eapp3hst[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

eapp3hst.dll
Size

259KB
MD5

d845a7e1fbf8dd00f1045847292f1e35
SHA1

858e63bb7447efb0b760bb56d87a04b38b6e01ab
SHA256

496c4b41145dc9da9e51607b2a6bccca0a29c4b4a893998d9a2975e5509e3eea
SHA512

33f19e35a7b96dd22a164dd3ade1227bd51dc88c70fb50436b35d0f3054dd1797e44cfbb073a64268a95d5dac44088de9ec91191e88ea1e8b10b6129b31b2ffa
SSDEEP

6144:R+dYnp8To9ky6eWCeycoNw5MY81D70eKaE5xgSkTpueGhdfAC01Ys4:R+48TReNeyd5fvKLgduZfA9+s4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eapp3hst.dll

Files

eapp3hst.dll
.dll regsvr32 windows:10 windows x86 arch:x86

80022c5251103b6b28dffd2153e4621f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

eapp3hst.pdb

Imports

msvcrt

__dllonexit
_unlock
_vsnwprintf
_vsnprintf
_lock
?terminate@@YAXXZ
_except_handler4_common
_initterm
malloc
_onexit
_amsg_exit
wcscat_s
memmove
memcpy
_errno
realloc
_CxxThrowException
_beginthreadex
memcmp
?what@exception@@UBEPBDXZ
??1type_info@@UAE@XZ
_endthreadex
free
memmove_s
_vsnprintf_s
swprintf_s
_wtol
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
_purecall
memcpy_s
__CxxFrameHandler3
wcsncpy_s
wcsrchr
_XcptFilter
wcscpy_s
memset

ntdll

EtwEventWriteTransfer
DbgPrint
EtwTraceMessage
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwEventEnabled

oleaut32

SysAllocString
SysFreeString
ord446
VarUI4FromStr
ord447
ord445
ord448

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadResource
FreeLibrary
GetProcAddress
GetModuleHandleW
FindResourceExW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
GetModuleFileNameA
SizeofResource

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockShared
CreateSemaphoreExW
ReleaseSemaphore
AcquireSRWLockShared
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
ReleaseMutex
InitializeCriticalSectionAndSpinCount
CreateMutexExW
DeleteCriticalSection
WaitForSingleObjectEx
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjectsEx

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetProcessId

rpcrt4

CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
NdrDllUnregisterProxy
IUnknown_Release_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
IUnknown_QueryInterface_Proxy
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient4
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient5
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient11
ObjectStublessClient13
ObjectStublessClient10
ObjectStublessClient3
ObjectStublessClient7
ObjectStublessClient15

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime
GetVersionExW
GetSystemInfo
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

combase

GetErrorInfo

api-ms-win-core-localization-l1-2-0

SetThreadLocale
GetThreadLocale
FormatMessageW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegLoadMUIStringW
RegCreateKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-heap-l1-1-0

HeapSize
GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
GetHandleInformation
CloseHandle

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-security-base-l1-1-0

RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80022c5251103b6b28dffd2153e4621f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

oleaut32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

combase

api-ms-win-core-localization-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 226KB - Virtual size: 225KB

.data Size: 6KB - Virtual size: 9KB

.idata Size: 7KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 80B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 226KB - Virtual size: 225KB

.data
Size: 6KB - Virtual size: 9KB

.idata
Size: 7KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 80B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB