LocationApi[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

LocationApi.dll
Size

313KB
MD5

8bab6943bc43e799db182602ebbf9d57
SHA1

461b4f318bb824b58a78ae089181acd17339d004
SHA256

32ec0b68e09fc55356da8a0ce2a5e72f2f929dddb7a02cb4bb981692c33446f7
SHA512

45ff347a05a4937b00d11ecb658909a551100a62b2f05385f5aa426f871d2f1afaf4999ec19ceda7540a299c774e3a51655fac692ad689ce55acae786c32abd3
SSDEEP

3072:Kzi8A/O1uT7A3ogWiGPsAmmE6ELVBFZmVCrJazk6QXEVww1t06CqPrDFYvXBtHf+:a6/ON3hD0mazMHwytH2ZXUJXHHB3dKB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LocationApi.dll

Files

LocationApi.dll
.dll regsvr32 windows:10 windows x86 arch:x86

4633e15f5d83ab1281d0972ab7715720

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

LocationApi.pdb

Imports

msvcp110_win

?_Xbad_alloc@std@@YAXXZ

msvcrt

__CxxFrameHandler3
memmove
_wcsicmp
_wmakepath_s
_wsplitpath_s
memcmp
_ftol2
_CxxThrowException
_CIsqrt
??3@YAXPAX@Z
_resetstkoflw
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
_callnewh
memset
wcsncpy_s
malloc
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
wcscat_s
wcscpy_s
memcpy_s
calloc
_vsnwprintf
??_V@YAXPAX@Z
memcpy

oleaut32

LPSAFEARRAY_UserSize
BSTR_UserMarshal
UnRegisterTypeLi
BSTR_UserFree
SysFreeString
LoadRegTypeLi
BSTR_UserSize
BSTR_UserUnmarshal
VariantInit
VariantClear
SystemTimeToVariantTime
VariantTimeToSystemTime
LoadTypeLi
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserMarshal
RegisterTypeLi
SysStringLen
SysAllocString
LPSAFEARRAY_UserUnmarshal

rpcrt4

NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrStubCall2
CStdStubBuffer_Connect
NdrDllCanUnloadNow
IUnknown_Release_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
NdrCStdStubBuffer2_Release
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrDllGetClassObject
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_Disconnect

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient12
CStdStubBuffer2_CountRefs
ObjectStublessClient14
ObjectStublessClient4
NdrProxyForwardingFunction5
ObjectStublessClient6
CStdStubBuffer2_Connect
NdrProxyForwardingFunction4
CStdStubBuffer2_QueryInterface
ObjectStublessClient3
ObjectStublessClient15
ObjectStublessClient8
NdrProxyForwardingFunction6
ObjectStublessClient5
CStdStubBuffer2_Disconnect
ObjectStublessClient9
ObjectStublessClient13
ObjectStublessClient10
ObjectStublessClient7
NdrProxyForwardingFunction3
ObjectStublessClient11

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
GetProcAddress
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleExW

api-ms-win-core-localization-l1-2-1

EnumSystemGeoID
GetGeoInfoW
GetThreadLocale
GetUserGeoID
SetThreadLocale
FormatMessageW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegGetKeySecurity
RegDeleteKeyExW
RegQueryValueExW
RegGetValueW
RegSetValueExW
RegCloseKey
RegSetKeySecurity
RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyExW

api-ms-win-core-synch-l1-2-0

WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexW
InitializeSRWLock
Sleep
WaitForSingleObject
AcquireSRWLockShared
InitializeCriticalSection
CreateMutexExW
ReleaseSRWLockShared
DeleteCriticalSection
LeaveCriticalSection
ReleaseSemaphore
ReleaseSRWLockExclusive
OpenEventW
CreateEventW
EnterCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
SetEvent
ReleaseMutex

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-1

GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-com-l1-1-1

CoCreateInstance
PropVariantClear
CoTaskMemFree
StringFromGUID2
PropVariantCopy
CLSIDFromString
CoTaskMemAlloc
CoSetProxyBlanket

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
CreateThread
GetCurrentProcessId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
IsThreadpoolTimerSet
SetThreadpoolTimer
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpool
SetThreadpoolWait
CreateThreadpool
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolThreadMaximum

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-sysinfo-l1-2-1

GetTickCount64
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-marshal-l1-1-0

HWND_UserUnmarshal
HWND_UserMarshal
HWND_UserSize
HWND_UserFree

user32

DefWindowProcW
GetWindowLongW
SetWindowLongW
UnregisterClassA
RegisterWindowMessageW
GetClassNameW
PostMessageW
EnumWindows
IsWindow
PostThreadMessageW
RegisterClassExW
CreateWindowExW
GetMessageW
DestroyWindow
TranslateMessage
DispatchMessageW
UnregisterClassW

ntdll

WinSqmAddToStreamEx
WinSqmAddToAverageDWORD
WinSqmAddToStream
WinSqmIsOptedIn
WinSqmIncrementDWORD

propsys

PropVariantToBSTR
InitPropVariantFromFileTime
InitPropVariantFromCLSID
PropVariantToDouble
PropVariantToString

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-security-base-l1-2-0

AddAce
InitializeSecurityDescriptor
GetAce
GetAclInformation
GetSecurityDescriptorDacl
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
SetSecurityDescriptorDacl
InitializeAcl
AddAccessAllowedAceEx
CopySid
GetLengthSid

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 230KB - Virtual size: 229KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4633e15f5d83ab1281d0972ab7715720

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp110_win

msvcrt

oleaut32

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-string-l2-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-marshal-l1-1-0

user32

ntdll

propsys

api-ms-win-core-apiquery-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 230KB - Virtual size: 229KB

.data Size: 1024B - Virtual size: 5KB

.idata Size: 9KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 53KB - Virtual size: 53KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 230KB - Virtual size: 229KB

.data
Size: 1024B - Virtual size: 5KB

.idata
Size: 9KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 53KB - Virtual size: 53KB

.reloc
Size: 18KB - Virtual size: 18KB