SettingSyncCore.pdb
Static task
static1
Behavioral task
behavioral1
Sample
SettingSyncCore.dll
Resource
win10v2004-20240508-en
General
-
Target
SettingSyncCore.dll
-
Size
840KB
-
MD5
f11c3aaf0b0e52a4ddd1547fbd5096aa
-
SHA1
511eedd3fdc4d58409a3bf338c7ff77206c9f925
-
SHA256
eaf21564a07bf6eb71d85f349982118823ec590d9c7a803af212334b7bede517
-
SHA512
6c9022126f405d764e830316150663626fc0e67a5992386fb8f87b18a59c16dee3b02e32da35024a50a4796c7e4ff6ff4da02ec4e05c95c3548627bf6f10c65f
-
SSDEEP
12288:c4OK8Cd0fRM5+WCh0AqxXXD1eOsZbcrpwOYjF:cs8Cd0fClCh0zxXsmp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SettingSyncCore.dll
Files
-
SettingSyncCore.dll.dll windows:10 windows x86 arch:x86
74eaa97cb7af30db5a42ccb49c15a599
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcsstr
_set_errno
_get_errno
memset
_CxxThrowException
_ftol2
memcmp
_wcsicmp
memcpy
iswalnum
wcschr
memmove_s
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
_initterm
realloc
_amsg_exit
_XcptFilter
malloc
free
wcstok_s
_vsnprintf_s
memmove
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
wcsrchr
wcsncpy_s
wcsncmp
_purecall
memcpy_s
_vsnwprintf
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleHandleExW
FreeLibrary
FindStringOrdinal
FreeLibraryAndExitThread
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleA
api-ms-win-core-synch-l1-2-0
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
DeleteCriticalSection
ReleaseSRWLockShared
OpenSemaphoreW
AcquireSRWLockShared
ReleaseMutex
InitializeSRWLock
CreateMutexExW
InitOnceComplete
InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce
WaitForSingleObjectEx
SetEvent
AcquireSRWLockExclusive
CreateEventExW
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
OpenEventW
api-ms-win-core-heap-l1-2-0
HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-1
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-debug-l1-1-1
OutputDebugStringA
OutputDebugStringW
api-ms-win-core-processthreads-l1-1-2
TerminateProcess
GetCurrentProcess
CreateThread
ProcessIdToSessionId
TlsAlloc
OpenProcess
TlsFree
TlsGetValue
GetCurrentThread
OpenThreadToken
TlsSetValue
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
api-ms-win-core-localization-l1-2-1
FormatMessageW
LCMapStringEx
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-2
LoadLibraryW
api-ms-win-core-winrt-error-l1-1-1
SetRestrictedErrorInfo
RoReportFailedDelegate
RoTransformError
RoOriginateErrorW
RoOriginateError
GetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
EventWrite
EventActivityIdControl
api-ms-win-core-registry-l1-1-0
RegNotifyChangeKeyValue
RegGetValueW
RegCloseKey
RegOpenKeyExW
RegDeleteTreeW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW
RegOpenCurrentUser
RegQueryInfoKeyW
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableFlags
TraceMessage
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsIsStringEmpty
WindowsDuplicateString
WindowsGetStringLen
WindowsCreateString
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
ntdll
RtlConvertSidToUnicodeString
RtlReleaseResource
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlDeleteResource
RtlInitializeResource
RtlInitUnicodeString
RtlAllocateHeap
NtQueryWnfStateData
NtDeleteWnfStateName
RtlComputeCrc32
RtlSubscribeWnfStateChangeNotification
NtCreateWnfStateName
RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlFreeUnicodeString
ZwAlpcCancelMessage
RtlWakeAddressAll
TpAllocAlpcCompletion
