apphelp[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

apphelp.dll
Size

289KB
MD5

d5afc3a476925ce740b7079d9bd2d269
SHA1

e3c038c05c8faed2c3e99924dcef8fb61a0837aa
SHA256

201313175bea013de47b00f9f563614641959fcad937fb873b587b7f8c87166c
SHA512

c53a69486181dfbf363b3c83d1b1e8aeec30134a7e031e505ee33a931a8527d0d949222663306428fce2476236491d7306bf62ae6351f1d68fc145bafa4d0b40
SSDEEP

6144:B3UTBGCdbz92gOZ6w9qQ3ZO0YD+U2LXDxH3sfuLSVpbj:hUTBGKzwZnIjyDxH3eu4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
apphelp.dll

Files

apphelp.dll
.dll windows:6 windows x86 arch:x86

499599933283a256ec6bca674e933c1e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

apphelp.pdb

Imports

ntdll

NtMapViewOfSection
NtCreateSection
NtUnmapViewOfSection
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtQuerySystemInformation
NtQueryVirtualMemory
_alloca_probe
NtQueryDirectoryFile
NtOpenFile
RtlxAnsiStringToUnicodeSize
NlsMbCodePageTag
RtlUnicodeStringToInteger
DbgPrint
NtQueryInformationProcess
RtlGetVersion
NtEnumerateValueKey
NtQueryKey
NtCreateKey
NtSetValueKey
NtDeleteValueKey
RtlDowncaseUnicodeString
RtlGetFullPathName_U
NtSetInformationKey
NtDeleteKey
strpbrk
strspn
_wcsupr
RtlUpcaseUnicodeChar
toupper
RtlUpcaseUnicodeString
NtWriteFile
RtlSecondsSince1970ToTime
RtlImageRvaToVa
RtlGUIDFromString
strchr
isdigit
LdrResFindResource
LdrResSearchResource
RtlUnwind
NtReadFile
qsort
NtDeleteFile
NtCreateFile
RtlDoesFileExists_U
NtOpenProcessToken
NtQueryInformationToken
RtlGetFileMUIPath
NtQueryInformationFile
RtlCreateUnicodeString
_vscwprintf
EtwEventRegister
EtwEventUnregister
EtwEventWrite
RtlAppendUnicodeStringToString
DbgPrintEx
wcsstr
strncmp
wcspbrk
wcsspn
wcschr
_vsnwprintf
ord7
RtlGetNativeSystemInformation
ord3
ord4
RtlEnterCriticalSection
LdrInitShimEngineDynamic
RtlLeaveCriticalSection
LdrLoadDll
LdrGetProcedureAddress
LdrUnloadDll
RtlTimeToTimeFields
RtlCompareUnicodeString
strrchr
LdrLockLoaderLock
LdrUnlockLoaderLock
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlInitString
LdrGetProcedureAddressEx
NtFlushInstructionCache
LdrFindEntryForAddress
RtlImageDirectoryEntryToData
_stricmp
_vsnprintf
RtlDeleteCriticalSection
RtlInitializeCriticalSection
_wcsnicmp
NtProtectVirtualMemory
RtlDosPathNameToNtPathName_U
LdrGetDllHandle
NtOpenKey
NtQueryValueKey
RtlExpandEnvironmentStrings_U
NtClose
RtlFormatCurrentUserKeyPath
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlStringFromGUID
RtlDuplicateUnicodeString
RtlQueryEnvironmentVariable_U
RtlSetEnvironmentVariable
RtlUnicodeStringToAnsiString
RtlFreeHeap
RtlFreeAnsiString
RtlDosPathNameToRelativeNtPathName_U
WinSqmIsOptedIn
RtlRandom
RtlCompareMemory
wcsnlen
RtlCaptureStackBackTrace
RtlNtStatusToDosError
RtlCreateServiceSid
RtlLengthRequiredSid
RtlEqualSid
RtlGetOwnerSecurityDescriptor
NtQuerySecurityObject
ord6
_strnicmp
RtlCreateUnicodeStringFromAsciiz
NtQueryObject
_strupr
_itoa_s
strcpy_s
LdrEnumerateLoadedModules
wcscat_s
wcscpy_s
RtlComputeCrc32
memset
NtApphelpCacheControl
wcsrchr
_wcsicmp
memcpy
RtlInitUnicodeString
RtlNtPathNameToDosPathName
RtlpEnsureBufferSize
RtlFreeUnicodeString
RtlAllocateHeap
RtlUpcaseUnicodeToMultiByteN
memmove
RtlReleaseRelativeName
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlImageNtHeader

