MsSpellCheckingFacility[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MsSpellCheckingFacility.dll
Size

711KB
MD5

7b96e2b48e3039756aec5472e576590e
SHA1

3fd9d9a7614c5f85418d986f9363e27d77d6db7f
SHA256

82fb6d1ddcbdc16e9f721e2b429c0c86dda0542ac2191c24b938e517a3a12490
SHA512

28d355b2c1bcbdb9feb6778b69ac325c8f15ca7b5d6d74d01bc119614791394938da4e25654d4def4870757375d10bf0b6075c906a3571f1210a46a28e02a828
SSDEEP

12288:e1VqhVU5gGQ6rmnrC0lVdLenW0X4vp54dYlfIorWrt+l5sb0E8569pix2AMUW:oVqhVMgz6rmvl3iW0X4vpeYlfrWrt+lU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MsSpellCheckingFacility.dll

Files

MsSpellCheckingFacility.dll
.dll regsvr32 windows:10 windows x86 arch:x86

908e16de9c2e6a78afdf8c73b2e0dace

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msspellcheckingfacility.pdb

Imports

msvcrt

memset
_ismbblead
tolower
___mb_cur_max_func
___lc_codepage_func
__pctype_func
memcmp
___lc_collate_cp_func
_errno
setlocale
_XcptFilter
_amsg_exit
_unlock
_lock
memmove
memcpy
_CxxThrowException
_callnewh
___lc_handle_func
_free_locale
_get_current_locale
__crtLCMapStringW
abort
__crtCompareStringW
_wcsdup
??1type_info@@UAE@XZ
__dllonexit
calloc
_resetstkoflw
_onexit
_except_handler4_common
_isctype
realloc
iswupper
wcstombs_s
strchr
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
_initterm
??0bad_cast@@QAE@PBD@Z
??0exception@@QAE@ABQBD@Z
wcscat_s
free
??3@YAXPAX@Z
wcsncpy_s
fread
ftell
fseek
fclose
_wfopen_s
_purecall
memmove_s
?what@exception@@UBEPBDXZ
_vsnprintf_s
?terminate@@YAXXZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??1exception@@UAE@XZ
memcpy_s
wcscpy_s
_vsnwprintf
??_V@YAXPAX@Z
__CxxFrameHandler3
malloc
_ftol2_sse

profapi

ord104

oleaut32

VarUI4FromStr
SetErrorInfo
VariantClear
VariantCopy
VariantInit
CreateErrorInfo
SysFreeString
SysStringLen

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SleepEx
ReleaseSemaphore
InitializeSRWLock
OpenSemaphoreW
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
CreateMutexExW
CreateSemaphoreExW
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
ReleaseMutex
CreateMutexW
WaitForSingleObject
CreateEventW
InitializeCriticalSection
WaitForSingleObjectEx
WaitForMultipleObjectsEx
SetEvent
AcquireSRWLockShared

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
OpenProcessToken
GetCurrentThreadId
OpenThreadToken
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
UpdateProcThreadAttribute
CreateThread
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
CreateProcessW

api-ms-win-core-handle-l1-1-0

CloseHandle

userenv

CreateAppContainerProfile
DeriveAppContainerSidFromAppContainerName

api-ms-win-core-libraryloader-l1-2-0

LockResource
FindResourceExW
FreeLibrary
GetModuleFileNameA
LoadResource
GetModuleHandleExW
SizeofResource
LoadStringW
LoadLibraryExW
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-base-l1-1-0

GetTokenInformation
FreeSid
ImpersonateLoggedOnUser
RevertToSelf

api-ms-win-core-com-l1-1-0

StringFromGUID2
CLSIDFromString
CoImpersonateClient
CoRevertToSelf
CoEnableCallCancellation
CoDisableCallCancellation
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoCancelCall

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
OpenFileMappingW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-localization-l1-2-0

GetThreadLocale
SetThreadLocale
LocaleNameToLCID
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsDeleteString

api-ms-win-core-file-l1-1-0

GetFileSizeEx
FindNextFileW
ReadFile
CreateFileW
FindClose
GetFileSize
GetDriveTypeW
FlushFileBuffers
GetFileAttributesW
SetFilePointer
FindNextChangeNotification
CreateDirectoryW
FindFirstFileExW
GetFileTime
FindFirstChangeNotificationW
SetFileTime
SetFilePointerEx
UnlockFile
SetEndOfFile
WriteFile
LockFile

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError
RoOriginateErrorW

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExA
RegGetValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExA
RegDeleteValueW
RegNotifyChangeKeyValue
RegEnumValueW
RegQueryValueExW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsUNCW
PathFindNextComponentW
PathStripPathW
PathGetDriveNumberW
PathAppendW
PathIsPrefixW
PathCombineW
PathFileExistsW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-string-l2-1-0

CharNextW
CharUpperW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
Sleep
WakeAllConditionVariable
InitOnceExecuteOnce

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetVersionExW

rpcrt4

UuidCreateSequential

coremessaging

CoreUICreate

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

ntdll

wcsrchr
wcsncmp
wcscspn
wcsstr
towlower
iswxdigit
iswdigit
iswspace
swscanf_s
wcschr
SbSelectProcedure
towupper
iswctype
toupper
NtQueryInformationProcess

coreuicomponents

CoreUIFactoryCreate

bcp47langs

Bcp47GetDistance
GetUserLanguages

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-normalization-l1-1-0

NormalizeString

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllRegisterServer
DllUnregisterServer
SpellerCheck
SpellerCloseLex
SpellerGetOptions
SpellerInit
SpellerOpenLex
SpellerSetOptions
SpellerTerminate

Sections

.text
Size: 647KB - Virtual size: 647KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

908e16de9c2e6a78afdf8c73b2e0dace

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

profapi

oleaut32

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

userenv

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

rpcrt4

coremessaging

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

ntdll

coreuicomponents

bcp47langs

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-normalization-l1-1-0

Exports

Exports

Sections

.text Size: 647KB - Virtual size: 647KB

.data Size: 9KB - Virtual size: 18KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 28B

.rsrc Size: 11KB - Virtual size: 11KB

.reloc Size: 31KB - Virtual size: 31KB

.text
Size: 647KB - Virtual size: 647KB

.data
Size: 9KB - Virtual size: 18KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 28B

.rsrc
Size: 11KB - Virtual size: 11KB

.reloc
Size: 31KB - Virtual size: 31KB