ZwAlpcDisconnectPort
ZwAlpcSendWaitReceivePort
TpReleaseAlpcCompletion
ZwAlpcQueryInformation
RtlWaitOnAddress
ZwAlpcConnectPort
TpWaitForAlpcCompletion
AlpcInitializeMessageAttribute
AlpcGetMessageAttribute
ZwClose
EtwEventWrite
vDbgPrintEx
RtlFreeHeap
RtlMapGenericMask
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-1
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetSystemTime
GetOsSafeBootMode
api-ms-win-shcore-thread-l1-1-0
SHGetThreadRef
SHSetThreadRef
SHCreateThreadRef
api-ms-win-core-file-l1-2-1
GetDriveTypeW
RemoveDirectoryW
SetFileAttributesW
CreateDirectoryW
FindClose
SetFileTime
DeleteFileW
GetFileTime
CreateFileW
GetFileAttributesExW
FindNextFileW
FindFirstFileW
CompareFileTime
GetFileAttributesW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalReAlloc
LocalAlloc
api-ms-win-core-shlwapi-obsolete-l1-2-0
StrRChrW
StrToIntExW
QISearch
StrChrW
api-ms-win-core-string-l2-1-0
CharLowerBuffW
api-ms-win-core-synch-l1-2-1
CreateSemaphoreW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolIo
WaitForThreadpoolIoCallbacks
CancelThreadpoolIo
StartThreadpoolIo
CreateThreadpoolWait
CloseThreadpoolIo
FreeLibraryWhenCallbackReturns
CloseThreadpoolWait
DisassociateCurrentThreadFromCallback
CallbackMayRunLong
TrySubmitThreadpoolCallback
CloseThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolWait
api-ms-win-core-threadpool-legacy-l1-1-0
CreateTimerQueueTimer
DeleteTimerQueueTimer
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-security-base-l1-2-0
AddAce
GetSecurityDescriptorControl
GetTokenInformation
AddAccessAllowedAceEx
AddAccessDeniedAceEx
GetAclInformation
GetAce
InitializeAcl
GetSecurityDescriptorSacl
IsValidSid
GetLengthSid
CopySid
EqualSid
DeleteAce
api-ms-win-shcore-stream-l1-1-0
IStream_Reset
IStream_Read
SHCreateMemStream
IStream_Write
IStream_Copy
IStream_Size
SHCreateStreamOnFileEx
api-ms-win-shcore-obsolete-l1-1-0
SHStrDupW
api-ms-win-core-path-l1-1-0
PathAllocCanonicalize
PathCchAppend
PathCchCombine
PathCchRemoveFileSpec
PathAllocCombine
api-ms-win-core-shlwapi-legacy-l1-1-0
PathRemoveFileSpecW
PathStripPathW
PathGetCharTypeW
PathFindFileNameW
PathRemoveBackslashW
PathGetDriveNumberW
PathIsUNCW
PathFileExistsW
api-ms-win-security-cryptoapi-l1-1-0
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
api-ms-win-core-file-l2-1-1
CopyFileExW
CreateHardLinkW
ReadDirectoryChangesW
MoveFileExW
api-ms-win-core-processenvironment-l1-2-0
ExpandEnvironmentStringsW
api-ms-win-core-io-l1-1-1
CancelIoEx
DeviceIoControl
rpcrt4
UuidCreate
api-ms-win-shcore-sysinfo-l1-1-0
IsOS
api-ms-win-shcore-registry-l1-1-1
SHDeleteValueW
SHGetValueW
SHSetValueW
SHRegGetValueW
api-ms-win-core-registry-l2-2-0
RegDeleteKeyW
profapi
ord104
shcore
ord100
ord190
ord123
api-ms-win-appmodel-state-l1-2-0
GetSystemAppDataKey
OpenStateExplicit
CloseState
api-ms-win-core-delayload-l1-1-1
DelayLoadFailureHook
ResolveDelayLoadedAPI
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
bcrypt
BCryptGetProperty
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
Exports
Exports
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
IsBackupAppDataEnabled
IsBackupEnabled
IsRoamingEnabled
IsSettingSyncAllowedByGroupPolicy
IsSettingSyncEnabled
IsSettingSyncEnabledSkipUserPolicyCheck
Sections
.text Size: 711KB - Virtual size: 710KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 47KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