windowsapis[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

windowsapis.dll
Size

3.1MB
MD5

c150540ddedc0c2541c4f789f57d1078
SHA1

4af67574f4f346cfe8f29c47c5efd1eb912a5a71
SHA256

3d27339973de483b62880a2e799879c934bcb1634541ec01152c2018bed75381
SHA512

1e6c7b0ac382dc80ce16318af6aec5e9f458e1b576b065508440858929333db5d8a62a3222cd05b02e4f7717cfadc1b21dc2c22d59305e836204ea8023b1455c
SSDEEP

49152:uAvUMmCWOE7BHkgW/M+IZakZW9TDeTlaakHjTQfyWPTHw1io9RMro9ZK1Z5c:uAvlmC3E1HIM34pKRcjTiyAQoaR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
windowsapis.dll

Files

windowsapis.dll
.dll windows:6 windows x86

61644e8ae5ae8f5c6e3f3f3d016166d0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
LoadLibraryW
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
GetCurrentProcessId
SystemTimeToFileTime
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceFrequency
GetSystemDirectoryW
GetModuleHandleW
MoveFileExW
CompareFileTime
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
SetFilePointer
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleExW
TerminateProcess
ConvertFiberToThread
ConvertThreadToFiber
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
InitializeCriticalSection
LeaveCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
EnterCriticalSection
HeapCreate
TryEnterCriticalSection
ReadFile
AreFileApisANSI
GetComputerNameA
GetProcessHeap
DeleteCriticalSection
LocalFree
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
GetSystemInfo
RaiseException
HeapReAlloc
GetLastError
HeapSize
GetModuleHandleA
InitializeCriticalSectionEx
SetLastError
HeapFree
GetCurrentDirectoryW
SetStdHandle
GetTimeZoneInformation
CreateProcessW
WriteConsoleW
GetExitCodeProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileSizeEx
GetConsoleOutputCP
GetModuleFileNameW
ExitProcess
SetConsoleCtrlHandler
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
FreeLibraryAndExitThread
GetModuleFileNameA
CloseHandle
GetVersionExA
GetCurrentProcess
WideCharToMultiByte
GetEnvironmentVariableW
MultiByteToWideChar
ExitThread
CreateThread
LoadLibraryExW
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
CreateEventW
ResetEvent
SetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
InitializeSRWLock
EncodePointer
LCMapStringEx

user32

GetWindowRect
GetAsyncKeyState
GetCursorPos
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

advapi32

CopySid
DuplicateToken
RegOpenKeyExA
CheckTokenMembership
OpenProcessToken
RegSetValueExA
CreateWellKnownSid
ReportEventW
RegisterEventSourceW
DeregisterEventSource
GetAclInformation
GetAce
EqualSid
SetNamedSecurityInfoA
AllocateAndInitializeSid
GetSidSubAuthority
GetSidLengthRequired
GetTokenInformation
InitializeSid
GetNamedSecurityInfoA
IsValidSid
AddAce
FreeSid
InitializeAcl
GetLengthSid
RegCreateKeyA
RegCloseKey
RegQueryValueExA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
ShellExecuteA

ole32

CoTaskMemFree

bcrypt

BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider

wldap32

ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord133
ord147
ord301

crypt32

CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertCloseStore

ws2_32

WSAResetEvent
WSAEventSelect
listen
WSACreateEvent
WSACloseEvent
send
recv
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
socket
setsockopt
WSAIoctl
__WSAFDIsSet
select
accept
bind
connect
getsockname
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
ioctlsocket
gethostname
htonl
WSAEnumNetworkEvents
getsockopt

Exports

Exports

AnsiToUtf8
Utf82Ansi
addDownloadInfo
addOrUpdateData
chmodFileRWByUtf8Path
clearAllMKV
clearAllSKV
delDownloadInfo
getAdmin
getAllDownloadInfos
getComputerName
getCurrectMousePosition
getDecodeKey
getDeviceId
getLateLoginInfo
getMKV
getPrinterInstallPath
getProgramDataUtf8Path
getSKV
getSpeedPluginInstallPath
getSpeedPluginVersion
getSysBit
getV4IpChar
getV4IpCharByNumStr
initDataPath
initSqlTablesOut
isLeftMousePressed
isRightMousePressed
isUserInAdminGroup
moveWindowFllowMouseIfMousePressed
readHKCUKeyValue
requestNet
resetMoveWindowFllowMouseIfMousePressed
saveSpeedPluginVersion
setMKV
setSKV
setWindowRound
sysCommond
systemExec
writeUtf8ToAnsiFile

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 545KB - Virtual size: 545KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61644e8ae5ae8f5c6e3f3f3d016166d0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

bcrypt

wldap32

crypt32

ws2_32

Exports

Exports

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 545KB - Virtual size: 545KB

.data Size: 37KB - Virtual size: 53KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 90KB - Virtual size: 89KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 545KB - Virtual size: 545KB

.data
Size: 37KB - Virtual size: 53KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 90KB - Virtual size: 89KB