ActionCenter[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ActionCenter.dll
Size

249KB
MD5

f240305dd64ba0144e5d288c75878e08
SHA1

53378553cde8951658dc136badb6164162133229
SHA256

7a09722c8cb890d50fde632713bb0497a0e01a5aa9e974f50a688a0c029bbfa6
SHA512

65187b69ab6974b75a43535ba096e4ba0fe71b213ad4dabbc019166bdfa33e51000acc592cd537eebdbfbcb14fbd13e191b9c556f828215882a0e75a926b9736
SSDEEP

6144:TKkIMCly9MDA3Bb0LLpjQKgji+AuhbyEJqgB7PFsCPJI:FFClymE3BmQjcEJrPFZJI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ActionCenter.dll

Files

ActionCenter.dll
.dll windows:10 windows x86 arch:x86

9ef310b78b395cc229e0e195a9883d49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ActionCenter.pdb

Imports

msvcrt

__dllonexit
_unlock
_lock
_onexit
_amsg_exit
_XcptFilter
memcmp
_except_handler4_common
_vsnwprintf
memcpy
isdigit
__CxxFrameHandler3
_callnewh
malloc
free
_purecall
memcpy_s
_initterm
memset

shell32

ord68
ShellExecuteExW
ord100
SHQueryUserNotificationState

shlwapi

StrCmpW
HashData
ord158
SHRegGetValueW
ord278
ord219
StrStrW
StrCmpIW
StrChrW
PathParseIconLocationW
ord631

rpcrt4

CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_CountRefs
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_QueryInterface

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
OpenThreadToken
OpenProcessToken
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
DisableThreadLibraryCalls
GetModuleHandleA
FreeLibrary
LoadStringW
GetProcAddress
GetModuleHandleW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeCriticalSection
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
DeleteCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockShared
ReleaseSemaphore
ReleaseSRWLockShared
ReleaseMutex
WaitForSingleObjectEx
CreateMutexExW

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegGetValueW

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
StringFromGUID2
CoGetMalloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemAlloc

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
Sleep
InitOnceExecuteOnce

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient4
ObjectStublessClient8
ObjectStublessClient6
ObjectStublessClient5
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient7
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient3
ObjectStublessClient10
ObjectStublessClient9

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

crypt32

CryptProtectData
CryptUnprotectData

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-marshal-l1-1-0

HWND_UserSize
HWND_UserFree
HWND_UserMarshal
HWND_UserUnmarshal

comctl32

ord335
ord328
ord334
ord386
ord329
ord332
ord336

ntdll

WinSqmAddToStream
WinSqmAddToStreamEx

user32

SetTimer
GetWindowLongW
SendMessageW
PostMessageW
DefWindowProcW
KillTimer

wevtapi

EvtCreateBookmark
EvtSeek
EvtQuery
EvtCreateRenderContext
EvtRender
EvtNext
EvtUpdateBookmark
EvtSubscribe
EvtClose

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ef310b78b395cc229e0e195a9883d49

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shell32

shlwapi

rpcrt4

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l2-1-0

crypt32

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-marshal-l1-1-0

comctl32

ntdll

user32

wevtapi

api-ms-win-core-processthreads-l1-1-1

Exports

Exports

Sections

.text Size: 198KB - Virtual size: 198KB

.data Size: 1KB - Virtual size: 2KB

.idata Size: 7KB - Virtual size: 6KB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 198KB - Virtual size: 198KB

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 12KB - Virtual size: 12KB