CallHistoryClient[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CallHistoryClient.dll
Size

141KB
MD5

ebc0222aac0decd7d7ea0272ab97c504
SHA1

5f57e397c7cb0a1cecee605cbdc352e548d95523
SHA256

de44c4a0cbf854aa3fc4ebc28a863f94bf8fd60dded318033c499f69f7516880
SHA512

851952c5f9f660d360c670228e7d41e77f8453e56881ed83fe98cabe943adc0cd8d5b35f5d71c8781ad1508c8cdcb0290607c7922027814c1554914756448417
SSDEEP

3072:6ldr9YW1VRJs5MhLgQIUdZN4eX8mihKYW64Dan20SROyFeclMKMQ7:wr/c5MHdZNmmihKYW64Dan20S6LKn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CallHistoryClient.dll

Files

CallHistoryClient.dll
.dll windows:10 windows x86 arch:x86

d7ddaca2dd8c383a0aec015ff7fe4823

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CallHistoryClient.pdb

Imports

msvcrt

_unlock
_lock
_except_handler4_common
_initterm
__dllonexit
_onexit
__CxxFrameHandler3
_purecall
memcpy
memcmp
_vsnwprintf
wcstoul
_XcptFilter
_amsg_exit
memmove
_callnewh
malloc
free
_wcsicmp
memset

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoCreateInstance

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
InitializeCriticalSection
ReleaseSRWLockShared
SetEvent
CreateEventW
ResetEvent
WaitForSingleObject
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionEx

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
GetModuleHandleW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

rpcrt4

RpcExceptionFilter
RpcAsyncCompleteCall
RpcBindingCreateW
RpcBindingBind
RpcAsyncCancelCall
NdrAsyncClientCall2
RpcAsyncInitializeHandle
NdrClientCall4
RpcBindingFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-synch-l1-2-0

WakeConditionVariable
SleepConditionVariableSRW
Sleep
InitializeConditionVariable

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
CloseThreadpool
CreateThreadpool
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
SetThreadpoolThreadMaximum
WaitForThreadpoolWaitCallbacks

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

GetUserTokenFromContext
IsCommsSystemService
GenerateUserModeServiceName
StartAndWaitForServiceForUser

userdatatypehelperutil

FormatPoomIdToString
ParsePoomIdFromString
DupString

phoneutil

ComparePhoneNumbers

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

ntdll

RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DoesCallHistoryItemMatchFilter
StringToUdmObjectId
UdmAreCallEventsEqual
UdmCancelAsyncTask
UdmCreateDataSession
UdmCreateDataSessionForUser
UdmCreateSyncCallbackHandler
UdmDebugModifyNotifyState
UdmFreeCallFavoriteItemSet
UdmFreeCallHistoryItemSet
UdmObjectIdToString

Sections

.text
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7ddaca2dd8c383a0aec015ff7fe4823

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-shcore-stream-winrt-l1-1-0

rpcrt4

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-profile-l1-1-0

userdataplatformhelperutil

userdatatypehelperutil

phoneutil

api-ms-win-security-base-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 124KB - Virtual size: 124KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 12B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 124KB - Virtual size: 124KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 12B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 6KB - Virtual size: 5KB