MapsBtSvc[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

MapsBtSvc.dll
Size

114KB
MD5

cdd42b3fb3f29bf812a02bca72227244
SHA1

f9782609929f86b2442f65e3544a9936dae934ea
SHA256

8bebf64d65f2199e773e1347f1945c0056ed8ca6b1e4c72c4ef6ccf361101654
SHA512

7af4511280e49673786eb80e6da06a548468aa0321d3e82280f13d9b14558d8f5d234d8f394da460c4074364d50f0265f7b9b31386a7ac6b5a5580ef9d8b2435
SSDEEP

1536:2MdShVsctyrQW2MQrdJpslb6UUVZh6hMeT7Pn2NZKwUyuqY8pKnexzjeLhi4qW:2MYhcrfQrpslbkhFeTaNsZqY8pKe9Yq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MapsBtSvc.dll

Files

MapsBtSvc.dll
.dll windows:10 windows x86 arch:x86

c4f1eafbaec24264e281bc363f126ae9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MapsBtSvc.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o__wcsicmp
_o__wtoi
_o_free
_o_malloc
_o_memset
_except_handler4_common
_CxxThrowException
_o__configure_narrow_argv
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
__CxxFrameHandler3
memmove
__std_terminate

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW

api-ms-win-core-synch-l1-2-0

ReleaseMutex
InitializeCriticalSection
CreateEventW
SetEvent
EnterCriticalSection
InitOnceComplete
InitOnceBeginInitialize
CreateEventExW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
DeleteCriticalSection
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
LeaveCriticalSection

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-com-l1-1-1

CoRevokeClassObject
CoDisconnectContext
CoTaskMemFree
CoGetApartmentType
CoCreateGuid
CoCreateInstance
CoUninitialize
CoInitializeEx
CoRegisterClassObject
StringFromCLSID

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-3

RaiseFailFastException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegGetValueW

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetThreadLocale

api-ms-win-core-heap-l1-2-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-security-base-l1-2-0

ImpersonateLoggedOnUser
RevertToSelf

api-ms-win-core-path-l1-1-0

PathCchCombine
PathAllocCombine
PathAllocCanonicalize

api-ms-win-core-file-l1-2-1

DeleteFileW
FindNextFileW
FindFirstFileW
SetFileAttributesW
CreateDirectoryW
RemoveDirectoryW
FindClose
GetFileAttributesW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

winhttp

WinHttpGetIEProxyConfigForCurrentUser

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalFree
LocalFree

api-ms-win-core-kernel32-legacy-l1-1-1

RegisterWaitForSingleObject

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer
UnregisterWaitEx
QueueUserWorkItem

api-ms-win-security-accesshlpr-l1-1-0

QueryTransientObjectSecurityDescriptor
FreeTransientObjectSecurityDescriptor

ztrace_maps

ZTraceHelper
ZTraceReportIgnore
ZTraceReportOriginationNoThis
ZTraceHelperNoThis
ZTraceReportPropagation
ZTraceReportOrigination
ZTraceReportPropagationNoThis
ZTraceClose
ZTraceInit
ZTraceReportIgnoreNoThis

msvcp_win

?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_message@std@@YAKKPADK@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ

Exports

Exports

MapsBackgroundTransferClassFactory_Register
MapsBackgroundTransferClassFactory_Revoke
MapsBackgroundTransferService_CreateOrFindJob
MapsBackgroundTransferService_FreeJob
MapsBackgroundTransferService_GetIsAnyJobWaiting
MapsBackgroundTransferService_RegisterCallbacks
MapsBackgroundTransferService_SetNetworkCostPolicy
MapsBackgroundTransferService_SetPowerPolicy
MapsBackgroundTransferService_SetPriority
MapsBackgroundTransferService_SetServiceCallbacks
MapsBackgroundTransferService_UnregisterCallbacks

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4f1eafbaec24264e281bc363f126ae9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-registry-l1-1-1

winhttp

api-ms-win-core-heap-l2-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-security-accesshlpr-l1-1-0

ztrace_maps

msvcp_win

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 96KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 96KB - Virtual size: 96KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB