Phoneutil[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

Phoneutil.dll
Size

254KB
MD5

d4b85b131f239799d4225523908a8a6f
SHA1

04d6c19cfea12b7350d423ac747eb541d10db675
SHA256

5db5fa94494c0911252655bd05a5ef29ae3033c67dccb80c6c2bcf2ca388af56
SHA512

89669129c94fc0bcc660244c070a20d1b0cc90c80c03cb69684161886bb2cc4ac6f9e90eaa6f14348980ee5fa3f78fac0f76eb239d4f3137a17bd72e2f2fb9ad
SSDEEP

6144:auIzKZdnauUwhBBXX2zzAek4Bfo/hw4NmBPXUZqK:auIzAdnauUCBNX2zz5kKocUt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Phoneutil.dll

Files

Phoneutil.dll
.dll windows:10 windows x86 arch:x86

a7b3a11a75767d91cd622f1c1bc28bf0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PhoneUtil.pdb

Imports

msvcrt

_vsnwprintf_s
tolower
wcsspn
wcstol
wcstok_s
wcschr
wcsncmp
_errno
wcsstr
wcscpy_s
_vsnwprintf
iswdigit
wcstoul
_itow_s
_purecall
bsearch_s
bsearch
_ultow_s
iswspace
wcspbrk
_except_handler4_common
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
realloc
_initterm
_amsg_exit
_XcptFilter
memcmp
memmove
wcsncpy_s
malloc
free
memcpy_s
memset
_callnewh
_wcsrev
memcpy

oleaut32

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

SizeofResource
LoadLibraryExW
FreeLibrary
LoadResource
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
LoadStringW
FindResourceExW

api-ms-win-core-synch-l1-2-0

ReleaseMutex
LeaveCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
CreateMutexExW
ReleaseSRWLockExclusive
ReleaseSemaphore
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
CreateEventW
CreateEventExW
CreateSemaphoreExW
EnterCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
Sleep
SetEvent

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
CLSIDFromString
CoFreeUnusedLibrariesEx
StringFromGUID2
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoWaitForMultipleHandles

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegGetValueW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
EventWrite

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
SuspendThread
TerminateProcess
GetCurrentThread
GetCurrentProcess
OpenThreadToken
GetCurrentProcessId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW

api-ms-win-core-localization-l1-2-1

GetUserGeoID
LCMapStringW
GetLocaleInfoW
FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
CloseThreadpoolTimer
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWork
SubmitThreadpoolWork
CallbackMayRunLong
CreateThreadpoolTimer

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-base-l1-2-0

IsValidSid
CopySid
GetTokenInformation
GetLengthSid
EqualSid

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoUninitialize
RoInitialize
RoGetActivationFactory

rpcrt4

RpcImpersonateClient
RpcRevertToSelf

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-core-file-l1-2-1

GetFileAttributesW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-kernel32-legacy-l1-1-1

RegisterWaitForSingleObject

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

api-ms-win-core-localization-obsolete-l1-3-0

GetUserDefaultUILanguage

ntdll

RtlIsMultiSessionSku
NtQueryWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlLengthSid

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

AsyncWorkDispatcher_CreateInstance
CauseCode_GetCodeFriendlyText
CauseCode_IsCodeRegistered
CellVoiceHelper_FreeUiccAppSet
CellVoiceHelper_GetSingleInstance
CellularApiHelper_CreateInstance
CellularApiHelper_FreeCountedModemArray
CellularApiHelper_FreeCountedRegistrationStatusArray
CellularApiHelper_FreeCountedSimAppArray
CellularApiHelper_FreeCountedSimArray
CellularApiHelper_FreeCountedSimLineArray
CellularApiHelper_FreeCountedSlotArray
CellularApiHelper_FreeCountedSlotCanAssociationArray
ComparePhoneNumbers
ConvertPhoneNumberToUINT64
CopyOnlyCharsetCharacters
CreateAudioHardwareHelper
CreateBrandingInfo
CreateCellularApiLineConfig
CreateCellularPhoneLineConfig
CreateDialAssist
CreatePerUserSecurityPolicy
CreatePerUserSecurityToken
CreatePerUserSecurityTokenForRpcClient
DeinitDialingPrefixTable
DetectMultiPrefix
DuplicateSidIfValid
FindAreaCode
FormatPhoneNumberWithLeftToRightMarker
Get3GGPInCallToneDefaultForRegion
Get3GPPInCallToneDefault
Get3GPPInCallToneForTypeAndMcc
Get3GPPInCallToneTypeString
GetAdjustCDMACallTimeSetting
GetCchTailMin
GetCellvoiceLineIdAsString_LocalAlloc
GetCountryCodeFromOperatorNum
GetDefaultWiFiCallingBranding
GetDialStringFromTelUri
GetDialableNumber
GetDialableNumberAndDTMF
GetDialableNumberEtc
GetDialingPrefixes
GetDisplayNameFromCallInformation
GetDisplayNumberWithLeftToRightMarker
GetIddPrefix
GetIddPrefixTable
GetMethodFromPropId
GetNationalNumberLength
GetNddPrefix
GetRegistryStringData
GetRpcClientUser
GetSignedInUserForAppActivation
GetTelUriFromDialString
GetTextReplyPresetMessages
GetTimeDeltaFormat
GetZerothCellularPhoneLineId
InitDialingPrefixTable
IsDialableChar
IsDialableCharEx
IsEqualWnfStateNameHelper
IsNumberDialable
IsTTYEnabled
IsValidCharacterForCharset
MapPlusToDialingPrefix
MaskPhoneNumber
MaskPhoneUri
MaskString
OneShotTimer_CreateInstance
OptimizedReverseNumberCompare
PhoneLineIdToString
PhoneLineIdToUrlEscapedString
Phone_FmtText
Phone_FmtText_GlobalFormat
Phone_FmtText_NonDialerFormat
RemoveMetadataFromNumber
ShouldSupportLineSecurity
StringToPhoneLineId
StripExtraneousNDD
StripNonDtmfChars
UrlEscapeString
ValidPhoneNumberInplaceStripInvalidCharacters
VoipAppIdentityUtilities_GetApplicationByAumid
VoipAppIdentityUtilities_GetApplicationResourceResolverFromApplication
VoipAppIdentityUtilities_GetRpcClientApplicationUserModelId
VoipAppIdentityUtilities_GetVoipAppAUMIDFromPFN

Sections

.text
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a7b3a11a75767d91cd622f1c1bc28bf0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-winrt-l1-1-0

rpcrt4

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-3-0

ntdll

api-ms-win-core-url-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 212KB - Virtual size: 212KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 32B

.rsrc Size: 23KB - Virtual size: 23KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 212KB - Virtual size: 212KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 23KB - Virtual size: 23KB

.reloc
Size: 10KB - Virtual size: 9KB