ContactApis[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ContactApis.dll
Size

829KB
MD5

054238671a4d0fc657285438beeac4aa
SHA1

ef3cb7c2ede84fd9197d68c45aa060f8c66df413
SHA256

0aebe89c614558694421f38b106b7867a5df6bb85fb0005968b721498f02d535
SHA512

ec244919f565c62f9ce34b15c97b71cc0958a22216756ad3ec5b26100ae8a7788a413b32a55e073254e3ab27e1a3e3c5378d811a08e006cb65334f993f8a4233
SSDEEP

12288:ZfndpeJqNtNhmJUCbMrtXVlQz3Qf9cPq1vQ7wKYZi5Te69dl+SZsmOJYNyItX95f:dNrKJUCXvG9KHI2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ContactApis.dll

Files

ContactApis.dll
.dll windows:10 windows x86 arch:x86

7d42e13a61e2e96739c750af00302632

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ContactApis.pdb

Imports

msvcrt

_except_handler4_common
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
memcmp
_initterm
_amsg_exit
_XcptFilter
_callnewh
wcstoul
_errno
_vsnwprintf_s
wcsstr
realloc
memcpy
memmove_s
memmove
malloc
free
_purecall
memcpy_s
_vsnwprintf
_lock
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
LoadLibraryExW
GetProcAddress

api-ms-win-core-synch-l1-2-0

CreateMutexExW
AcquireSRWLockShared
WaitForSingleObject
InitOnceBeginInitialize
InitializeSRWLock
InitOnceExecuteOnce
DeleteCriticalSection
InitializeCriticalSectionEx
InitOnceComplete
SetEvent
OpenSemaphoreW
CreateEventExW
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
ReleaseSemaphore
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
CreateEventW
CreateSemaphoreExW
Sleep
ReleaseSRWLockShared

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventWrite
EventActivityIdControl
EventRegister
EventUnregister
EventSetInformation

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
OpenProcess
GetCurrentProcessId
OpenThreadToken
OpenProcessToken
SetThreadToken
GetCurrentThread

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWait
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
FreeLibraryWhenCallbackReturns
SetThreadpoolWait

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

ntdll

RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-service-management-l1-1-0

OpenServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-service-winsvc-l1-2-0

QueryServiceStatus

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

GenerateUserModeServiceName
GetUserTokenFromContext
IsActiveDebugger
IsCommsSystemService
GetUserContextFromHandle
StartAndWaitForServiceForUser

contactactivation

AwaitContactPickerResults
ShowContactPickerAsync
ContactToVCardString

userdatalanguageutil

IsMatchingEAPrefix
DetermineStringEALangIdNLS
IsEAChar

systemeventsbrokerclient

SebCreateContactNotificationEvent
SebDeleteEvent

phoneutil

ValidPhoneNumberInplaceStripInvalidCharacters

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
SetLocalRpcConnection

Sections

.text
Size: 758KB - Virtual size: 758KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7d42e13a61e2e96739c750af00302632

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

ntdll

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-2-0

api-ms-win-core-winrt-propertysetprivate-l1-1-1

api-ms-win-core-profile-l1-1-0

userdataplatformhelperutil

contactactivation

userdatalanguageutil

systemeventsbrokerclient

phoneutil

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-registry-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 758KB - Virtual size: 758KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 248B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 61KB - Virtual size: 61KB

.text
Size: 758KB - Virtual size: 758KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 248B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 61KB - Virtual size: 61KB