SensorsApi[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SensorsApi.dll
Size

306KB
MD5

150d0452099f5d783d7280699f62fb6f
SHA1

6109c32e9ecba17c5f155d2f62cbcb7af97fc323
SHA256

05439fba194ee811791dbad6b0bbac99988351c4b45e80c5b05574c0ae6d8262
SHA512

969f36cf13929c79e29ae882b825f584996bcae168cfd0936106e16d838ae3848f2d94a585aa406e8426fe4ebda37081efbf120cf39535c88b68b720472c10c0
SSDEEP

6144:u2D/6MrUih/tWxGF8rBv4A9mf8VdbBSUWsxRg8/2KvGXflfbFGfffKfKLDxma6Jh:sxGmrBv4AiRSRZ/2KOXLKOurTKAkq/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SensorsApi.dll

Files

SensorsApi.dll
.dll regsvr32 windows:10 windows x86 arch:x86

c0735cf77a7de7b33c07f2ded84fd508

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SensorsApi.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
memmove_s

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcsnicmp
_o_calloc
_o_free
_o_malloc
_o_toupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wmemcpy_s
_except_handler4_common
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsrchr
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o__errno
__std_terminate
__CxxFrameHandler3
_o__crt_atexit
_o__configure_narrow_argv
memcmp
memcpy

rpcrt4

CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
I_RpcExceptionFilter
RpcBindingFree
RpcBindingBind
NdrClientCall4
RpcBindingCreateW
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
NdrDllUnregisterProxy
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
NdrDllRegisterProxy
CStdStubBuffer_DebugServerQueryInterface

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient12
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient4
ObjectStublessClient16
ObjectStublessClient9
ObjectStublessClient3
ObjectStublessClient8
ObjectStublessClient6
ObjectStublessClient11
ObjectStublessClient15
ObjectStublessClient14
ObjectStublessClient5
ObjectStublessClient13
ObjectStublessClient7

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
FindResourceExW
LoadResource
LockResource
SizeofResource
DisableThreadLibraryCalls
LoadLibraryExW

api-ms-win-core-localization-l1-2-0

GetThreadLocale
SetThreadLocale
FormatMessageW

api-ms-win-core-registry-l1-1-0

RegSetKeySecurity
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegGetKeySecurity
RegSetValueExW
RegCreateKeyExW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
LeaveCriticalSection
ReleaseSemaphore
InitializeCriticalSectionEx
DeleteCriticalSection
CreateMutexExW
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSRWLockExclusive
WaitForMultipleObjectsEx
InitializeCriticalSection
ReleaseMutex
WaitForSingleObject
CreateEventExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapSize
HeapDestroy
HeapFree
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage

api-ms-win-core-processthreads-l1-1-0

CreateThread
OpenProcessToken
GetCurrentThreadId
ExitProcess
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
SetRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-file-l1-1-0

ReadFile
CreateFileW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-shcore-unicodeansi-l1-1-0

SHAnsiToUnicode

user32

UnregisterClassA
IsWindow
EndDialog
DialogBoxParamW
PeekMessageW
MsgWaitForMultipleObjectsEx
PostQuitMessage
TranslateMessage
SetCursor
LoadCursorW
LoadStringW
DispatchMessageW

sensorsutilsv2

PropKeyFindKeyGetFileTime
CollectionsListCopyAndMarshall
CollectionsListGetMarshalledSize
PropKeyFindKeyGetPropVariant
IsCollectionListSame
IsKeyPresentInCollectionList
PropKeyFindKeyGetUlong
InitPropVariantFromFloat
PropKeyFindKeyGetDouble
CollectionsListDeserializeFromBuffer
PropKeyFindKeyGetFloat
PropKeyFindKeySetPropVariant
PropKeyFindKeyGetGuid

sensorsnativeapi.v2

SensorStartCollectionV2
SensorStartStateChangeNotificationV2
SensorOpenByInterfaceV2
SensorGetCapabilitiesCollectionV2
SensorCloseV2
SensorGetDataCollectionV2
SensorEnableIdleOperationV2
SensorStopStateChangeNotificationV2
SensorSetDataIntervalV2
SensorStopV2
SensorGetDataFieldPropertiesV2
SensorGetPropertiesV2
SensorGetDataThresholdsV2
SensorGetDataIntervalV2
SensorSetDataThresholdsV2
SensorGetSupportedDataFieldsV2

api-ms-win-core-marshal-l1-1-0

HWND_UserSize
HWND_UserMarshal
HWND_UserUnmarshal
HWND_UserFree

msvcp_win

_Mtx_init_in_situ
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPBD@Z
_Mtx_destroy_in_situ
_Mtx_lock
?_Xbad_function_call@std@@YAXXZ

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolThreadMinimum
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
CreateThreadpoolTimer
CreateThreadpool
CloseThreadpool
SetThreadpoolThreadMaximum
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWorkCallbacks
CloseThreadpoolTimer

api-ms-win-security-base-l1-1-0

CopySid
GetAce
GetAclInformation
GetLengthSid
AddAccessAllowedAceEx
InitializeAcl
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
AddAce
GetSecurityDescriptorDacl
IsValidSid
SetSecurityDescriptorDacl
GetTokenInformation
InitializeSecurityDescriptor
IsWellKnownSid

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-psapi-l1-1-0

K32GetModuleBaseNameW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-io-l1-1-0

CancelIoEx
GetOverlappedResult

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

ntdll

WinSqmAddToStreamEx
WinSqmIsOptedIn

api-ms-win-core-synch-l1-2-0

Sleep

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
SensorCloseCOM
SensorEnableIdleOperationCOM
SensorGetAccDataCOM
SensorGetAlsDataCOM
SensorGetAlsDataWithColorCOM
SensorGetBarDataCOM
SensorGetCapabilitiesCollectionCOM
SensorGetDataCollectionCOM
SensorGetDeviceIdCOM
SensorGetFusDataCOM
SensorGetGyrDataCOM
SensorGetMagDataCOM
SensorGetPropertiesCOM
SensorGetPrxDataCOM
SensorGetThresholdsCOM
SensorOpenByInterfaceCOM
SensorPermissionsHandler
SensorPermissionsHandlerA
SensorPermissionsHandlerW
SensorRegisterEventCOM
SensorSetAccThresholdsCOM
SensorSetAlsThresholdsCOM
SensorSetAlsWithColorThresholdsCOM
SensorSetBarThresholdsCOM
SensorSetFusThresholdsCOM
SensorSetGyrThresholdsCOM
SensorSetIntervalCOM
SensorSetMagThresholdsCOM
SensorSetThresholdsCOM
SensorStartCollectionCOM
SensorStopCOM
SensorUnregisterEventCOM

Sections

.text
Size: 270KB - Virtual size: 270KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c0735cf77a7de7b33c07f2ded84fd508

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-shcore-unicodeansi-l1-1-0

user32

sensorsutilsv2

sensorsnativeapi.v2

api-ms-win-core-marshal-l1-1-0

msvcp_win

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

ntdll

api-ms-win-core-synch-l1-2-0

Exports

Exports

Sections

.text Size: 270KB - Virtual size: 270KB

.data Size: 1024B - Virtual size: 3KB

.idata Size: 10KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 284B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 21KB - Virtual size: 21KB

.text
Size: 270KB - Virtual size: 270KB

.data
Size: 1024B - Virtual size: 3KB

.idata
Size: 10KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 284B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 21KB - Virtual size: 21KB