MicrosoftAccountTokenProvider[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MicrosoftAccountTokenProvider.dll
Size

162KB
MD5

6ba9cfdaa9e45ec0db49f9d60ba5240b
SHA1

3799957526c41daf89d4c61ff197d8ac9d144798
SHA256

c372c272563d2e23754e07ef5b18be071573d613aa91c5ecaf722c0ed3440224
SHA512

a834c6848f469787c5c8eb61343f1918654c3419faaaf0afd4f15af74eeec37b430d8040b555d10c88351a9117b838628f7f781df7d724cd4628c6b4f42fb014
SSDEEP

3072:ODLu+1OwOV5sYLNaNKGF/NMEW5HaUKv68ptJtfrDD9dxt8rq7EcLO:ou+vsVNbGF/NMX9aHywfTDD9Tt8U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MicrosoftAccountTokenProvider.dll

Files

MicrosoftAccountTokenProvider.dll
.dll regsvr32 windows:10 windows x86 arch:x86

ccab0904a83121db654e3b2bafa6601c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MicrosoftAccountTokenProvider.pdb

Imports

msvcrt

_wcsicmp
wcsstr
isalpha
strtol
isxdigit
isdigit
__CxxFrameHandler3
swprintf_s
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler4_common
wcschr
_amsg_exit
_XcptFilter
calloc
_CxxThrowException
?what@exception@@UBEPBDXZ
_wtof
strrchr
malloc
_ftol2
_callnewh
_vsnprintf_s
memmove_s
tolower
memcpy_s
_initterm
_vsnwprintf
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
_set_errno
wcstol
vswprintf_s
_vscwprintf
iswspace
wcsncpy_s
wcsnlen
_wtoi
_purecall
free
memset

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
OpenSemaphoreW
EnterCriticalSection
ResetEvent
ReleaseSemaphore
DeleteCriticalSection
InitializeCriticalSection
CreateMutexExW
CreateSemaphoreExW
SetEvent
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateEventExW
ReleaseSRWLockExclusive
CreateEventW
ReleaseMutex
WaitForSingleObject
AcquireSRWLockExclusive

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
SizeofResource
LockResource
LoadResource
FindResourceExW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLocaleName
GetThreadPreferredUILanguages

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
OpenThreadToken
TerminateProcess
GetProcessIdOfThread
OpenThread
GetCurrentProcessId
OpenProcessToken

api-ms-win-core-heap-l1-1-0

HeapFree
HeapReAlloc
HeapDestroy
GetProcessHeap
HeapSize
HeapAlloc

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
EventActivityIdControl

api-ms-win-core-com-l1-1-0

CoUninitialize
CoGetCallContext
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoGetCallerTID

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetVersionExW
GetTickCount

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegDeleteValueW
RegGetValueW
RegDeleteTreeW
RegQueryInfoKeyW
RegEnumValueW
RegOpenCurrentUser
RegCloseKey
RegSetKeySecurity
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

ntdll

RtlGetDeviceFamilyInfoEnum

api-ms-win-security-base-l1-1-0

GetTokenInformation
CopySid
GetSecurityDescriptorSacl
ImpersonateLoggedOnUser
RevertToSelf
GetSecurityDescriptorDacl
DuplicateTokenEx
IsValidSid
GetLengthSid
CreateWellKnownSid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

rpcrt4

NdrMesTypeEncode2
NdrMesTypeDecode2
MesEncodeFixedBufferHandleCreate
MesBufferHandleReset
MesHandleFree
MesDecodeBufferHandleCreate
UuidCreate
I_RpcBindingInqLocalClientPID
RpcAsyncInitializeHandle
RpcSsDestroyClientContext
NdrAsyncClientCall2
RpcAsyncCompleteCall
RpcAsyncCancelCall
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
NdrMesTypeAlignSize2
NdrMesTypeFree2

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize
RoGetActivationFactory

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ccab0904a83121db654e3b2bafa6601c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

ntdll

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

rpcrt4

api-ms-win-core-version-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-capability-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-stateseparation-helpers-l1-1-0

Exports

Exports

Sections

.text Size: 138KB - Virtual size: 138KB

.data Size: 1KB - Virtual size: 11KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 92B

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 138KB - Virtual size: 138KB

.data
Size: 1KB - Virtual size: 11KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 92B

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 8KB