AppIdPolicyEngineApi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
AppIdPolicyEngineApi.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
AppIdPolicyEngineApi.dll
Resource
win10v2004-20240508-en
General
-
Target
AppIdPolicyEngineApi.dll
-
Size
198KB
-
MD5
a15d8e9dd4efc7b650a82ef6a5f0e82b
-
SHA1
b704351d186fee51c3d0550185dd3afdbefa8c82
-
SHA256
0f725c6cfb175912053bd41ef2118eb5168450afe9f49dcda73a45fd7561b464
-
SHA512
12e7017e46e86f8009db340ae8140817a7629ea9866eb2df2ee60273e43c114c38e5e4c2eae5d84d2214ab10ad9c8ac560b991106657d927fcad30faa6926a7f
-
SSDEEP
3072:pGVk9/MsZi3FqxS/PIIpoxDhfEdsR1HNytwM01iAw99rDKFotoEhm:pGVKEYingIpo1hfb7yCMv99rDKmto
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AppIdPolicyEngineApi.dll
Files
-
AppIdPolicyEngineApi.dll.dll windows:6 windows x86 arch:x86
95862a39c7aaa367dccf328f9def1547
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_callnewh
_CxxThrowException
_purecall
malloc
free
memcpy_s
wcstol
_onexit
_lock
__dllonexit
_unlock
_errno
realloc
_except_handler4_common
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_amsg_exit
_initterm
_XcptFilter
__CxxFrameHandler3
memcpy
__RTDynamicCast
memmove_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
memset
wcsncpy_s
tolower
_wtoi
_wtof
toupper
_vsnwprintf_s
_ui64tow_s
ntdll
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage
EtwGetTraceEnableFlags
api-ms-win-core-localregistry-l1-1-0
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
advapi32
AddAce
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
RegEnumKeyW
RegCreateKeyW
GetAce
GetSecurityDescriptorDacl
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
MakeSelfRelativeSD
rpcrt4
UuidCompare
UuidCreate
RpcStringFreeW
UuidToStringW
UuidFromStringW
user32
UnregisterClassA
CharNextW
authz
AuthziModifySecurityAttributes
AuthzInitializeResourceManager
AuthzFreeResourceManager
AuthzInitializeContextFromSid
AuthzFreeContext
AuthziAccessCheckEx
appidapi
AppIDFreeAttributeString
AppIDEncodeAttributeString
AppIDReleaseFileAttributes
AppIDGetFileAttributes
AppIDDecodeAttributeString
kernel32
InterlockedExchange
GetVersionExA
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
CreateFileW
CloseHandle
SetLastError
Sleep
OutputDebugStringA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RegQueryValueExW
LocalFree
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetSystemWindowsDirectoryW
FreeLibrary
GetModuleFileNameW
lstrcmpiW
GetModuleHandleW
GetProcAddress
RegDeleteTreeW
LoadLibraryW
GetLastError
lstrlenW
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
DeleteCriticalSection
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 166KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