SettingSync[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

SettingSync.dll
Size

433KB
MD5

f42e1958e80fa728d616f1620696bf66
SHA1

c829a1415a0b9e253a5d642e9a3add30d9c791e9
SHA256

ceb5e9a5ac1786db6fda32f3e9338ed28058207fe4413785f0473756bbc622e6
SHA512

d895d5ad4f149e1407bfaf00fb418e3d582b7cbe2cd866dccfa1bacaa5b02581b477d9291d88a138834b3706c9e6dafa6f2e5818edeb64b006faca8ac8cb9ba9
SSDEEP

12288:o1pAr24hfNn8wo4wnnW5Vbr7WNbgV+B+NszpTs:oU1nlo4wnnGPaNbgV9sx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SettingSync.dll

Files

SettingSync.dll
.dll windows:10 windows x86 arch:x86

07b1985b889243317e34a1c9ca3f0f56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SettingSync.pdb

Imports

msvcrt

??0exception@@QAE@ABQBDH@Z
__uncaught_exception
abort
_callnewh
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
wcschr
memset
_wcsdup
_ismbblead
_errno
___mb_cur_max_func
??0bad_cast@@QAE@PBD@Z
??0exception@@QAE@ABQBD@Z
calloc
towupper
iswalpha
?what@exception@@UBEPBDXZ
iswdigit
_except_handler4_common
memmove
wcstok_s
memmove_s
??1type_info@@UAE@XZ
_onexit
_set_errno
realloc
_get_errno
___lc_codepage_func
__dllonexit
___lc_handle_func
_initterm
_purecall
_amsg_exit
__pctype_func
memcpy
_XcptFilter
_CIsqrt
malloc
free
memcmp
wcsstr
__CxxFrameHandler3
wcsncmp
_vsnprintf_s
_CxxThrowException
setlocale
_unlock
_lock
??_V@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
_free_locale
_get_current_locale
__crtLCMapStringW
wcscpy_s
_wcsicmp
wcstoul
iswalnum
_ftol2

api-ms-win-shcore-sysinfo-l1-1-0

IsOS

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
FreeLibraryAndExitThread
LoadLibraryExW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleHandleA
FreeLibrary
GetModuleFileNameW
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
OpenEventW
InitializeSRWLock
WaitForSingleObjectEx
CreateEventW
SetEvent
InitializeCriticalSectionEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreExW
CreateEventExW
InitOnceComplete
WaitForMultipleObjectsEx
ReleaseMutex
ReleaseSemaphore
InitOnceExecuteOnce
InitOnceBeginInitialize
WaitForSingleObject
Sleep
CreateMutexExW
OpenSemaphoreW

api-ms-win-core-heap-l1-2-0

HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

RaiseException
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-2

CreateThread
DeleteProcThreadAttributeList
TlsAlloc
TlsFree
TlsGetValue
ResumeThread
TlsSetValue
GetCurrentThreadId
OpenThreadToken
GetCurrentThread
OpenProcessToken
CreateProcessAsUserW
GetCurrentProcess
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
SetThreadToken
TerminateProcess
GetCurrentProcessId
CreateProcessW

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetLocaleInfoW
GetLocaleInfoEx
SetLocaleInfoW
GetUserDefaultLocaleName

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW
LoadLibraryA

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegOpenCurrentUser
RegSetValueExW
RegDeleteValueW
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids

api-ms-win-core-file-l1-2-1

FindClose
FindFirstFileW
SetFileTime
CompareFileTime
GetFileAttributesExW
CreateFileW
FindNextFileW
DeleteFileW

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
TrySubmitThreadpoolCallback
FreeLibraryWhenCallbackReturns

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWrite
EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-sysinfo-l1-2-1

GetSystemDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-path-l1-1-0

PathCchCombine
PathCchAppend

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-appcontainer-l1-1-0

GetAppContainerNamedObjectPath

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
StartTraceW
StopTraceW

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-errorhandling-l1-1-3

RaiseFailFastException

api-ms-win-core-kernel32-legacy-l1-1-1

GetComputerNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

SHExpandEnvironmentStringsW
PathFileExistsW
PathFindNextComponentW
PathFindExtensionW
PathRelativePathToW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-shlwapi-obsolete-l1-2-0

StrRStrIW
StrCmpICW
StrToIntExW
QISearch

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

ntdll

ZwQueryWnfStateData
RtlNtStatusToDosError
RtlGetSuiteMask
NtQueryInformationToken

wevtapi

EvtSetChannelConfigProperty
EvtSaveChannelConfig
EvtClose
EvtOpenChannelConfig

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 388KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07b1985b889243317e34a1c9ca3f0f56

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-shcore-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-path-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-appcontainer-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

wevtapi

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 388KB - Virtual size: 387KB

.data Size: 4KB - Virtual size: 6KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 1024B - Virtual size: 780B

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 388KB - Virtual size: 387KB

.data
Size: 4KB - Virtual size: 6KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 1024B - Virtual size: 780B

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 23KB - Virtual size: 22KB