AppointmentApis[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AppointmentApis.dll
Size

679KB
MD5

08d50d4b0cf355935cb73876d9dec717
SHA1

1f8e0359f9c15b307ae8cf111beb6b62cc69020b
SHA256

64de9e514be7f416d0e400f91c8ccd9282c875b0da7cb5d2843418087ed0320d
SHA512

ea47d43e9ddddd0fdb812af0906d8f4e09dad80812c2a9352a92778397f1f3554008e28a085e9b8e82141008a8f8ba0386cf7e7af0aa7aff0f5149d7a42c27ff
SSDEEP

12288:byUo1TnGeNvnLCCqON3KfVxr/V+yhrMye3nm:byU4TNVLpFoxr/VfrMB2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AppointmentApis.dll

Files

AppointmentApis.dll
.dll windows:10 windows x86 arch:x86

d0d30d748a389e235909b3beff368a2e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppointmentApis.pdb

Imports

msvcrt

memcmp
memcpy
memmove
__CxxFrameHandler3
_vsnwprintf
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
wcstoul
_wcsicmp
_errno
_vsnwprintf_s
memmove_s
realloc
_purecall
wcsncpy_s
malloc
free
memcpy_s
_onexit
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
LoadResource
DisableThreadLibraryCalls
GetModuleHandleExW
FreeLibrary
FindResourceExW
SizeofResource
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
CreateMutexExW
ReleaseMutex
DeleteCriticalSection
AcquireSRWLockExclusive
CreateEventW
WaitForSingleObject
SetEvent
AcquireSRWLockShared
ReleaseSemaphore
CreateEventExW
ReleaseSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockShared
OpenSemaphoreW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
CreateSemaphoreExW
WaitForSingleObjectEx

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer
EventActivityIdControl
EventSetInformation

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
OpenProcessToken
TerminateProcess
GetCurrentThread
SetThreadToken
GetCurrentProcess
GetCurrentThreadId
OpenThreadToken

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWait
SubmitThreadpoolWork
WaitForThreadpoolWaitCallbacks
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWork

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

ntdll

RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

StartAndWaitForServiceForUser
GetUserContextFromHandle
GetUserTokenFromContext
RunServicesInProc
GenerateUserModeServiceName
IsCommsSystemService

appointmentactivation

ShowAddAppointment
AwaitAppointmentActivation
ShowAddAppointmentAsync
GetWindowIdOfHost
ShowReplaceAppointment
ShowReplaceAppointmentAsync
ShowRemoveAppointment
ShowRemoveAppointmentAsync
ShowCalendarChooserAsync
ShowCalendarChooser
ShowTimeFrame
ShowAppointmentDetails

systemeventsbrokerclient

SebDeleteEvent
SebCreateCalendarNotificationEvent

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CreatePropertiesFromRecurrencePattern
CreateRecurrencePatternFromProperties
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 609KB - Virtual size: 608KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d0d30d748a389e235909b3beff368a2e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-timezone-l1-1-0

ntdll

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-profile-l1-1-0

userdataplatformhelperutil

appointmentactivation

systemeventsbrokerclient

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 609KB - Virtual size: 608KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 260B

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 48KB - Virtual size: 47KB

.text
Size: 609KB - Virtual size: 608KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 260B

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 48KB - Virtual size: 47KB