PortableDeviceApi[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

PortableDeviceApi.dll
Size

511KB
MD5

4683cdb08235af54231c314c9dcea344
SHA1

b17f1de9156bfa7aa743d5d662105291ee38a90e
SHA256

4ecb2af92ce2ad183e74339175b5d4aa26595c1c7748d4a2b81f24a705585713
SHA512

594af5aa9958910607949d730296aca1c49de142ea60240d9e3938d498ff1c54669bdbd16fe0a5367212a193aa0298e4b63a77c6ad8e6af21157b98ead024dfd
SSDEEP

12288:jOIieFPP/+06Tw5buZPjeLxNK3d5SzwgsWN:jJibTwFuZPaNK3d3gs4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PortableDeviceApi.dll

Files

PortableDeviceApi.dll
.dll regsvr32 windows:10 windows x86 arch:x86

695341d1e816cdf1ca40739e7e00ba6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PortableDeviceApi.pdb

Imports

msvcrt

__CxxFrameHandler3
_except_handler4_common
realloc
_vsnwprintf
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memset
_callnewh
vswprintf_s
_vscwprintf
calloc
memmove_s
_wcsicmp
wcsnlen
_purecall
wcscat_s
wcscpy_s
wcsncpy_s
malloc
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_errno
_CxxThrowException
_ftol2
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
GetModuleHandleW
SizeofResource
LoadResource
LockResource
FreeLibraryAndExitThread
FindResourceExW
GetModuleFileNameW
GetModuleFileNameA
LoadStringW
GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-synch-l1-2-0

ReleaseSemaphore
InitOnceComplete
Sleep
InitOnceBeginInitialize
CreateEventW
CreateSemaphoreExW
WaitForMultipleObjectsEx
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
WaitForSingleObject
ReleaseMutex

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapReAlloc
HeapSize
HeapAlloc
HeapDestroy
HeapFree

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TerminateProcess
ResumeThread
GetCurrentProcessId
CreateThread
GetCurrentProcess
OpenProcessToken
OpenThreadToken
GetCurrentThread

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
TraceMessage
GetTraceEnableLevel
TraceEvent

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWrite
EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-security-base-l1-2-0

GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation

api-ms-win-core-io-l1-1-1

GetOverlappedResult
DeviceIoControl
CancelIoEx

api-ms-win-core-file-l1-2-1

CreateFileW

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
FreeLibraryWhenCallbackReturns
TrySubmitThreadpoolCallback

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

kernel32

lstrcmpiW
GetCurrentPackageFamilyName

rpcrt4

CStdStubBuffer_Connect
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
NdrDllGetClassObject
NdrDllRegisterProxy
CStdStubBuffer_DebugServerRelease
NdrCStdStubBuffer_Release
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
NdrDllUnregisterProxy
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
NdrCStdStubBuffer2_Release
IUnknown_AddRef_Proxy
NdrClientCall2
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrOleAllocate
CStdStubBuffer_DebugServerQueryInterface

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 404KB - Virtual size: 403KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

695341d1e816cdf1ca40739e7e00ba6d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l2-1-0

kernel32

rpcrt4

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 404KB - Virtual size: 403KB

.data Size: 5KB - Virtual size: 6KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 296B

.rsrc Size: 63KB - Virtual size: 62KB

.reloc Size: 31KB - Virtual size: 31KB

.text
Size: 404KB - Virtual size: 403KB

.data
Size: 5KB - Virtual size: 6KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 296B

.rsrc
Size: 63KB - Virtual size: 62KB

.reloc
Size: 31KB - Virtual size: 31KB