CloudBackupSettings[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

CloudBackupSettings.dll
Size

228KB
MD5

8354da3147906af26d035aca094c000a
SHA1

8318f8d2086bb00846bb213e231f0c2b6669a2c2
SHA256

9636d84ebc8185fdfee338da5fcecfebacf876043f421237e567f71617071125
SHA512

0aeb959f79463787fa86c381364569e86bca9f346d0fabea0dc844899a5a9206ebe8b34f30fd08f97f0d69c9883590512e8570bce9ad3af8eb525056a9c0c1fc
SSDEEP

6144:ySsHgzMBvR4vYJpUhr5uNQksPyYcUThUCJa2iea0:ypAzMBvR4vYJpUhr5uNQksBcSUMa5B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CloudBackupSettings.dll

Files

CloudBackupSettings.dll
.dll windows:10 windows x86 arch:x86

0bc9fed386b007e6f8e1945e0f0da830

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CloudBackupSettings.pdb

Imports

msvcrt

_callnewh
__dllonexit
_onexit
_initterm
malloc
_except_handler4_common
_amsg_exit
_unlock
_vsnwprintf
_XcptFilter
free
_lock
memcpy
memcmp
_CxxThrowException
memcpy_s
_purecall
memmove_s
realloc
_set_errno
_get_errno
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
__CxxFrameHandler3
??1type_info@@UAE@XZ
_ftol2
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
FreeLibraryAndExitThread
GetModuleHandleExW
FindResourceExW
DisableThreadLibraryCalls
GetProcAddress
LoadResource
FreeLibrary
LockResource
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

CreateSemaphoreExW
OpenSemaphoreW
InitOnceExecuteOnce
ReleaseMutex
ReleaseSemaphore
WaitForSingleObjectEx
CreateMutexExW
AcquireSRWLockShared
ReleaseSRWLockShared
SetEvent
AcquireSRWLockExclusive
Sleep
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateEventExW
InitializeSRWLock
WaitForSingleObject

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentThreadId
OpenProcess
OpenProcessToken
CreateThread
TlsAlloc
TlsGetValue
GetCurrentThread
TlsSetValue
TlsFree

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-shcore-thread-l1-1-0

SHSetThreadRef
SHGetThreadRef
SHCreateThreadRef

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWrite

api-ms-win-core-winrt-error-l1-1-1

GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
RoTransformError
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsCreateString
WindowsDeleteString
WindowsStringHasEmbeddedNull

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetOsSafeBootMode
GetSystemTimeAsFileTime

api-ms-win-core-com-l1-1-1

CoGetApartmentType
CLSIDFromString
PropVariantClear
RoGetAgileReference
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoReleaseMarshalData
StringFromCLSID
CreateStreamOnHGlobal
CoMarshalInterface
CoGetInterfaceAndReleaseStream
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
CloseThreadpoolTimer
CallbackMayRunLong
WaitForThreadpoolTimerCallbacks

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-file-l1-2-1

CompareFileTime

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalReAlloc
LocalFree

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

ntdll

RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlFreeUnicodeString
RtlConvertSidToUnicodeString

userenv

GetProfileType

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0bc9fed386b007e6f8e1945e0f0da830

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

ntdll

userenv

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 200KB - Virtual size: 200KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 92B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 18KB - Virtual size: 17KB

.text
Size: 200KB - Virtual size: 200KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 92B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 18KB - Virtual size: 17KB