acppage[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

acppage.dll
Size

68KB
MD5

fdfee9a47525597410b54d18399c43af
SHA1

8bb6d880bdb92106b058cdfb44f42ee41fd29c91
SHA256

eecb6d1c6d94c8023c56edf6b42a762c63659364582e4aedb5c75cd0a6f9abae
SHA512

08029fff666ebe72885287f85823bc040cc883d71e837a92c2167b57ffb16f3d98aaf0fa92aef220488e0b1c1e68c5c7d419c72b855a4df67eafd899e76fe694
SSDEEP

1536:w5HS44tWlYg5pbMrsFzRckMjRvolkH+QgVmTB2BeCF:wP4tWV5pbMr81cfQlk+QggTB2ACF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
acppage.dll

Files

acppage.dll
.dll windows:10 windows x86 arch:x86

0f7acee614453223947ba7cd29cb1642

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

acppage.pdb

Imports

msvcrt

wcschr
wcsncmp
_wcslwr
wcscat_s
_purecall
sscanf_s
memcpy
wcsrchr
memmove
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
wcscpy_s
_callnewh
malloc
free
_wcsnicmp
wcsstr
_wcsupr
_wcsicmp
_vsnwprintf
memcmp
memset

ntdll

ZwQueryValueKey
RtlInitUnicodeStringEx
ZwOpenKey
ZwQuerySystemInformation
RtlGetNativeSystemInformation
RtlUpcaseUnicodeChar
ZwClose
ZwEnumerateKey
RtlReAllocateHeap
NtQuerySection
RtlNtStatusToDosError
NtCreateSection
RtlImageRvaToVa
RtlImageDirectoryEntryToData
RtlFreeHeap
RtlAllocateHeap
NtOpenThreadToken
NtClose
NtQueryInformationToken
NtOpenProcessToken
RtlIsPartialPlaceholder
RtlInitUnicodeString

kernel32

GetLocalTime
CreateFileMappingW
MapViewOfFile
FileTimeToSystemTime
GetFileTime
GetVersionExW
QueryActCtxW
UnmapViewOfFile
SystemTimeToFileTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
FindFirstFileW
FindClose
GetLastError
lstrcmpiA
RegQueryValueExW
HeapFree
BasepGetExeArchType
ExpandEnvironmentStringsW
EncodePointer
RegOpenKeyExW
CreateFileW
GetSystemDirectoryW
CloseHandle
LoadLibraryW
HeapAlloc
DecodePointer
CheckElevationEnabled
GetProcAddress
LocalFree
GetProcessHeap
CreateProcessW
RegCloseKey
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
LoadLibraryExW
GetModuleFileNameW
FreeLibrary
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
GetModuleHandleW

user32

GetWindowLongW
SendMessageW
EndDialog
GetSystemMetrics
SetWindowTextW
SendDlgItemMessageW
SetThreadDpiAwarenessContext
IsWindowEnabled
SetWindowLongW
GetDlgItem
GetParent
EnableWindow
GetWindowTextW
LoadStringA
DialogBoxParamW
LoadStringW
InsertMenuW

shlwapi

StrCmpIW
PathFindFileNameW
PathFindExtensionW
ord176

advapi32

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

shell32

SHGetItemFromDataObject
SHChangeNotify
SHGetNameFromIDList
ShellExecuteW
ord155
SHParseDisplayName
SHGetPathFromIDListW

ole32

CoTaskMemFree
CoCreateInstance
HWND_UserMarshal
StringFromGUID2
HWND_UserFree
HWND_UserUnmarshal
ObjectStublessClient3
HWND_UserSize
CoGetObject

rpcrt4

CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
NdrDllGetClassObject
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_Invoke

sfc

SfcIsFileProtected

msi

ord173
ord201

aepic

PicFreeFileInfo
PicRetrieveFileInfo

apphelp

SdbQueryFlagMask
SdbGetPathSystemSdb
SdbInitDatabase
SdbGetMatchingExe
SdbReleaseDatabase

Exports

Exports

DllCanUnloadNow
DllGetClassObject
GetExeFromLnk

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f7acee614453223947ba7cd29cb1642

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

user32

shlwapi

advapi32

shell32

ole32

rpcrt4

sfc

msi

aepic

apphelp

Exports

Exports

Sections

.text Size: 55KB - Virtual size: 55KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 55KB - Virtual size: 55KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 3KB - Virtual size: 3KB