appinfo[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

appinfo.dll
Size

46KB
MD5

8ae8019d64bf22eac97a42671e730906
SHA1

8d404800950e6ce056887e934b700a8f28cea7e0
SHA256

2855a838f0710f79f70ef8e486006556f61ebd250d17ec2e33ff08c423cbdee0
SHA512

03efb0549a8fc4e04f49f322e5e940a24aa28a101a8d08374e4294c9777f7ad2f2d9007e0371116309b4960766bb7fce87a1f3f2f16ee9e7d85f5b4e936ef27e
SSDEEP

768:CmF7iAu3kBGZfGqci6q0pt0ets+GwASGEv6r4G:CmhiAu3kBKfGVpWets+7ASG7r4G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
appinfo.dll

Files

appinfo.dll
.dll windows:6 windows x86 arch:x86

8d229952dfa5bf3665979fad859f20d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

appinfo.pdb

Imports

msvcrt

free
malloc
_XcptFilter
_vsnwprintf
bsearch
_wcsicmp
wcscpy_s
wcscat_s
_initterm
_amsg_exit
_except_handler4_common
wcschr
swprintf_s
memset
memcpy
wcsrchr

ntdll

EtwTraceMessage
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwEventWrite
NtQuerySecurityObject
NtSetSecurityObject
RtlCreateServiceSid
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlReleaseRelativeName
RtlFreeUnicodeString
RtlInitUnicodeStringEx
RtlPrefixUnicodeString
RtlQueryEnvironmentVariable
RtlInitUnicodeString
LdrOpenImageFileOptionsKey
LdrQueryImageFileKeyOption
RtlExpandEnvironmentStrings
RtlDestroyEnvironment
RtlCreateEnvironmentEx
RtlSetEnvironmentVar
NtOpenProcess
NtOpenThreadToken
NtQueryInformationToken
NtDuplicateObject
RtlRegisterWait
NtQuerySystemInformation
NtQueryInformationProcess
NtReadVirtualMemory
RtlNtStatusToDosErrorNoTeb
RtlImageNtHeaderEx
RtlDeregisterWaitEx
RtlDeregisterWait
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
NtOpenProcessToken
NtDuplicateToken
NtSetInformationToken
RtlRemovePrivileges
RtlNtStatusToDosError
NtClose
RtlInitializeSRWLock
EtwEventRegister
EtwEventUnregister

api-ms-win-core-localregistry-l1-1-0

RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetExitCodeProcess
GetCurrentProcessId
DeleteProcThreadAttributeList
GetCurrentProcess
GetCurrentThreadId
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CreateProcessAsUserW
ResumeThread

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
GetTokenInformation
CheckTokenMembership
SetTokenInformation
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
RevertToSelf

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

rpcrt4

RpcRevertToSelf
RpcImpersonateClient
I_RpcBindingInqLocalClientPID
RpcServerUseProtseqW
RpcAsyncCompleteCall
RpcServerInqBindings
RpcServerRegisterIfEx
RpcEpRegisterW
RpcServerUnregisterIf
RpcEpUnregister
RpcBindingVectorFree
NdrAsyncServerCall
NdrServerCall2

kernel32

GetLastError
InterlockedIncrement
LocalFree
WaitForSingleObject
InterlockedDecrement
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
Sleep
InterlockedExchange
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
DelayLoadFailureHook
lstrlenW
GetTempPathW
GetSystemDirectoryW
GetEnvironmentVariableW
CreateFileMappingW
MapViewOfFile
CreateActCtxW
QueryActCtxSettingsW
ReleaseActCtx
UnmapViewOfFile
GetLongPathNameW
CheckElevationEnabled
CreateFileW
CheckElevation
GetFullPathNameW
GetFileAttributesW
ReadProcessMemory
ReleaseMutex
CreateMutexW
LocalAlloc
CreateEventW
CloseHandle
GetTickCount
UnregisterWait
SetEvent

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8d229952dfa5bf3665979fad859f20d6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-service-core-l1-1-0

rpcrt4

kernel32

Exports

Exports

Sections

.text Size: 37KB - Virtual size: 36KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 37KB - Virtual size: 36KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 2KB