AppExtension[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AppExtension.dll
Size

132KB
MD5

68f82f01a8ed91beabdb1fe69edfb767
SHA1

626176ee421510e89f41c8fe02c0879023fe5f6f
SHA256

0c0dfb26f33783581de35ec530c3d064fe84bf14666c1b60113c2d058edbde3a
SHA512

accf9d300f88abc1571bcd6bf4e9c5cace987bd9200bc6505c9dbb8b1ee36cb32b8a827ecd477170e7f9cf1337a55524f9d5d512ebaeb67a021fd5a5802a22e6
SSDEEP

3072:yY+H2ZT7jC2/usUgc9CR5S/pkjBB+a5NwBpB3BCoAB5BrQ1eEHaKDYCrYkP:yYTdHx6CR5S/KjBBj5NwBpB3BUB5B81V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AppExtension.dll

Files

AppExtension.dll
.dll windows:10 windows x86 arch:x86

1becb78855ed3185ace74e978a16b290

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppExtension.pdb

Imports

msvcrt

_vsnwprintf
_purecall
??0exception@@QAE@ABQBD@Z
realloc
memmove_s
wcschr
_initterm
_amsg_exit
?terminate@@YAXXZ
malloc
__dllonexit
__CxxFrameHandler3
free
_onexit
memcpy_s
??1type_info@@UAE@XZ
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_lock
_callnewh
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
_except_handler4_common
??_V@YAXPAX@Z
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??3@YAXPAX@Z
_unlock
memset

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoGetCallerTID
CoGetMalloc
CoTaskMemFree
CoGetApartmentType
CoRevertToSelf
CoGetInterfaceAndReleaseStream
CoGetCallContext
CreateStreamOnHGlobal
CoReleaseMarshalData
CoMarshalInterface
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoCreateGuid
StringFromCLSID

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
OpenThreadToken
GetCurrentThread
GetCurrentProcess
TerminateProcess
GetProcessId
GetCurrentThreadId
OpenProcessToken

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
GetRestrictedErrorInfo
RoTransformError
RoOriginateError
SetRestrictedErrorInfo

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-synch-l1-1-0

ReleaseMutex
CreateSemaphoreExW
CreateEventW
SetEvent
LeaveCriticalSection
WaitForMultipleObjectsEx
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
CreateEventExW
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeSRWLock
CreateMutexExW
AcquireSRWLockShared
WaitForSingleObject
ReleaseSemaphore
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
CopySid
GetLengthSid
GetTokenInformation

api-ms-win-appmodel-runtime-l1-1-0

PackageFamilyNameFromFullName

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-rtcore-ntuser-window-l1-1-0

PostQuitMessage
DispatchMessageW
TranslateMessage
PeekMessageW

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegNotifyChangeKeyValue
RegQueryValueExW
RegOpenKeyExW

propsys

ord435

api-ms-win-appmodel-runtime-internal-l1-1-1

GetPackageStatus

twinapi.appcore

ord3
ord2

appxdeploymentclient

ord24
ord25
ord27
ord23

combase

ord168

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

ntdll

RtlAllocateHeap
RtlInitUnicodeString
NtQueryInformationToken
RtlFreeHeap
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlNtStatusToDosErrorNoTeb
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableAvl
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
RtlCompareUnicodeString

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1becb78855ed3185ace74e978a16b290

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-security-capability-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l2-1-1

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-registry-l1-1-0

propsys

api-ms-win-appmodel-runtime-internal-l1-1-1

twinapi.appcore

appxdeploymentclient

combase

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

ntdll

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 113KB - Virtual size: 112KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 76B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 113KB - Virtual size: 112KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 76B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 8KB