AAFCOAPI[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AAFCOAPI.dll
Size

2.9MB
MD5

d5959092cea6e58bc6bef8860fef2f36
SHA1

d7a0e174ac40166789ff6aa845523bf1a3cbaf1c
SHA256

5f9d0ad984a3b87d89896843a952ca02c38fde4ef01a2e9f3d370cbbd4f253f4
SHA512

3502338089d154f18cf64fe2088280effe6fbc12fa177af391536e1f94e53ccbca923d4faa6b99e4aba001cce1991593db70c5367df4bc6d678fcaad0aaed015
SSDEEP

49152:bo0llB41XbIxkJEtm6YbMGOttR2s+Coh8UUUZt4C:3HBySAoUZf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AAFCOAPI.dll

Files

AAFCOAPI.dll
.dll regsvr32 windows:5 windows x64 arch:x64

55ced51ebe688897566aa21f5c718158

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
SetLastError
GetLastError
GetModuleFileNameA
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
GetVersion
GetProcAddress
FreeLibrary
LoadLibraryA
FindFirstFileA
FindNextFileA
FindClose
GetTickCount
GetSystemTimeAsFileTime

msvcr90

fsetpos
malloc
swscanf
_mkdir
__C_specific_handler
_unlock
__dllonexit
_encode_pointer
_gmtime64
_onexit
_errno
?terminate@@YAXXZ
_malloc_crt
_initterm
_initterm_e
free
_encoded_null
_amsg_exit
__CppXcptFilter
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__clean_type_info_names_internal
fgetpos
fflush
_fileno
_fstat64
wcsncpy
_snwprintf
wcschr
printf
__iob_func
fprintf
fseek
fwrite
fread
_wremove
remove
_wfopen
fopen
isprint
??0exception@std@@QEAA@AEBV01@@Z
??1exception@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
??0exception@std@@QEAA@AEBQEBDH@Z
_strnicmp
_decode_pointer
_time64
toupper
wcsncmp
strncpy
__RTtypeid
??9type_info@@QEBA_NAEBV0@@Z
fclose
memset
??_U@YAPEAX_K@Z
memcpy
_purecall
wcstombs
tolower
_CxxThrowException
qsort
bsearch
memcmp
strrchr
??_V@YAXPEAX@Z
__RTDynamicCast
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
__CxxFrameHandler3
_lock
_chsize
calloc
towupper
realloc
memmove

msvcp90

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Unlock@_Mutex@std@@QEAAXXZ
?_Lock@_Mutex@std@@QEAAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?endl@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@1@AEAV21@@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

ole32

CoUninitialize
StgCreateDocfileOnILockBytes
StgCreateStorageEx
StgOpenStorageEx
StgOpenStorageOnILockBytes
CoCreateGuid
CoInitialize

Exports

Exports

AAFCreateAAFFileOnRawStorage
AAFCreateRawStorageCached
AAFCreateRawStorageCached2
AAFCreateRawStorageCachedDisk
AAFCreateRawStorageDisk
AAFCreateRawStorageMemory
AAFFileIsAAFFile
AAFFileIsAAFFileKind
AAFFileOpenExistingModify
AAFFileOpenExistingRead
AAFFileOpenNewModify
AAFFileOpenNewModifyEx
AAFFileOpenTransient
AAFGetFileEncodings
AAFGetLibraryPathName
AAFGetLibraryPathNameBufLen
AAFGetLibraryVersion
AAFGetPluginManager
AAFRawStorageIsAAFFile
AAFRawStorageIsAAFFileKind
AAFResultToText
AAFResultToTextBufLen
AAFSetProgressCallback
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1001KB - Virtual size: 1001KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

55ced51ebe688897566aa21f5c718158

Headers

File Characteristics

Imports

kernel32

msvcr90

msvcp90

ole32

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 1001KB - Virtual size: 1001KB

.data Size: 148KB - Virtual size: 171KB

.pdata Size: 175KB - Virtual size: 174KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 73KB - Virtual size: 72KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 1001KB - Virtual size: 1001KB

.data
Size: 148KB - Virtual size: 171KB

.pdata
Size: 175KB - Virtual size: 174KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 73KB - Virtual size: 72KB