LockAppBroker[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

LockAppBroker.dll
Size

355KB
MD5

5792ff54bf8903aab4864bce8541500f
SHA1

3379a994d1c6e86bcce1cfda3b214ac3246bccfd
SHA256

438f27124d49fcddab8f1abc4436f02ca1c8df888de6b235d60666653167c58f
SHA512

617c081d60b91ef0f6aa1311b9602261ce56b5c60da6a4a49a9755e51fd40c79499c44ca829650cc12939b32d7db251b1f36740d30637498b54f40e64892a32d
SSDEEP

6144:gya/SyU6dKqNdlc0ic50QnqFmR+OJ/+AfN/jnqettLA0nuM:nSFKsdd5Lwm5VdAc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LockAppBroker.dll

Files

LockAppBroker.dll
.dll windows:10 windows x86 arch:x86

664c579cc250ad00b6d7954ed2791586

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

lockappbroker.pdb

Imports

msvcp110_win

?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Syserror_map@std@@YAPBDH@Z
??0id@locale@std@@QAE@I@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ

msvcrt

wcschr
realloc
??_V@YAXPAX@Z
memmove
memcpy
memcmp
_ftol2
_CxxThrowException
__CxxFrameHandler3
_vsnwprintf
memcpy_s
_wcsicmp
??3@YAXPAX@Z
_purecall
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
memmove_s
malloc
_callnewh
_XcptFilter
_amsg_exit
free
_except_handler4_common
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
memset

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
CreateEventExW
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSectionEx
ReleaseMutex
CreateSemaphoreExW
SetEvent
ResetEvent
WaitForMultipleObjectsEx
AcquireSRWLockShared
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OpenEventW
WaitForSingleObjectEx
InitializeSRWLock
OpenSemaphoreW
CreateMutexExW
EnterCriticalSection
CreateEventW
TryAcquireSRWLockShared
ReleaseSRWLockShared

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
OpenThreadToken
GetProcessId
GetCurrentProcessId
GetCurrentThread
GetCurrentProcess
CreateThread
GetExitCodeProcess
TerminateProcess
OpenProcessToken

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

rpcrt4

CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrStubCall2
NdrDllGetClassObject
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
NdrCStdStubBuffer2_Release
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
IUnknown_Release_Proxy
CStdStubBuffer_AddRef

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoTransformError
RoOriginateError

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
InitOnceBeginInitialize
WakeByAddressSingle
InitOnceExecuteOnce
WakeAllConditionVariable
Sleep
WaitOnAddress
InitOnceComplete

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
HSTRING_UserSize
WindowsCreateString
WindowsStringHasEmbeddedNull
WindowsDeleteString
HSTRING_UserUnmarshal
HSTRING_UserMarshal
WindowsDuplicateString
WindowsIsStringEmpty
HSTRING_UserFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetVersionExW

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient25
ObjectStublessClient24
CStdStubBuffer2_Connect
NdrProxyForwardingFunction3
ObjectStublessClient21
ObjectStublessClient29
ObjectStublessClient16
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient26
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient19
CStdStubBuffer2_QueryInterface
ObjectStublessClient13
ObjectStublessClient7
CStdStubBuffer2_Disconnect
ObjectStublessClient23
ObjectStublessClient15
ObjectStublessClient20
ObjectStublessClient28
ObjectStublessClient18
ObjectStublessClient27
ObjectStublessClient22
CStdStubBuffer2_CountRefs
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient12

api-ms-win-core-com-l1-1-0

CoUninitialize
CoIncrementMTAUsage
CoTaskMemFree
CoDecrementMTAUsage
CoInitializeEx
CoGetCallContext
CoEnableCallCancellation
CoDisableCallCancellation
CoCancelCall
CoWaitForMultipleHandles
CoGetApartmentType
CoTaskMemAlloc
CoCreateInstance
PropVariantClear
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer
UnregisterWaitEx

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-security-base-l1-1-0

GetSidSubAuthority
IsValidSid
DuplicateTokenEx
GetTokenInformation
EqualSid

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

ntdll

RtlPublishWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlFreeHeap
NtQueryInformationToken
RtlAllocateHeap
RtlInitUnicodeString
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
NtSetInformationProcess

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW
SHCreateMemStream

api-ms-win-core-file-l1-1-0

CreateFileW

oleaut32

SysFreeString
SysAllocString
VariantClear

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream
CreateRandomAccessStreamOverStream

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus
RegisterWaitForSingleObject

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformation

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

api-ms-win-shcore-scaling-l1-1-0

GetScaleFactorForDevice

api-ms-win-rtcore-ntuser-private-l1-1-0

GetWindowBand

api-ms-win-rtcore-ntuser-window-l1-1-0

TranslateMessage
DestroyWindow
PostQuitMessage
PostMessageW
PeekMessageW
DefWindowProcW
SetWindowLongW
GetWindowLongW
DispatchMessageW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-ntuser-sysparams-l1-1-0

SystemParametersInfoW
GetSystemMetrics

api-ms-win-shlwapi-winrt-storage-l1-1-1

SHCreateWorkerWindowW

api-ms-win-rtcore-ntuser-powermanagement-l1-1-0

RegisterPowerSettingNotification
UnregisterPowerSettingNotification

mrmcorer

ResourceManagerQueueGetString

shcore

ord190
ord109
ord200

twinapi.appcore

ord3
ord2

ole32

CoGetCallerTID

user32

GetSysColor
DestroyIcon

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-registryuserspecific-l1-1-0

SHRegGetUSValueW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

shell32

DuplicateIcon
ord866

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 293KB - Virtual size: 292KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

664c579cc250ad00b6d7954ed2791586

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp110_win

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

rpcrt4

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-winrt-l1-1-0

ntdll

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-file-l1-1-0

oleaut32

api-ms-win-shcore-stream-winrt-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-power-base-l1-1-0

api-ms-win-shcore-scaling-l1-1-0

api-ms-win-rtcore-ntuser-private-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-shlwapi-winrt-storage-l1-1-1

api-ms-win-rtcore-ntuser-powermanagement-l1-1-0

mrmcorer

shcore

twinapi.appcore

ole32

user32

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-security-capability-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-registryuserspecific-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

shell32

Exports

Exports

Sections

.text Size: 293KB - Virtual size: 292KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 12KB - Virtual size: 11KB

.didat Size: 512B - Virtual size: 12B

.text
Size: 293KB - Virtual size: 292KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 12KB - Virtual size: 11KB

.didat
Size: 512B - Virtual size: 12B

.rsrc
Size: 28KB - Virtual size: 28KB

.reloc
Size: 19KB - Virtual size: 19KB