BamSettingsClient[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

BamSettingsClient.dll
Size

12KB
MD5

53c3540287c624310e15678b786821dc
SHA1

5da9919f3da13ae01d65494f563272bc0317b876
SHA256

f0791fa2c83c7c09a7a0f27ffaa9042f4295690c4a55ec0e3c2fa29d8b855fe4
SHA512

689dade7df330973a693192496e607899d82002de398f090ebd81a5ce430c754d395c71bf1c3f35cdea678814dfb9900b9e267c75961bd068697487aa70f8bb7
SSDEEP

192:XmnLBIoc7orvShX2Vds89KNLfFii6JLjOYr1w1qfgEEbc2Wh7W:XmnLBtMYwt89iMzJLjvOgfQc2Wh7W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BamSettingsClient.dll

Files

BamSettingsClient.dll
.dll windows:10 windows x86 arch:x86

02219ea0d17d81a1c5266d582af24246

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

BamSettingsClient.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_except_handler4_common

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

ntdll

NtSetSystemInformation
RtlInitUnicodeString
NtQueryFullAttributesFile
NtPowerInformation
NtQuerySystemInformation

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryInfoKeyW
RegGetValueW
RegEnumValueW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

Exports

Exports

BamCreateSettingsClientLib
BamDestroySettingsClientLib
BamFreeQueriedApplications
BamQueryKnownApplications
BamSetUserManagementState

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02219ea0d17d81a1c5266d582af24246

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 900B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 376B

.text
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 900B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 376B