kernel32

RegOpenKeyExA
RegOpenKeyExW
RegGetKeySecurity
RegCloseKey
GetModuleFileNameW
WideCharToMultiByte
CompareStringW
CompareStringA
lstrlenA
LoadLibraryExW
SetLastError
GetFileSizeEx
LocalAlloc
LocalFree
GetSystemDirectoryW
GetFileAttributesW
GetCurrentDirectoryW
WriteFile
IsDBCSLeadByte
VerLanguageNameW
OutputDebugStringW
GetLongPathNameW
ReadProcessMemory
GetSystemWindowsDirectoryW
Wow64DisableWow64FsRedirection
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
Wow64RevertWow64FsRedirection
GetUserDefaultUILanguage
FreeLibrary
GetTempPathW
GetTempFileNameW
LoadLibraryW
SetErrorMode
GetProcessTimes
FindNextFileW
FindClose
FindFirstFileW
SetFilePointerEx
SetFilePointer
ReadFile
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
TerminateProcess
GetProcessHeap
GetCurrentProcess
IsWow64Process
GetModuleHandleW
GetProcAddress
GetCurrentProcessId
OutputDebugStringA
FindResourceW
LoadResource
LockResource
SizeofResource
BaseDumpAppcompatCache
BaseFlushAppcompatCache
GetDriveTypeW
BaseCheckAppcompatCacheEx
BaseUpdateAppcompatCache
BaseIsAppcompatInfrastructureDisabled
OpenProcess
CreateFileW
GetLastError
CloseHandle
DisableThreadLibraryCalls
CompareFileTime

