PackageStateRoaming[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

PackageStateRoaming.dll
Size

173KB
MD5

5779182d856e7ea64c6f45666095b8fd
SHA1

3a6c34b29bd0a49c45ce78265d3e40427dbf5207
SHA256

66bb992b3293955652b91e7518423b6afffba718be5680713ca39e472f099605
SHA512

c69354774418195a8190865bff0cdc6239a2f0df7c00399ec6bfa58c425e9699b2a376e9986a941adaa6ed91f3af50be07c83ed8362954b6f06fe553378bbf78
SSDEEP

3072:H9d/2iLZsJaGhF577BpPfaz9up8FBk1L2x7SmRIqlEz:2iLZ4awF5DaZIWBk1L2x2mRTE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PackageStateRoaming.dll

Files

PackageStateRoaming.dll
.dll windows:10 windows x86 arch:x86

9b289edfef236f0c2d284800f88a86ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PackageStateRoaming.pdb

Imports

msvcrt

memcmp
memcpy
memcpy_s
_except_handler4_common
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_callnewh
realloc
free
malloc
memmove_s
_purecall
memmove
_vsnwprintf
memset

api-ms-win-core-shlwapi-obsolete-l1-2-0

StrRChrW
StrStrIW
QISearch

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWrite
EventUnregister
EventRegister

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError
RoTransformError

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-synch-l1-2-0

ReleaseSRWLockExclusive
CreateMutexExW
CreateSemaphoreExW
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseMutex
SetEvent
ReleaseSemaphore
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
ResetEvent
CreateEventW
Sleep
OpenSemaphoreW
CreateEventExW
DeleteCriticalSection
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenCurrentUser
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-path-l1-1-0

PathCchCombine
PathAllocCombine
PathCchAppend

api-ms-win-core-errorhandling-l1-1-1

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-file-l1-2-1

CompareFileTime
FindNextFileW
GetFileAttributesW
FindFirstFileW
FindClose

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveBackslashW
PathFindFileNameW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-processthreads-l1-1-2

OpenProcess
ProcessIdToSessionId
GetCurrentThreadId
CreateThread
GetCurrentProcessId
SetThreadPriority
TlsAlloc
TerminateProcess
GetCurrentProcess
TlsSetValue
TlsFree
TlsGetValue
GetCurrentThread

api-ms-win-core-localization-l1-2-1

FormatMessageW

ntdll

RtlAllocateHeap
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
EtwEventWrite
EtwEventEnabled
EtwEventRegister
RtlReleaseSRWLockExclusive
EtwEventUnregister
RtlAcquireSRWLockExclusive
RtlNtStatusToDosError
RtlInitUnicodeString
WinSqmIncrementDWORD
RtlDeleteCriticalSection
RtlTryEnterCriticalSection
RtlInitializeCriticalSection
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlFreeHeap

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-appmodel-runtime-l1-1-1

GetPackagesByPackageFamily
GetApplicationUserModelId
OpenPackageInfoByFullName
GetStagedPackageOrigin
ClosePackageInfo

api-ms-win-appmodel-runtime-internal-l1-1-3

GetPackageStatus

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-shcore-stream-l1-1-0

IStream_Reset
IStream_Read
IStream_Size
SHCreateMemStream
IStream_Write

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString

api-ms-win-security-base-l1-2-0

GetLengthSid
IsValidSecurityDescriptor
GetTokenInformation
CopySid

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabledForPackage

api-ms-win-appmodel-runtime-internal-l1-1-0

GetPackagePropertyString
GetPackageContext
GetPackageProperty

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-heap-l1-2-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback
CreateThreadpoolTimer
SetThreadpoolWait
CloseThreadpoolWait
FreeLibraryWhenCallbackReturns
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CallbackMayRunLong

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize

api-ms-win-core-biplmapi-l1-1-1

BiGetActiveBackgroundTasksEvent

rpcrt4

RpcImpersonateClient
I_RpcExceptionFilter
NdrClientCall4
RpcEpRegisterW
UuidFromStringW
RpcServerRegisterIf3
RpcServerInqBindings
RpcServerUseProtseqW
RpcServerUnregisterIf
RpcBindingVectorFree
RpcEpUnregister
RpcStringBindingComposeW
NdrServerCall2
RpcServerInqCallAttributesW
RpcRevertToSelf
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcStringFreeW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b289edfef236f0c2d284800f88a86ba

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-shlwapi-obsolete-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

ntdll

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-appmodel-runtime-l1-1-1

api-ms-win-appmodel-runtime-internal-l1-1-3

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-appmodel-runtime-internal-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-biplmapi-l1-1-1

rpcrt4

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 134KB - Virtual size: 134KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 300B

.rsrc Size: 21KB - Virtual size: 20KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 134KB - Virtual size: 134KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 300B

.rsrc
Size: 21KB - Virtual size: 20KB

.reloc
Size: 8KB - Virtual size: 8KB