MessagingDataModel2[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MessagingDataModel2.dll
Size

838KB
MD5

8c3a7847e6ef128837893a0d59d3875e
SHA1

bcc9fa910527a450caa476fcc7768e3fa22fae7f
SHA256

3c41152fef119b1b22d6ec19aa03c183609b19882ddaf28d9d03420be9b0d943
SHA512

17b9e152a620ba21fc306741728fcc5db963782276807f1bb401aa537e37655055a4f37eba8116d6190fb529a9b389a1b00fad3e526b341348d0bc2d9520e512
SSDEEP

24576:EnLDXw3xwVvrhqNrtWAaflfHu+ot+CDV0m:EDXwMvo58vflm/di

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MessagingDataModel2.dll

Files

MessagingDataModel2.dll
.dll windows:10 windows x86 arch:x86

54398b8cf7e1ea696ac23da2f466cafc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MessagingDataModel2.pdb

Imports

msvcrt

_ftol2
toupper
memcmp
memmove
memmove_s
realloc
__CxxFrameHandler3
_purecall
wcsftime
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
wcscpy_s
_callnewh
_wcstoui64
malloc
_wtoi64
free
wcstok_s
wcstoul
_errno
_vsnwprintf_s
towlower
_wcslwr_s
wcsncmp
iswdigit
_wgetenv
_wcsicmp
_wtoi
wcsrchr
swscanf_s
wcschr
_vsnwprintf
memcpy_s
_wcsnicmp
memcpy
memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadStringW
FreeLibraryAndExitThread
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExW
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
CreateSemaphoreExW
ReleaseMutex
WaitForSingleObjectEx
CreateEventExW
DeleteCriticalSection
OpenSemaphoreW
CreateMutexExW
ResetEvent
InitializeCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
LeaveCriticalSection
AcquireSRWLockShared
EnterCriticalSection
CreateEventW
ReleaseSRWLockExclusive
SetEvent
ReleaseSRWLockShared
WaitForSingleObject
InitializeCriticalSectionEx

oleaut32

SysAllocString
SysStringLen
VarBstrFromUI8
SysAllocStringLen
SysFreeString
VariantInit
SysStringByteLen
VarBstrCat
SysAllocStringByteLen

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoTaskMemAlloc
CoWaitForMultipleObjects
StringFromGUID2
CoCreateFreeThreadedMarshaler
CoCreateGuid
CLSIDFromString

api-ms-win-core-shlwapi-legacy-l1-1-0

PathGetDriveNumberW
PathSkipRootW
PathFindFileNameW
PathFindExtensionW

api-ms-win-core-path-l1-1-0

PathCchCanonicalize
PathCchRenameExtension

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetSystemInfo

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
CreateThread
GetCurrentProcess
TerminateProcess
CreateProcessW
GetCurrentProcessId
GetThreadPriority
GetCurrentThread
SetThreadPriority

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegCloseKey

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-file-l1-1-0

DeleteFileW
GetFileSizeEx
CompareFileTime
FileTimeToLocalFileTime
CreateFileW

api-ms-win-core-localization-l1-2-0

GetUserGeoID
GetGeoInfoW
GetUserDefaultLocaleName
GetThreadUILanguage
GetLocaleInfoW
FormatMessageW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-security-cryptoapi-l1-1-0

CryptAcquireContextW
CryptReleaseContext
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptCreateHash

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
SetThreadpoolThreadMaximum
CreateThreadpoolWork
CloseThreadpoolWait
CreateThreadpool
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWork
CreateThreadpoolCleanupGroup

xmllite

CreateXmlReader

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
ExpandEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

phoneutil

ComparePhoneNumbers
GetTelUriFromDialString
CellularApiHelper_CreateInstance
CellularApiHelper_FreeCountedSlotCanAssociationArray
GetDialStringFromTelUri
IsDialableChar
OneShotTimer_CreateInstance
IsNumberDialable
GetCchTailMin
Phone_FmtText_NonDialerFormat
MaskPhoneUri
MaskPhoneNumber

pimstore

FindAllMatchingContactsEx
FindMatchingContactEx

cemapi

MAPIAllocateBuffer
MAPIInitialize
MAPILogonEx
MAPIUninitialize
CreateMAPITableWalker
MAPI_CompareEntryIDs
FreeProws
GetNamedPropTag
HrSetOneProp
MAPIFreeBuffer
HrGetOneProp

userdataplatformhelperutil

GetContentTypeFromFilePath
CreateKnownFolderPath
GetFileExtensionFromContentType
IsCommsSystemService
GetThreadIOPriority
SetThreadIOPriority
StartAndWaitForServiceForUser
GetUserTokenFromContext

userdatatypehelperutil

CopyStream
BytesToDigits
CreateWrapFileNameStm
StreamFromStringW
FormatPoomIdToString
StringToBytes
CreateWrapFileStreamFromDssToken
ReadStreamContent

ntdll

RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-base-l1-1-0

GetTokenInformation

rpcrt4

NdrClientCall4
RpcBindingCreateW
RpcBindingBind
RpcExceptionFilter
RpcBindingFree

Exports

Exports

?CommitAllAttachments@MessagingDeferredAttachment@@YGJPAUISmMessage@@@Z
?CommitDeferredContent@MessagingDeferredAttachment@@YGJPAUIStream@@0@Z
?DeleteMessageAndTempFiles@MessagingDeferredAttachment@@YGJPAUISmMessage@@@Z
?DeleteTempFiles@MessagingDeferredAttachment@@YGJPAUISmMessage@@@Z
?GetData@MessagingDeferredAttachment@@YGJPAUISmAttachment@@PAPAUIStream@@1@Z
?GetDeferredAttachmentFilePath@MessagingDeferredAttachment@@YGJPAUISmMessage@@KPAHPAV?$basic_string@GU?$char_traits@G@utl@@V?$allocator@G@2@@utl@@@Z
CellMessagingHelper_CreateInstance
DllCanUnloadNow
DllGetClassObject
GetActiveMmsProfile
GetDirectionalMarkerForCurrentLocale
GetHasInternationalCapability
GetMaxAuthorizedSizeOfMMS
MOCloudCorrelation_CreateInstance
MOCloudCorrelation_CreateInstance2
MessagingAsyncDeletion_CreateInstance
MessagingMultiSimConverter_CreateInstanceWithPhoneOM
MessagingMultiSimConverter_CreateInstanceWithSimOM
MessagingMultiSimConverter_CreateSynchronousInstanceWithSimOM
MessagingRegistryGetDWORDFromPerSimMmsProfile
MessagingRegistryGetDWORDPerSim
MessagingRegistryGetStringFromPerSimMmsProfile
MessagingRegistryGetStringPerSim
MessagingRegistrySetDWORDPerSim
MessagingRegistrySetDWORDToPerSimMmsProfile
MessagingRegistrySetStringPerSim
MessagingRegistrySetStringToPerSimMmsProfile
Messaging_ChatTransportIdToStoreId
Messaging_CreateMessageInConversation
Messaging_CreateMessageInConversationWithRecipients
Messaging_CreateMessageInConversationWithRecipientsAndRemoteId
Messaging_FormatPhoneNumber
Messaging_FormatRecipient
Messaging_FormatRecipientFromAggregate
Messaging_FormatStringWithLeftToRightMarkers
Messaging_FormatStringWithLeftToRightMarkersIfPhoneNumber
Messaging_GetAddressType
Messaging_GetContentTypeFromFilePath
Messaging_GetFileExtensionFromContentType
Messaging_GetMediaTempFilePath
Messaging_GetMediaTempFolder
Messaging_GetMediaTypeFromMimeTag
Messaging_GetMessageAttachmentText
Messaging_GetMessagePreview
Messaging_GetPlatformType
Messaging_GetRecipientsPreviewWithBiDiMarkers
Messaging_GetRecipientsString
Messaging_GetSmsCharacterCount
Messaging_GetUnFormattedMessagePreview
Messaging_GetValidSimId
Messaging_HasEmbeddedModem
Messaging_InitializeRcsSlotMessagingSettings
Messaging_IsContentSupported
Messaging_IsCustomAppProviderId
Messaging_IsDataRoamingRestrictionActive
Messaging_IsFilterProviderId
Messaging_IsMediaType
Messaging_IsMmsMessage
Messaging_IsRcsEnabled
Messaging_IsRcsMessage
Messaging_IsSIMMessage
Messaging_IsThreadedByRemoteConversationId
Messaging_IsUnderMediaTempFolder
Messaging_IsVoiceRoamingRestrictionActive
Messaging_MarkMessageAsFailed
Messaging_MessagingOMStartupShutdown
Messaging_MessagingOMStartupStoreScan
Messaging_ResolveRecipientEx
Messaging_RetryDownloadCloudServiceMessage
Messaging_ShowToastForRcsEndUserMessage
Messaging_ShutdownCloudServices
Messaging_ShutdownMessageMaintenance
Messaging_ShutdownNotification
Messaging_SmEntryIdToUdmObjectId
Messaging_StartCloudServiceSync
Messaging_StartCloudServices
Messaging_StartMessageMaintenance
Messaging_StartNotification
UnInitMessagingObjectModelModule
WwanConnectionConfiguration_CreateInstance

Sections

.text
Size: 783KB - Virtual size: 783KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54398b8cf7e1ea696ac23da2f466cafc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

oleaut32

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-threadpool-l1-2-0

xmllite

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

phoneutil

pimstore

cemapi

userdataplatformhelperutil

userdatatypehelperutil

ntdll

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-security-base-l1-1-0

rpcrt4

Exports

Exports

Sections

.text Size: 783KB - Virtual size: 783KB

.data Size: 2KB - Virtual size: 4KB

.idata Size: 9KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 100B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 41KB - Virtual size: 40KB

.text
Size: 783KB - Virtual size: 783KB

.data
Size: 2KB - Virtual size: 4KB

.idata
Size: 9KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 100B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 41KB - Virtual size: 40KB