Windows[.]ApplicationModel[.]Store[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Windows.ApplicationModel.Store.dll
Size

2.2MB
MD5

c4580846fe483f21ceab8aea5c9c953d
SHA1

9ea59bacf79ebf4d1b783edb42be06989258b249
SHA256

b6fdc0ff208e09e48a6d15397217b4193cb99c809308292eb455c8b7ae4d2d36
SHA512

5128198e6d6b2280172ba81a913cb726a0b10f3d721e0631dc44de4a2fe0ace356cdbd08115b28b141b52b1b6d02fd8da0171a0fc15da98e8594a713817e44e3
SSDEEP

24576:z/IUadrq3vOPOVM9kSa4OUymSvBJCAQKThDgac6HElfL9Y:LMdr84OVM9ta4OUj4CTKT6ac6HElfLW

Score

1^/10

Malware Config

Signatures

Files

Windows.ApplicationModel.Store.dll
.dll windows:10 windows x64

c0a120a4ab33e22efb82600c593d8864

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:60:d6:ed:b6:c2:21:4d:cc:35:11:bc:63:c0:6f:64:d6:ba:f0:cd:dc:b1:bb:17:ad:8a:48:c2:8a:68:b0:47
Signer

Actual PE Digest

36:60:d6:ed:b6:c2:21:4d:cc:35:11:bc:63:c0:6f:64:d6:ba:f0:cd:dc:b1:bb:17:ad:8a:48:c2:8a:68:b0:47

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

realloc
_wtoi
_errno
wcscspn
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
_wtof
wcstoul
wcstombs_s
_vsnprintf
_amsg_exit
_snwprintf_s
_wcstoui64
strcmp
wcsrchr
wcstod
_wcstoi64
_wcsdup
_wtol
wcsstr
_itow_s
_wcsicmp
mbstowcs_s
memmove_s
strchr
strrchr
_set_errno
strtol
strncpy_s
wcstombs
sprintf_s
memset
memmove
memcpy
memcmp
floor
wcschr
_callnewh
_XcptFilter
toupper
malloc
wcscpy_s
??_V@YAXPEAX@Z
__C_specific_handler
_wcsupr
free
_purecall
memcpy_s
_vsnwprintf
wcscmp

ntdll

RtlUpcaseUnicodeChar
NtQueryInformationProcess
NtQueryWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlNtStatusToDosError
EtwEventRegister
EtwEventUnregister
EtwEventSetInformation
RtlUnsubscribeWnfStateChangeNotification
EtwEventWriteTransfer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-kernel32-legacy-l1-1-0

FileTimeToDosDateTime

combase

ord23
ord6
ord25
ord18
CStdStubBuffer2_QueryInterface
ord20
ord24
CStdStubBuffer2_Disconnect
ord9
CStdStubBuffer_DebugServerRelease
ord32
CStdStubBuffer_IsIIDSupported
CStdStubBuffer2_Connect
ord11
CStdStubBuffer_DebugServerQueryInterface
ord8
ord13
ord2
ord14
ord12
CStdStubBuffer_CountRefs
ord5
CStdStubBuffer2_CountRefs
ord10
ord16
CStdStubBuffer_Invoke
CStdStubBuffer_QueryInterface
ord15
NdrCStdStubBuffer_Release
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
ord21
ord7
NdrCStdStubBuffer2_Release
ord17
ord22
ord19
ord33
CStdStubBuffer_AddRef
ord34

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleHandleW
DisableThreadLibraryCalls
FreeResource
LockResource
FreeLibrary
GetModuleFileNameA
SizeofResource
LoadResource
FindResourceExW
GetModuleHandleExW
GetProcAddress

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
LCMapStringEx
GetUserDefaultLocaleName
FormatMessageW
GetGeoInfoW
GetUserGeoID

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
CreateProcessW
GetExitCodeProcess
GetCurrentProcessId
OpenProcessToken
GetProcessId
GetCurrentThreadId
GetProcessIdOfThread
OpenThread
GetCurrentThread
OpenThreadToken

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateMutexExW
ReleaseSRWLockShared
CreateSemaphoreExW
CreateEventExW
InitializeSRWLock
OpenSemaphoreW
WaitForSingleObject
LeaveCriticalSection
AcquireSRWLockShared
EnterCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSection
WaitForMultipleObjectsEx
ResetEvent
DeleteCriticalSection
SetEvent
CreateEventW
InitializeCriticalSectionEx

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
InitOnceExecuteOnce
WakeAllConditionVariable
Sleep
InitOnceBeginInitialize
InitOnceComplete

rpcrt4

NdrStubCall3
IUnknown_QueryInterface_Proxy
NdrOleAllocate
IUnknown_Release_Proxy
NdrOleFree
IUnknown_AddRef_Proxy
RpcServerInqCallAttributesW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringFreeW
NdrStubForwardingFunction
NdrDllCanUnloadNow
UuidCreate
NdrDllGetClassObject
I_RpcBindingInqLocalClientPID
UuidFromStringW
NdrClientCall3

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar
CompareStringW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
ExpandEnvironmentStringsA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
GetVersionExA

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventProviderEnabled
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser
GetLengthSid
GetTokenInformation
CopySid
AllocateAndInitializeSid
FreeSid
DuplicateTokenEx

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-file-l1-1-0

WriteFile
SetFilePointer
DeleteFileA
GetFileInformationByHandle
FileTimeToLocalFileTime
CreateFileA
DeleteFileW
CompareFileTime
FindFirstFileExA
ReadFile
FindNextFileA
GetFileSize
FindClose
FindFirstFileA
CreateFileW
CreateDirectoryW

api-ms-win-security-base-l1-2-0

CheckTokenMembershipEx

api-ms-win-core-file-l1-2-2

GetTempPathA
GetTempFileNameA

cabinet

ord13
ord14
ord10
ord11

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-registry-l1-1-0

RegOpenCurrentUser
RegGetValueW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-core-path-l1-1-0

PathCchAddExtension
PathCchAppendEx

api-ms-win-core-localization-l2-1-0

GetCurrencyFormatEx

api-ms-win-shcore-stream-winrt-l1-1-0

CreateRandomAccessStreamOverStream

api-ms-win-core-url-l1-1-0

UrlEscapeW

cryptsp

CryptGetHashParam
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptAcquireContextW
CryptCreateHash

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-eventing-legacy-l1-1-0

QueryTraceW
FlushTraceW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveFileSpecA
PathAppendW
PathCombineA
PathAppendA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalFree

api-ms-win-security-capability-l1-1-0

CapabilityCheck

iertutil

ord74
ord89
ord85
ord76

winhttp

WinHttpSetTimeouts
WinHttpConnect
WinHttpCrackUrl
WinHttpAddRequestHeaders
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpSetOption
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetStatusCallback
WinHttpReadData
WinHttpOpen

webservices

WsCreateReader
WsReadXmlBufferFromBytes
WsSetInputToBuffer
WsMoveReader
WsReadToStartElement
WsGetReaderPosition
WsReadBytes
WsReadStartElement
WsCreateError
WsCreateHeap
WsFreeReader
WsFreeHeap
WsFreeError
WsReadEndAttribute
WsReadStartAttribute
WsFindAttribute
WsReadChars

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 883KB - Virtual size: 882KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c0a120a4ab33e22efb82600c593d8864

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:dfCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

36:60:d6:ed:b6:c2:21:4d:cc:35:11:bc:63:c0:6f:64:d6:ba:f0:cd:dc:b1:bb:17:ad:8a:48:c2:8a:68:b0:47Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-kernel32-legacy-l1-1-0

combase

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

rpcrt4

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-file-l1-2-2

cabinet

api-ms-win-core-file-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-path-l1-1-0

api-ms-win-core-localization-l2-1-0

api-ms-win-shcore-stream-winrt-l1-1-0

api-ms-win-core-url-l1-1-0

cryptsp

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-eventing-legacy-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-security-capability-l1-1-0

iertutil

winhttp

webservices

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 883KB - Virtual size: 882KB

.data Size: 8KB - Virtual size: 14KB

.pdata Size: 41KB - Virtual size: 41KB

.didat Size: 1024B - Virtual size: 848B

.rsrc Size: 63KB - Virtual size: 63KB

.reloc Size: 65KB - Virtual size: 65KB

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

36:60:d6:ed:b6:c2:21:4d:cc:35:11:bc:63:c0:6f:64:d6:ba:f0:cd:dc:b1:bb:17:ad:8a:48:c2:8a:68:b0:47
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 883KB - Virtual size: 882KB

.data
Size: 8KB - Virtual size: 14KB

.pdata
Size: 41KB - Virtual size: 41KB

.didat
Size: 1024B - Virtual size: 848B

.rsrc
Size: 63KB - Virtual size: 63KB

.reloc
Size: 65KB - Virtual size: 65KB