AppointmentApis[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AppointmentApis.dll
Size

693KB
MD5

355b607ef9e48a76b4e262cfdbad4162
SHA1

d519bef6f3fa32e9eb03d1278b2ee0169d3ed338
SHA256

ef6c2cbbe88b517c515a40658f7a4b5ca1d734cfc49c21124888d12b6d44ebaa
SHA512

7e8291503e7eb349f5accd19317c19cdc7fa418254f41e21c0dc687110b778247f09db9fc5e83843dfc5444119b2550180a9a0e222cf561c61fdea57ef635df0
SSDEEP

6144:uSm6Do8BNhJcgIPU5veiVJWXambvQjAuzSNGj3zNcs9oB5XdqVwvapl:u+DVNTcPYDVJWXamvQxz//NcCo/dqDp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AppointmentApis.dll

Files

AppointmentApis.dll
.dll windows:10 windows x86 arch:x86

06c066e391deb669d2ecbe7247dc400e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppointmentApis.pdb

Imports

msvcrt

_except_handler4_common
__CxxFrameHandler3
_onexit
memcmp
_vsnwprintf
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
memset
_callnewh
wcstoul
_wcsicmp
_errno
_vsnwprintf_s
memmove_s
realloc
_purecall
wcsncpy_s
malloc
free
memcpy_s
__dllonexit
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
FindResourceExW
SizeofResource
GetModuleFileNameW
GetModuleHandleExW
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
AcquireSRWLockShared
CreateMutexExW
SetEvent
AcquireSRWLockExclusive
Sleep
ReleaseSemaphore
InitializeSRWLock
OpenSemaphoreW
CreateSemaphoreExW
InitOnceExecuteOnce
DeleteCriticalSection
CreateEventW
WaitForSingleObject
InitOnceComplete
InitializeCriticalSection
WaitForSingleObjectEx
ReleaseSRWLockExclusive
LeaveCriticalSection
ReleaseMutex
InitializeCriticalSectionEx
CreateEventExW
InitOnceBeginInitialize
ReleaseSRWLockShared

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-1

RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventActivityIdControl
EventSetInformation
EventWriteTransfer
EventWrite
EventRegister

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
OpenProcess
OpenThreadToken
GetCurrentProcessId
GetCurrentThread
OpenProcessToken
SetThreadToken

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
OutputDebugStringA
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
FreeLibraryWhenCallbackReturns
SetThreadpoolWait
CloseThreadpoolWait
CloseThreadpoolWork
CreateThreadpoolWork

api-ms-win-core-file-l1-2-1

CompareFileTime

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

ntdll

RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-service-winsvc-l1-2-0

QueryServiceStatus

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

GetUserTokenFromContext
StartAndWaitForServiceForUser
IsCommsSystemService
GenerateUserModeServiceName
GetUserContextFromHandle
IsActiveDebugger

appointmentactivation

ShowReplaceAppointment
AwaitAppointmentActivation
ShowAddAppointment
ShowAddAppointmentAsync
GetWindowIdOfHost
ShowReplaceAppointmentAsync
ShowAppointmentDetails
ShowTimeFrame
ShowCalendarChooser
ShowCalendarChooserAsync
ShowRemoveAppointmentAsync
ShowRemoveAppointment

systemeventsbrokerclient

SebDeleteEvent
SebCreateCalendarNotificationEvent

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Exports

Exports

CreatePropertiesFromRecurrencePattern
CreateRecurrencePatternFromProperties
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
SetLocalRpcConnection

Sections

.text
Size: 621KB - Virtual size: 621KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06c066e391deb669d2ecbe7247dc400e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-timezone-l1-1-0

ntdll

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-2-0

api-ms-win-core-profile-l1-1-0

userdataplatformhelperutil

appointmentactivation

systemeventsbrokerclient

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 621KB - Virtual size: 621KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 252B

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 49KB - Virtual size: 49KB

.text
Size: 621KB - Virtual size: 621KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 252B

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 49KB - Virtual size: 49KB