StorageContextHandler[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

StorageContextHandler.dll
Size

78KB
MD5

f88e39787c4202b4641bfe9ecb135218
SHA1

e64b0565a9c6a0cc6699377905974264c499d512
SHA256

0df83d9f777694a79402bbe5f881b6cb63dd0f0c0ad07b517418b44fb2d1b633
SHA512

5a19458b4f630998485f42d17a384c36689763732837df44f86f4e087597e018a1b7fd16c462535bb1e0179641c40a6ebd07d7567c4957f6db729c3e6fa499f2
SSDEEP

1536:9r6wtDrtylsE1vXl8oHJMNSGYVAH9F6z4ahrc3PNwhTinws3KH8tYlGtc:9/Drty3hXOoHJMwhVi9oc3PNwhTa3cy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
StorageContextHandler.dll

Files

StorageContextHandler.dll
.dll regsvr32 windows:10 windows x86 arch:x86

3a6a2ede49679668a76e76b939880040

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

StorageContextHandler.pdb

Imports

msvcrt

_lock
_ftol2
_amsg_exit
_XcptFilter
?terminate@@YAXXZ
_initterm
realloc
_errno
_callnewh
_unlock
__dllonexit
_except_handler4_common
__CxxFrameHandler3
??1type_info@@UAE@XZ
_onexit
calloc
memmove_s
_CxxThrowException
_purecall
_wcsupr
malloc
wcsncpy_s
wcscat_s
free
wcscpy_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
memset

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
LoadLibraryExW
FreeLibrary
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleW
SizeofResource
LoadResource
FindResourceExW
DisableThreadLibraryCalls
GetProcAddress
LockResource
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

CreateEventW
ReleaseSemaphore
CreateSemaphoreExW
InitializeCriticalSection
ReleaseMutex
EnterCriticalSection
WaitForSingleObjectEx
DeleteCriticalSection
LeaveCriticalSection
OpenSemaphoreW
CreateMutexExW
WaitForSingleObject
ResetEvent

api-ms-win-core-heap-l1-1-0

HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetProcessId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

GetThreadLocale
SetThreadLocale
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysAllocString
VarUI4FromStr
VariantClear
VariantInit

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
TraceMessage
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceEnableFlags
RegisterTraceGuidsW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc
CoGetMalloc
CoCreateInstance
StringFromGUID2
PropVariantClear
CoTaskMemRealloc
CLSIDFromString

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar

api-ms-win-devices-config-l1-1-1

CM_Get_Device_IDW
CM_Get_Device_Interface_ListW
CM_Locate_DevNodeW
CM_Get_Device_Interface_List_SizeW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetTickCount

api-ms-win-core-file-l1-1-0

CreateFileW
GetDriveTypeW

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpICW
StrCmpNICW
StrRChrIW
QISearch

api-ms-win-shcore-comhelpers-l1-1-0

IUnknown_QueryService
IUnknown_GetSite
IUnknown_Set

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

cfgmgr32

CM_Get_Parent_Ex
CM_Get_DevNode_Registry_Property_ExW
CM_Get_DevNode_Custom_PropertyW

api-ms-win-appmodel-runtime-l1-1-0

GetApplicationUserModelId

api-ms-win-shlwapi-winrt-storage-l1-1-1

ord348
IUnknown_GetWindow

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

api-ms-win-dx-d3dkmt-l1-1-4

D3DKMTGetProcessList
D3DKMTGetProcessDeviceRemovalSupport

ntdll

NtQueryInformationProcess

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-shell-namespace-l1-1-0

SHCreateItemFromParsingName
SHGetIDListFromObject

api-ms-win-devices-query-l1-1-0

DevFreeObjects
DevGetObjects

api-ms-win-dx-d3dkmt-l1-1-0

D3DKMTQueryAdapterInfo
D3DKMTOpenAdapterFromDeviceName

api-ms-win-core-shlwapi-legacy-l1-1-0

PathGetDriveNumberW

setupapi

SetupDiCreateDeviceInfoList
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiGetDevicePropertyW
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInfoW
SetupDiEnumDeviceInterfaces

shell32

ord100
SHCreateItemInKnownFolder
ShellExecuteExW

user32

UnregisterClassA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a6a2ede49679668a76e76b939880040

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-shcore-comhelpers-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

cfgmgr32

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-shlwapi-winrt-storage-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-4

ntdll

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-shell-namespace-l1-1-0

api-ms-win-devices-query-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

setupapi

shell32

user32

Exports

Exports

Sections

.text Size: 63KB - Virtual size: 63KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 7KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 63KB - Virtual size: 63KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB