CallHistoryClient[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

CallHistoryClient.dll
Size

140KB
MD5

c44692121b1f06f14539d6af83dee719
SHA1

31d3c81e461fa6071ae2b33db42ad8fbbaaa0e3d
SHA256

5e6a98f1940a3de7ff769d9d3206c4656a749f22b3277bbbec91f275fb974b8b
SHA512

7d03d810845fff55620bac5d75caf0423f7e5eb177dbc225229c55c571139bf31d39094428b2cd6d6549f1d50eeab6d4beef909ccfd90c2626c8cda991a1524a
SSDEEP

3072:Ay8qQIiDi9gsw8tkiAqa+g8XpSQaoGqY+KgmEiti+KXpKx2ZjBUCa:A1h+gsAqE8XpSQaoGqY+KgmEi85nZjza

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CallHistoryClient.dll

Files

CallHistoryClient.dll
.dll windows:10 windows x86 arch:x86

d7ddaca2dd8c383a0aec015ff7fe4823

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CallHistoryClient.pdb

Imports

msvcrt

_unlock
_lock
_except_handler4_common
_initterm
__dllonexit
_onexit
__CxxFrameHandler3
_purecall
memcpy
memcmp
_vsnwprintf
wcstoul
_XcptFilter
_amsg_exit
memmove
_callnewh
malloc
free
_wcsicmp
memset

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoCreateInstance

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
InitializeCriticalSection
ReleaseSRWLockShared
SetEvent
CreateEventW
ResetEvent
WaitForSingleObject
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionEx

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
GetModuleHandleW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

rpcrt4

RpcExceptionFilter
RpcAsyncCompleteCall
RpcBindingCreateW
RpcBindingBind
RpcAsyncCancelCall
NdrAsyncClientCall2
RpcAsyncInitializeHandle
NdrClientCall4
RpcBindingFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-synch-l1-2-0

WakeConditionVariable
SleepConditionVariableSRW
Sleep
InitializeConditionVariable

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
CloseThreadpool
CreateThreadpool
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
SetThreadpoolThreadMaximum
WaitForThreadpoolWaitCallbacks

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

GetUserTokenFromContext
IsCommsSystemService
GenerateUserModeServiceName
StartAndWaitForServiceForUser

userdatatypehelperutil

FormatPoomIdToString
ParsePoomIdFromString
DupString

phoneutil

ComparePhoneNumbers

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

ntdll

RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DoesCallHistoryItemMatchFilter
StringToUdmObjectId
UdmAreCallEventsEqual
UdmCancelAsyncTask
UdmCreateDataSession
UdmCreateDataSessionForUser
UdmCreateSyncCallbackHandler
UdmDebugModifyNotifyState
UdmFreeCallFavoriteItemSet
UdmFreeCallHistoryItemSet
UdmObjectIdToString

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7ddaca2dd8c383a0aec015ff7fe4823

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-shcore-stream-winrt-l1-1-0

rpcrt4

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-profile-l1-1-0

userdataplatformhelperutil

userdatatypehelperutil

phoneutil

api-ms-win-security-base-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 123KB - Virtual size: 123KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 12B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 123KB - Virtual size: 123KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 12B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 6KB - Virtual size: 5KB