupportForAccount
GetOutlookExtensionSupportFromAccessor
GetUserInfoForUnconfiguredAccount
HandleEasMeetingResponseForAppointment
HandleEasMeetingResponseForMeetingNotification
InitializeSyncStatus
IsEnabledForSync
IsErrorCatastrophic
IsValidOutlookExtensionVersion
MarkPeopleFolderForResync
OneStopFactory
SyncGetMAPISession
SyncGetMessageStore
SyncGetSpecialFolder
SyncMgrPurgeFolderProvider
SyncMgrPurgeProviderStore
SyncMgrRemovePolicy
SyncSqmUpdateStats
UpdateEasTrackingSchema
WriteStoreCapabilityProps
WriteStoreContentTypesProps

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 304KB - Virtual size: 303KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71de13c0bb143d06cad7973a4df93a64

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

syncutil

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-string-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

accountaccessor

cemapi

userdatalanguageutil

userdatatimeutil

userdatatypehelperutil

networkhelper

pimstore

mccspal

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 304KB - Virtual size: 303KB

.data Size: 2KB - Virtual size: 8KB

.pdata Size: 58KB - Virtual size: 57KB

.didat Size: 512B - Virtual size: 488B

.rsrc Size: 28KB - Virtual size: 27KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 304KB - Virtual size: 303KB

.data
Size: 2KB - Virtual size: 8KB

.pdata
Size: 58KB - Virtual size: 57KB

.didat
Size: 512B - Virtual size: 488B

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 8KB - Virtual size: 8KB