api-ms-win-security-base-l1-1-0

GetAclInformation
GetAce
GetSecurityDescriptorDacl

Exports

Exports

AllowPermLayer
ApphelpCheckExe
ApphelpCheckIME
ApphelpCheckInstallShieldPackage
ApphelpCheckModule
ApphelpCheckMsiPackage
ApphelpCheckRunApp
ApphelpCheckRunAppEx
ApphelpCheckShellObject
ApphelpCreateAppcompatData
ApphelpFixMsiPackage
ApphelpFixMsiPackageExe
ApphelpFreeFileAttributes
ApphelpGetFileAttributes
ApphelpGetMsiProperties
ApphelpGetNTVDMInfo
ApphelpGetShimDebugLevel
ApphelpParseModuleData
ApphelpQueryModuleData
ApphelpQueryModuleDataEx
ApphelpShowDialog
ApphelpUpdateCacheEntry
GetPermLayers
SE_DllLoaded
SE_DllUnloaded
SE_DynamicShim
SE_GetHookAPIs
SE_GetMaxShimCount
SE_GetProcAddressIgnoreIncExc
SE_GetProcAddressLoad
SE_GetShimCount
SE_InstallAfterInit
SE_InstallBeforeInit
SE_IsShimDll
SE_LdrEntryRemoved
SE_ProcessDying
SdbAddLayerTagRefToQuery
SdbApphelpNotify
SdbApphelpNotifyEx
SdbApphelpNotifyEx2
SdbBeginWriteListTag
SdbBuildCompatEnvVariables
SdbCloseApphelpInformation
SdbCloseDatabase
SdbCloseDatabaseWrite
SdbCloseLocalDatabase
SdbCommitIndexes
SdbCreateDatabase
SdbCreateHelpCenterURL
SdbCreateMsiTransformFile
SdbDeclareIndex
SdbDeletePermLayerKeys
SdbDumpSearchPathPartCaches
SdbEndWriteListTag
SdbEnumMsiTransforms
SdbEscapeApphelpURL
SdbFindCustomActionForPackage
SdbFindFirstDWORDIndexedTag
SdbFindFirstGUIDIndexedTag
SdbFindFirstMsiPackage
SdbFindFirstMsiPackage_Str
SdbFindFirstNamedTag
SdbFindFirstStringIndexedTag
SdbFindFirstTag
SdbFindFirstTagRef
SdbFindMsiPackageByID
SdbFindNextDWORDIndexedTag
SdbFindNextGUIDIndexedTag
SdbFindNextMsiPackage
SdbFindNextStringIndexedTag
SdbFindNextTag
SdbFindNextTagRef
SdbFormatAttribute
SdbFreeDatabaseInformation
SdbFreeFileAttributes
SdbFreeFileInfo
SdbFreeFlagInfo
SdbGUIDFromString
SdbGUIDToString
SdbGetAppCompatDataSize
SdbGetAppPatchDir
SdbGetBinaryTagData
SdbGetDatabaseGUID
SdbGetDatabaseID
SdbGetDatabaseInformation
SdbGetDatabaseInformationByName
SdbGetDatabaseMatch
SdbGetDatabaseVersion
SdbGetDllPath
SdbGetEntryFlags
SdbGetFileAttributes
SdbGetFileImageType
SdbGetFileImageTypeEx
SdbGetFileInfo
SdbGetFirstChild
SdbGetImageType
SdbGetIndex
SdbGetItemFromItemRef
SdbGetLayerName
SdbGetLayerTagRef
SdbGetLocalPDB
SdbGetMatchingExe
SdbGetMsiPackageInformation
SdbGetNamedLayer
SdbGetNextChild
SdbGetNthUserSdb
SdbGetPDBFromGUID
SdbGetPermLayerKeys
SdbGetShowDebugInfoOption
SdbGetShowDebugInfoOptionValue
SdbGetStandardDatabaseGUID
SdbGetStringTagPtr
SdbGetTagDataSize
SdbGetTagFromTagID
SdbGrabMatchingInfo
SdbGrabMatchingInfoEx
SdbInitDatabase
SdbInitDatabaseEx
SdbIsNullGUID
SdbIsStandardDatabase
SdbIsTagrefFromLocalDB
SdbIsTagrefFromMainDB
SdbLoadString
SdbMakeIndexKeyFromString
SdbOpenApphelpDetailsDatabase
SdbOpenApphelpDetailsDatabaseSP
SdbOpenApphelpInformation
SdbOpenApphelpInformationByID
SdbOpenApphelpResourceFile
SdbOpenDatabase
SdbOpenDbFromGuid
SdbOpenLocalDatabase
SdbPackAppCompatData
SdbQueryApphelpInformation
SdbQueryBlockUpgrade
SdbQueryContext
SdbQueryData
SdbQueryDataEx
SdbQueryDataExTagID
SdbQueryFlagInfo
SdbQueryFlagMask
SdbQueryName
SdbQueryReinstallUpgrade
SdbReadApphelpData
SdbReadApphelpDetailsData
SdbReadBYTETag
SdbReadBYTETagRef
SdbReadBinaryTag
SdbReadDWORDTag
SdbReadDWORDTagRef
SdbReadEntryInformation
SdbReadMsiTransformInfo
SdbReadPatchBits
SdbReadQWORDTag
SdbReadQWORDTagRef
SdbReadStringTag
SdbReadStringTagRef
SdbReadWORDTag
SdbReadWORDTagRef
SdbRegisterDatabase
SdbRegisterDatabaseEx
SdbReleaseDatabase
SdbReleaseMatchingExe
SdbResolveDatabase
SdbSetApphelpDebugParameters
SdbSetEntryFlags
SdbSetImageType
SdbSetPermLayerKeys
SdbShowApphelpDialog
SdbShowApphelpFromQuery
SdbStartIndexing
SdbStopIndexing
SdbStringDuplicate
SdbStringReplace
SdbStringReplaceArray
SdbTagIDToTagRef
SdbTagRefToTagID
SdbTagToString
SdbUnpackAppCompatData
SdbUnregisterDatabase
SdbWriteBYTETag
SdbWriteBinaryTag
SdbWriteBinaryTagFromFile
SdbWriteDWORDTag
SdbWriteNULLTag
SdbWriteQWORDTag
SdbWriteStringRefTag
SdbWriteStringTag
SdbWriteStringTagDirect
SdbWriteWORDTag
SetPermLayerState
SetPermLayers
ShimDbgPrint
ShimDumpCache
ShimFlushCache

Sections

.text
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

499599933283a256ec6bca674e933c1e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

kernel32

api-ms-win-security-base-l1-1-0

Exports

Exports

Sections

.text Size: 236KB - Virtual size: 236KB

.data Size: 7KB - Virtual size: 8KB

.rsrc Size: 34KB - Virtual size: 34KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 236KB - Virtual size: 236KB

.data
Size: 7KB - Virtual size: 8KB

.rsrc
Size: 34KB - Virtual size: 34KB

.reloc
Size: 9KB - Virtual size: 9KB