DavSyncProvider[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

DavSyncProvider.dll
Size

311KB
MD5

4a776b389134defee193543bb9b6435c
SHA1

23b36cda32d4c42becc1838420fe73849616f5f0
SHA256

162d27e711bf9d6f5be0c0620dd3bc77a8450081ed99f5011e0e866371859024
SHA512

96ea7b952d6bccb95561afd844f0e1f32fa9b3d54224fcc87aaf5d61843cf9912644ea17960e8b25f96795e81fcc6b51ec7983768442b1b167578e24b0fe8e76
SSDEEP

6144:aBr68K8jeqcsjsUcSTdWfGNl83VW0iSosU49pQwAP8DkzB+SbOgwJJ:d8jdjXcSTdyVWUZU4jQwdD8RbOvJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DavSyncProvider.dll

Files

DavSyncProvider.dll
.dll windows:10 windows x86 arch:x86

cced6396584e4f1fff556cecf3761e0e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DavSyncProvider.pdb

Imports

msvcrt

strrchr
_strnicmp
strtol
strchr
wcschr
_purecall
iswcntrl
_wcstoui64
_ui64tow_s
_wcsicmp
_wcsnicmp
_ultow_s
_vsnwprintf_s
_wtoi
wcstod
wcstol
_wcstoi64
wcstoul
_vscwprintf_p_l
_vswprintf_p_l
wcsstr
tolower
__CxxFrameHandler3
memcpy
memcmp
memcpy_s
malloc
free
sprintf_s
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
_except_handler4_common
_errno
memmove
strncpy_s
_set_errno
_callnewh
_vsnwprintf
memset

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
LoadStringW
GetModuleHandleW
GetProcAddress

api-ms-win-core-synch-l1-1-0

CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
DeleteCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseMutex
InitializeCriticalSection
WaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateSemaphoreExW
LeaveCriticalSection
InitializeCriticalSectionEx

api-ms-win-core-heap-l1-1-0

HeapDestroy
GetProcessHeap
HeapCompact
HeapAlloc
HeapReAlloc
HeapSize
HeapCreate
HeapValidate
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
VariantClear
VariantInit

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventActivityIdControl
EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-com-l1-1-0

CreateStreamOnHGlobal
StringFromGUID2
CoCreateInstance
CoCreateGuid

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
GetSystemTime

rpcrt4

UuidCreate

winhttp

WinHttpCreateUrl
WinHttpCrackUrl

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

crypt32

CryptBinaryToStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

syncutil

ord503
ord505
ord502
ReadPasswordForPartnership
GetOAuthAccessTokenForPartnership
GetOAuthHelperForAccount
ord500
ord501
ord739
ord273
ord274
ord1
ord463
ord462
ord413
ord464
ord461
SyncSqmUpdateStats
InitializeSyncStatus
AggregateAccountSyncStats
GetCurrentSyncStats
GetSessionSyncStats
AggregateSessionSyncStats
ord453
ord452
InvalidateOAuthAccessTokenForPartnership
ord26
ord25
ord27
ord412
ord109
ord441

userdatatypehelperutil

FormatPoomIdToString
UsOidToContactUdmId
FileTimeToISO8601String
UsOidToCalendarUdmId
EcGlobalObjIdToUid
CopyStream

networkhelper

ReportSyncProgress

ntdll

RtlCaptureContext
RtlReportException

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
ForceCalDavCollectionsListRefreshDuringNextSync
HandleWebDavMeetingResponseForAppointment
HandleWebDavMeetingResponseForMeetingNotification
UpdateCalDavTrackingSchema
UpdateGMailContactSyncPartner

Sections

.text
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cced6396584e4f1fff556cecf3761e0e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

rpcrt4

winhttp

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

crypt32

api-ms-win-core-string-obsolete-l1-1-0

syncutil

userdatatypehelperutil

networkhelper

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

Exports

Exports

Sections

.text Size: 276KB - Virtual size: 276KB

.data Size: 1024B - Virtual size: 3KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 56B

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 276KB - Virtual size: 276KB

.data
Size: 1024B - Virtual size: 3KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 56B

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 16KB - Virtual size: 15KB