AppIdPolicyEngineApi[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AppIdPolicyEngineApi.dll
Size

279KB
MD5

9f6ee25e32423b3db3948dc23051804e
SHA1

eff0dd774cdb41cc49e70b2a5058743a2cf0f355
SHA256

1d29d9927ed75ef12db2b42e42bef80916d6c7f64f615d99824fe313092e459e
SHA512

cf95df9a04dde3cd4b7dd7f8dbc123e64f802a5d55a95750979afb53ee0bfc0b1ebe736f1905e4a572e38c11e4a269242e1dadcc6616ddc7b2d6dcd07a1ee83e
SSDEEP

6144:MvlZCFVK21Gxw0+IaJsLHOuuI5mJ+3wRyJ3fFsAe67PTllGtwwZxJbZGSuS9UQkb:MzCt1Gxw0+hsLuuuIYJ+3wIJ3fFsA17b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AppIdPolicyEngineApi.dll

Files

AppIdPolicyEngineApi.dll
.dll windows:10 windows x86 arch:x86

d32f5f0454f5f3fc3db5d41023aa60f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppIdPolicyEngineApi.pdb

Imports

msvcp110_win

?_Xbad_alloc@std@@YAXXZ
??0_Locinfo@std@@QAE@PBD@Z
?id@?$collate@G@std@@2V0locale@2@A
_Wcsxfrm
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?tolower@?$ctype@G@std@@QBEGG@Z
??_7facet@locale@std@@6B@
??0facet@locale@std@@IAE@I@Z
??0_Lockit@std@@QAE@H@Z
?is@?$ctype@G@std@@QBE_NFG@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??1facet@locale@std@@MAE@XZ
??Bid@locale@std@@QAEIXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
_Wcscoll
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??_7_Facet_base@std@@6B@
??1_Facet_base@std@@UAE@XZ
??1_Lockit@std@@QAE@XZ
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
??1_Locinfo@std@@QAE@XZ

msvcrt

memcpy
memcmp
__RTDynamicCast
memmove
??0exception@@QAE@ABV0@@Z
__CxxFrameHandler3
_purecall
realloc
_errno
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
memset
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
_wtoi
_wtof
tolower
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@PBD@Z
strchr
towupper
_vsnwprintf_s
_ui64tow_s
wcstol
??0exception@@QAE@XZ
_callnewh
memcpy_s
free
malloc
wcsncpy_s

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
FindResourceExW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
SizeofResource
LoadResource

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegDeleteTreeW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegGetValueW
RegEnumKeyExW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-path-l1-1-0

PathCchAppend

rpcrt4

UuidCreate
UuidCompare
RpcStringFreeW
UuidToStringW
UuidFromStringW

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-handle-l1-1-0

CloseHandle

authz

AuthziAccessCheckEx
AuthziModifySecurityAttributes
AuthzFreeResourceManager
AuthzInitializeResourceManager
AuthzInitializeContextFromSid
AuthzFreeContext

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorGroup
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
GetAce
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-appmodel-runtime-l1-1-0

PackageFamilyNameFromId
PackageNameAndPublisherIdFromFamilyName

appidapi

AppIDDecodeAttributeString
AppIDEncodeAttributeString
AppIDFreeAttributeString
AppIDConstructAppxAttributes
AppIDGetAppxFileAttributes
AppIDGetFileAttributes
AppIDReleaseAppxFileAttributes
AppIDReleaseFileAttributes

ntdll

EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage
EtwGetTraceLoggerHandle

advapi32

RegCreateKeyW
RegEnumKeyW

shlwapi

SHCreateStreamOnFileEx

user32

UnregisterClassA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 238KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d32f5f0454f5f3fc3db5d41023aa60f5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp110_win

msvcrt

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-path-l1-1-0

rpcrt4

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

authz

api-ms-win-security-base-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-appmodel-runtime-l1-1-0

appidapi

ntdll

advapi32

shlwapi

user32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 238KB - Virtual size: 237KB

.data Size: 6KB - Virtual size: 7KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 68B

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 238KB - Virtual size: 237KB

.data
Size: 6KB - Virtual size: 7KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 68B

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 17KB - Virtual size: 16KB