FlightSettings[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

FlightSettings.dll
Size

713KB
MD5

7d2a545ef6fa7b8059663b9d7baeda44
SHA1

0788b770d6a8f5db33b66fbcb19d6ebb1c31acc7
SHA256

76a4d432c27753d041b3a682ff167a5e550cade67009006a98e21f63a5aabb23
SHA512

59b43f80e33652bf5717a1de0e7bf64628c9fbcf2bb4cdbab4a1f9fa3d9f86481d817c7a23d798fc4499036165a18642d26f3efacaccafe2b5970a61ab4f1148
SSDEEP

12288:O1WPKiPWDBtTQcagMLgMTFcx1M3sMlEh1rp6zt827ddwBCYs6wmQxECZh4Lam+nD:O1WPKiPWDBtTQcagMLgMTFcx1M3sIEbM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FlightSettings.dll

Files

FlightSettings.dll
.dll windows:10 windows x86 arch:x86

51061586f5efe646e3cd06ddbc681d0e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

FlightSettings.pdb

Imports

msvcrt

_wcsupr
wcstoul
_wcstoui64
wcschr
wcsstr
_wcsicmp
wcstok_s
_wtol
memmove_s
_wtoi
_CxxThrowException
_get_errno
wcsnlen
_ftol2_sse
memcmp
memcpy
realloc
??1exception@@UAE@XZ
_set_errno
wcsncmp
wcsrchr
swprintf_s
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnwprintf
_vsnprintf_s
swscanf_s
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_ftol2
memmove
_except_handler4_common
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
_purecall
toupper
_callnewh
memcpy_s
memset

combase

ord69
ord67
ord68
ord66

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleHandleExW
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
FreeLibrary
FindStringOrdinal

api-ms-win-core-synch-l1-1-0

InitializeSRWLock
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
LeaveCriticalSection
ReleaseMutex
WaitForSingleObjectEx
SetEvent
EnterCriticalSection
OpenSemaphoreW
CreateMutexExW
CreateEventExW
TryEnterCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
CreateMutexW
DeleteCriticalSection
InitializeCriticalSectionEx

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentProcess
SetThreadToken
GetProcessId
CreateProcessW
GetExitCodeProcess

api-ms-win-core-localization-l1-2-0

GetSystemPreferredUILanguages
FormatMessageW
GetLocaleInfoW
GetUserDefaultLocaleName

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
RoTransformError
SetRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateString
WindowsCompareStringOrdinal
WindowsCreateStringReference

api-ms-win-core-com-l1-1-0

CoMarshalInterface
CoUninitialize
CoDisconnectObject
CoWaitForMultipleHandles
CoGetApartmentType
CoTaskMemFree
CoReleaseMarshalData
CoCreateFreeThreadedMarshaler
CoRegisterClassObject
CoCreateInstance
CoRevokeClassObject
CoDisconnectContext
CoCreateGuid
CoSetProxyBlanket
CoInitializeEx
CoRevertToSelf
CoGetClassObject
CLSIDFromString
CoGetCallContext
CreateStreamOnHGlobal
CoGetMalloc
CoSwitchCallContext
CoTaskMemRealloc
StringFromCLSID
CoImpersonateClient
CoTaskMemAlloc

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-kernel32-legacy-l1-1-0

CopyFileW
UnregisterWait
MoveFileW

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

ntdll

EtwTraceMessage
NtQueryInformationToken
NtQuerySystemInformation
RtlGetVersion
NtQueryLicenseValue
RtlConvertDeviceFamilyInfoToString
RtlIsStateSeparationEnabled
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlNtStatusToDosError
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce
InitOnceComplete
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegCloseKey
RegDeleteTreeW
RegOpenKeyExW
RegQueryInfoKeyW
RegGetValueW
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegSetValueExW

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoActivateInstance
RoGetActivationFactory

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-string-l2-1-0

CharLowerBuffW
CharUpperBuffW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
CreateWellKnownSid
DuplicateToken
RevertToSelf
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
FreeSid
AllocateAndInitializeSid
ImpersonateLoggedOnUser
DuplicateTokenEx
CheckTokenMembership

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptEncrypt
CryptDestroyKey
CryptDeriveKey
CryptDecrypt
CryptAcquireContextW

api-ms-win-devices-config-l1-1-1

CM_Locate_DevNodeW
CM_Get_DevNode_PropertyW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_MapCrToWin32Err

api-ms-win-devices-query-l1-1-0

DevCloseObjectQuery
DevCreateObjectQuery

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW
PathFindFileNameW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

oleaut32

VariantInit
SysAllocString
VariantChangeTypeEx
SysFreeString
VariantClear

api-ms-win-core-file-l1-1-0

ReadFile
SetFilePointer
DeleteFileW
CreateFileA
RemoveDirectoryW
FlushFileBuffers
GetFileSizeEx
FindNextFileW
GetFileAttributesW
WriteFile
FindFirstFileW
QueryDosDeviceW
CreateFileW
DefineDosDeviceW
FindClose
CreateDirectoryW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW
GetPersistedRegistryValueW

crypt32

CertFreeCertificateContext
CertGetNameStringW
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CryptBinaryToStringW
CertFreeCertificateChain
CryptStringToBinaryW

bcd

BcdSetElementData
BcdGetElementData
BcdCloseObject
BcdCloseStore
BcdDeleteElement
BcdOpenObject
BcdOpenStore

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetProcessMitigationPolicy

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

rpcrt4

I_RpcBindingInqLocalClientPID

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
IsThreadpoolTimerSet
CreateThreadpoolTimer

winhttp

WinHttpQueryDataAvailable
WinHttpQueryOption
WinHttpSetTimeouts
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpCloseHandle
WinHttpConnect
WinHttpOpenRequest
WinHttpSetStatusCallback
WinHttpOpen
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpReadData
WinHttpSendRequest

api-ms-win-security-base-l1-2-0

CheckTokenMembershipEx

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-service-management-l1-1-0

StartServiceW
OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-core-path-l1-1-0

PathCchSkipRoot
PathAllocCombine

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus
ControlService

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx
ChangeServiceConfigW
QueryServiceConfigW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx
GetDateFormatEx

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

api-ms-win-service-private-l1-1-0

WaitServiceState

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 628KB - Virtual size: 627KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51061586f5efe646e3cd06ddbc681d0e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

combase

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-service-core-l1-1-0

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-devices-query-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

oleaut32

api-ms-win-core-file-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-stateseparation-helpers-l1-1-0

crypt32

bcd

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-security-sddl-l1-1-0

rpcrt4

api-ms-win-core-threadpool-l1-2-0

winhttp

api-ms-win-security-base-l1-2-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-security-capability-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-shutdown-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-memory-l1-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

.text
Size: 628KB - Virtual size: 627KB

.data
Size: 33KB - Virtual size: 35KB

.idata
Size: 14KB - Virtual size: 13KB

.didat
Size: 512B - Virtual size: 216B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 35KB - Virtual size: 35KB