ChatApis[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ChatApis.dll
Size

554KB
MD5

aa977093e4b741600108fbbdc539ec8f
SHA1

967b2c7f452d92ad38e5bdaab43c58dd97bb27bc
SHA256

f2748ed6b9444c05ec31df588db21029f595996eb1d48dd4d43e39d4837e85ce
SHA512

ece939823e5ae99bc9818f3d24a5b434186c06a98ace8889385e77faa14caf8f9f53c4c4ba9c1fdd3b653af765549ff4f7874b4d814e69b8ca36259e35bf6732
SSDEEP

12288:rUvWFlmZ+yhSIdtQ+hOM+vI9CARBjeodo:rWWD7ypQkx+vCCkdeod

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ChatApis.dll

Files

ChatApis.dll
.dll windows:10 windows x86 arch:x86

deea7667dde8064fbbb6e7023589f8b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ChatApis.pdb

Imports

msvcrt

_except_handler4_common
__CxxFrameHandler3
_onexit
__dllonexit
_lock
_initterm
memcmp
_ftol2
_unlock
memcpy_s
_XcptFilter
memset
_callnewh
_vsnwprintf
tolower
wcstok_s
memmove
_wtoi
_errno
_vsnwprintf_s
realloc
memmove_s
_purecall
wcstoul
wcsncpy_s
malloc
free
_amsg_exit
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadLibraryExW
SizeofResource
GetModuleFileNameW
FreeLibrary
FindResourceExW
GetModuleHandleExW
GetModuleFileNameA
LoadResource
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-synch-l1-2-0

InitializeCriticalSectionEx
InitOnceBeginInitialize
CreateEventExW
InitOnceExecuteOnce
CreateEventW
InitializeSRWLock
EnterCriticalSection
SetEvent
LeaveCriticalSection
InitOnceComplete
Sleep
CreateMutexExW
WaitForSingleObject
DeleteCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
OpenSemaphoreW
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSRWLockExclusive
InitializeCriticalSection
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventWrite
EventRegister
EventWriteTransfer

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-1

RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-sysinfo-l1-2-1

GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

FreeLibraryWhenCallbackReturns
SubmitThreadpoolWork
CloseThreadpoolWork
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolWork
CreateThreadpoolWait

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
OpenProcessToken
SetThreadToken
GetCurrentThread
GetCurrentProcess
TerminateProcess
OpenProcess
OpenThreadToken
GetCurrentThreadId

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
DebugBreak
OutputDebugStringA

api-ms-win-core-file-l1-2-1

CompareFileTime

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

StartAndWaitForServiceForUser
IsActiveDebugger
GetUserTokenFromContext
IsCommsSystemService

systemeventsbrokerclient

SebDeleteEvent
SebCreateMessageInterceptNotificationEvent
SebCreateRcsEndUserMessageNotificationEvent
SebCreateChatNotificationEvent

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
SetLocalRpcConnection

Sections

.text
Size: 492KB - Virtual size: 491KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

deea7667dde8064fbbb6e7023589f8b2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-debug-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-url-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-profile-l1-1-0

userdataplatformhelperutil

systemeventsbrokerclient

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 492KB - Virtual size: 491KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 244B

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 41KB - Virtual size: 41KB

.text
Size: 492KB - Virtual size: 491KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 244B

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 41KB - Virtual size: 41KB