SettingSyncCore[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SettingSyncCore.dll
Size

840KB
MD5

f11c3aaf0b0e52a4ddd1547fbd5096aa
SHA1

511eedd3fdc4d58409a3bf338c7ff77206c9f925
SHA256

eaf21564a07bf6eb71d85f349982118823ec590d9c7a803af212334b7bede517
SHA512

6c9022126f405d764e830316150663626fc0e67a5992386fb8f87b18a59c16dee3b02e32da35024a50a4796c7e4ff6ff4da02ec4e05c95c3548627bf6f10c65f
SSDEEP

12288:c4OK8Cd0fRM5+WCh0AqxXXD1eOsZbcrpwOYjF:cs8Cd0fClCh0zxXsmp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SettingSyncCore.dll

Files

SettingSyncCore.dll
.dll windows:10 windows x86 arch:x86

74eaa97cb7af30db5a42ccb49c15a599

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SettingSyncCore.pdb

Imports

msvcrt

wcsstr
_set_errno
_get_errno
memset
_CxxThrowException
_ftol2
memcmp
_wcsicmp
memcpy
iswalnum
wcschr
memmove_s
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
_initterm
realloc
_amsg_exit
_XcptFilter
malloc
free
wcstok_s
_vsnprintf_s
memmove
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
wcsrchr
wcsncpy_s
wcsncmp
_purecall
memcpy_s
_vsnwprintf

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleHandleExW
FreeLibrary
FindStringOrdinal
FreeLibraryAndExitThread
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleA

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
DeleteCriticalSection
ReleaseSRWLockShared
OpenSemaphoreW
AcquireSRWLockShared
ReleaseMutex
InitializeSRWLock
CreateMutexExW
InitOnceComplete
InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce
WaitForSingleObjectEx
SetEvent
AcquireSRWLockExclusive
CreateEventExW
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
OpenEventW

api-ms-win-core-heap-l1-2-0

HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
OutputDebugStringW

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcess
CreateThread
ProcessIdToSessionId
TlsAlloc
OpenProcess
TlsFree
TlsGetValue
GetCurrentThread
OpenThreadToken
TlsSetValue
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId

api-ms-win-core-localization-l1-2-1

FormatMessageW
LCMapStringEx

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-winrt-error-l1-1-1

SetRestrictedErrorInfo
RoReportFailedDelegate
RoTransformError
RoOriginateErrorW
RoOriginateError
GetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister
EventWrite
EventActivityIdControl

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegGetValueW
RegCloseKey
RegOpenKeyExW
RegDeleteTreeW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW
RegOpenCurrentUser
RegQueryInfoKeyW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableFlags
TraceMessage
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsIsStringEmpty
WindowsDuplicateString
WindowsGetStringLen
WindowsCreateString
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

ntdll

RtlConvertSidToUnicodeString
RtlReleaseResource
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlDeleteResource
RtlInitializeResource
RtlInitUnicodeString
RtlAllocateHeap
NtQueryWnfStateData
NtDeleteWnfStateName
RtlComputeCrc32
RtlSubscribeWnfStateChangeNotification
NtCreateWnfStateName
RtlNtStatusToDosError
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlFreeUnicodeString
ZwAlpcCancelMessage
RtlWakeAddressAll
TpAllocAlpcCompletion
ZwAlpcDisconnectPort
ZwAlpcSendWaitReceivePort
TpReleaseAlpcCompletion
ZwAlpcQueryInformation
RtlWaitOnAddress
ZwAlpcConnectPort
TpWaitForAlpcCompletion
AlpcInitializeMessageAttribute
AlpcGetMessageAttribute
ZwClose
EtwEventWrite
vDbgPrintEx
RtlFreeHeap
RtlMapGenericMask

