MicrosoftAccountExtension[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

MicrosoftAccountExtension.dll
Size

212KB
MD5

e8df2d870f3a849168e4098e0139f2fe
SHA1

369210c72fdd1b3cefde787717c9e5ced436efa0
SHA256

020ab4f5f0d8c460398b79a32cd88e1ab787299c12d6e9c54742eddb1dc3339d
SHA512

af7d83c99ba4508263a2df49fffe6feb09d2afac7d8c09cb0b4e93fe28a3e468c1fb738add7f39129bdb7019d7d3b8a60678a5b32cce52d454610807cdf1bbdc
SSDEEP

3072:gEOU8ZNe7NXLYn3yK6ZfuTTYOl06JmyfzxX0Mh3BDGqWjE+OqDsiQPkH:gEOU8ZNwuyKgfuTkOl7JhFE8nWvzs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MicrosoftAccountExtension.dll

Files

MicrosoftAccountExtension.dll
.dll windows:10 windows x86 arch:x86

dc2ec50514a99ca3bac059280b7004a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MicrosoftAccountExtension.pdb

Imports

msvcp_win

?_Winerror_message@std@@YAKKPADK@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memcpy
_o__wcsicmp
_o__wcsnicmp
_o__wtol
_o_free
_o_malloc
_o_memset
_o_wcstol
__CxxFrameHandler3
_except_handler4_common
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
wcsstr
strrchr
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
memmove

api-ms-win-core-com-l1-1-1

CoGetApartmentType
CoWaitForMultipleHandles
CoGetCallContext
CoMarshalInterface
CoGetMalloc
CoTaskMemAlloc
PropVariantClear
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoGetCallerTID
CreateStreamOnHGlobal
CoCreateFreeThreadedMarshaler
RoGetAgileReference
CoInitializeEx

api-ms-win-core-errorhandling-l1-1-1

SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
CreateEventExW
Sleep
ReleaseSemaphore
ResetEvent
CreateEventW
ReleaseMutex
OpenEventW
WaitForMultipleObjectsEx
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
OpenSemaphoreW
SetEvent
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ReleaseSRWLockExclusive
CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockShared
WaitForSingleObject

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
LoadLibraryExA
LoadLibraryExW
GetProcAddress
FreeLibrary
FreeLibraryAndExitThread

api-ms-win-core-processthreads-l1-1-2

OpenThread
TerminateProcess
GetCurrentThread
GetCurrentProcessId
CreateThread
GetCurrentProcess
GetProcessId
TlsSetValue
IsProcessorFeaturePresent
OpenProcessToken
GetProcessIdOfThread
OpenProcess
TlsFree
TlsAlloc
GetCurrentThreadId
TlsGetValue
OpenThreadToken

api-ms-win-core-localization-l1-2-1

GetUserDefaultLocaleName
GetThreadPreferredUILanguages
FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWrite
EventUnregister
EventWriteTransfer

api-ms-win-core-winrt-error-l1-1-1

GetRestrictedErrorInfo
RoTransformError
RoReportFailedDelegate
RoOriginateErrorW
RoGetMatchingRestrictedErrorInfo
SetRestrictedErrorInfo
IsErrorPropagationEnabled
RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDuplicateString
WindowsDeleteString
WindowsCreateString
HSTRING_UserUnmarshal
HSTRING_UserFree
HSTRING_UserMarshal
HSTRING_UserSize
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetVersionExW
GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead

rpcrt4

NdrAsyncClientCall2
RpcSsDestroyClientContext
RpcAsyncInitializeHandle
RpcAsyncCompleteCall
RpcAsyncCancelCall
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcBindingInqLocalClientPID
UuidCreate
MesDecodeBufferHandleCreate
MesHandleFree
MesBufferHandleReset
MesEncodeFixedBufferHandleCreate
RpcBindingSetAuthInfoExW
RpcBindingFree
UuidToStringW
RpcStringFreeW
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer2_Release

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient9
CStdStubBuffer2_Connect
NdrProxyForwardingFunction3
ObjectStublessClient12
ObjectStublessClient14
ObjectStublessClient11
CStdStubBuffer2_CountRefs
ObjectStublessClient18
ObjectStublessClient15
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient13
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient16
ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient10
ObjectStublessClient17

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-rtcore-ntuser-window-l1-1-0

DispatchMessageW
GetDesktopWindow
PostThreadMessageW
PeekMessageW
TranslateMessage

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegGetValueW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumValueW
RegQueryValueExW
RegDeleteTreeW
RegDeleteValueW
RegDeleteKeyExW
RegOpenCurrentUser

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
CallbackMayRunLong
WaitForThreadpoolTimerCallbacks
TrySubmitThreadpoolCallback
FreeLibraryWhenCallbackReturns

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

ntdll

RtlGetDeviceFamilyInfoEnum

api-ms-win-security-credentials-l1-1-0

CredProtectW

api-ms-win-security-lsalookup-l2-1-1

LookupAccountNameW

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-security-base-l1-2-0

GetTokenInformation
IsValidSid
RevertToSelf
ImpersonateLoggedOnUser
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
EqualSid
CreateWellKnownSid

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-shcore-thread-l1-1-0

SHGetThreadRef
SHSetThreadRef
SHCreateThreadRef

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

oleaut32

SysFreeString

crypt32

CryptProtectMemory
CryptUnprotectData
CryptStringToBinaryW
CryptProtectData
CryptUnprotectMemory

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

userenv

GetProfileType

sspicli

LogonUserExExW
LsaRegisterLogonProcess
LsaConnectUntrusted
LsaLookupAuthenticationPackage
LsaCallAuthenticationPackage
LsaDeregisterLogonProcess

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-service-winsvc-l1-2-0

QueryServiceStatus

propsys

PropVariantToStringAlloc

api-ms-win-core-memory-l1-1-2

VirtualQuery
VirtualProtect

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc2ec50514a99ca3bac059280b7004a2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-interlocked-l1-2-0

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-obsolete-l1-1-0

ntdll

api-ms-win-security-credentials-l1-1-0

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-synch-l1-2-1

oleaut32

crypt32

api-ms-win-core-version-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

userenv

sspicli

api-ms-win-security-provider-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-2-0

propsys

api-ms-win-core-memory-l1-1-2

Exports

Exports

Sections

.text Size: 181KB - Virtual size: 181KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 11KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 181KB - Virtual size: 181KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 11KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB