ChatApis[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ChatApis.dll
Size

547KB
MD5

a7bd2a5cb28b9c8f3f131f18ab2a0e65
SHA1

08423028593c70181c07552882cb9fdf18b66401
SHA256

81d042eedf669081f59a0d31b6891da7b7973e588ec711f2af0c8a8d2033c634
SHA512

d048c171d3765f948a06ad474c07efb895070ce1fa74b66294cb8a3865320f6fc2096581cc625abd874ca603bdee995b5fe85b2ba60bc56d4c2c0071eae00a6b
SSDEEP

12288:7VMnUnY2/QDdb0uJvxt76yuTBVxhK89hKp4Lr61LQVJtOJ:7VMUnYsQJb0uJvxt76ykBVxhK89hKp49

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ChatApis.dll

Files

ChatApis.dll
.dll windows:10 windows x86 arch:x86

4a27267808ca493885047c801b1f0a90

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ChatApis.pdb

Imports

msvcrt

memmove
__CxxFrameHandler3
memcpy
_ftol2
memcpy_s
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
_vsnwprintf
tolower
_wtol
wcstok_s
_errno
_vsnwprintf_s
wcstoul
_wtoi
realloc
memmove_s
_purecall
wcsncpy_s
malloc
free
memcmp
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleExW
FindResourceExW
LoadResource
LoadLibraryExW
SizeofResource
GetProcAddress
GetModuleFileNameW
FreeLibrary
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
AcquireSRWLockShared
LeaveCriticalSection
EnterCriticalSection
CreateEventW
ReleaseSRWLockShared
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
SetEvent
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
WaitForSingleObject
InitializeCriticalSection
CreateEventExW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister
EventActivityIdControl
EventWriteTransfer

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
SetLastError

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWait
CloseThreadpoolWork
SetThreadpoolWait
FreeLibraryWhenCallbackReturns

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentProcessId
OpenProcessToken
SetThreadToken
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
TerminateProcess

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-localization-l1-2-0

FormatMessageW

ntdll

RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
OpenServiceW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

RunServicesInProc
IsCommsSystemService
GenerateUserModeServiceName
StartAndWaitForServiceForUser
GetUserTokenFromContext
GetUserContextFromHandle

systemeventsbrokerclient

SebCreateChatNotificationEvent
SebCreateMessageInterceptNotificationEvent
SebCreateRcsEndUserMessageNotificationEvent
SebDeleteEvent

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 487KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a27267808ca493885047c801b1f0a90

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

ntdll

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-profile-l1-1-0

userdataplatformhelperutil

systemeventsbrokerclient

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 487KB - Virtual size: 487KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 260B

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 39KB - Virtual size: 38KB

.text
Size: 487KB - Virtual size: 487KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 260B

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 39KB - Virtual size: 38KB