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetSystemTime
GetOsSafeBootMode

api-ms-win-shcore-thread-l1-1-0

SHGetThreadRef
SHSetThreadRef
SHCreateThreadRef

api-ms-win-core-file-l1-2-1

GetDriveTypeW
RemoveDirectoryW
SetFileAttributesW
CreateDirectoryW
FindClose
SetFileTime
DeleteFileW
GetFileTime
CreateFileW
GetFileAttributesExW
FindNextFileW
FindFirstFileW
CompareFileTime
GetFileAttributesW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalReAlloc
LocalAlloc

api-ms-win-core-shlwapi-obsolete-l1-2-0

StrRChrW
StrToIntExW
QISearch
StrChrW

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolIo
WaitForThreadpoolIoCallbacks
CancelThreadpoolIo
StartThreadpoolIo
CreateThreadpoolWait
CloseThreadpoolIo
FreeLibraryWhenCallbackReturns
CloseThreadpoolWait
DisassociateCurrentThreadFromCallback
CallbackMayRunLong
TrySubmitThreadpoolCallback
CloseThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolWait

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-security-base-l1-2-0

AddAce
GetSecurityDescriptorControl
GetTokenInformation
AddAccessAllowedAceEx
AddAccessDeniedAceEx
GetAclInformation
GetAce
InitializeAcl
GetSecurityDescriptorSacl
IsValidSid
GetLengthSid
CopySid
EqualSid
DeleteAce

api-ms-win-shcore-stream-l1-1-0

IStream_Reset
IStream_Read
SHCreateMemStream
IStream_Write
IStream_Copy
IStream_Size
SHCreateStreamOnFileEx

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-core-path-l1-1-0

PathAllocCanonicalize
PathCchAppend
PathCchCombine
PathCchRemoveFileSpec
PathAllocCombine

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveFileSpecW
PathStripPathW
PathGetCharTypeW
PathFindFileNameW
PathRemoveBackslashW
PathGetDriveNumberW
PathIsUNCW
PathFileExistsW

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-core-file-l2-1-1

CopyFileExW
CreateHardLinkW
ReadDirectoryChangesW
MoveFileExW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-io-l1-1-1

CancelIoEx
DeviceIoControl

rpcrt4

UuidCreate

api-ms-win-shcore-sysinfo-l1-1-0

IsOS

api-ms-win-shcore-registry-l1-1-1

SHDeleteValueW
SHGetValueW
SHSetValueW
SHRegGetValueW

api-ms-win-core-registry-l2-2-0

RegDeleteKeyW

profapi

ord104

shcore

ord100
ord190
ord123

api-ms-win-appmodel-state-l1-2-0

GetSystemAppDataKey
OpenStateExplicit
CloseState

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

bcrypt

BCryptGetProperty
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
IsBackupAppDataEnabled
IsBackupEnabled
IsRoamingEnabled
IsSettingSyncAllowedByGroupPolicy
IsSettingSyncEnabled
IsSettingSyncEnabledSkipUserPolicyCheck

Sections

.text
Size: 711KB - Virtual size: 710KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

74eaa97cb7af30db5a42ccb49c15a599

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-string-l1-1-0

ntdll

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-shlwapi-obsolete-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-io-l1-1-1

rpcrt4

api-ms-win-shcore-sysinfo-l1-1-0

api-ms-win-shcore-registry-l1-1-1

api-ms-win-core-registry-l2-2-0

profapi

shcore

api-ms-win-appmodel-state-l1-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-version-l1-1-0

bcrypt

Exports

Exports

Sections

.text Size: 711KB - Virtual size: 710KB

.data Size: 4KB - Virtual size: 6KB

.idata Size: 11KB - Virtual size: 11KB

.didat Size: 1024B - Virtual size: 536B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 63KB - Virtual size: 63KB

.reloc Size: 47KB - Virtual size: 46KB

.text
Size: 711KB - Virtual size: 710KB

.data
Size: 4KB - Virtual size: 6KB

.idata
Size: 11KB - Virtual size: 11KB

.didat
Size: 1024B - Virtual size: 536B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 63KB - Virtual size: 63KB

.reloc
Size: 47KB - Virtual size: 46KB