ChatApis[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ChatApis.dll
Size

567KB
MD5

bdd7e70983156747275d011a1678b69c
SHA1

8b8b03277509d4ebad1870b7ecacd9e76375473a
SHA256

95c117a0a1821a13a67bb2788e4ad64b24b98ed9ce3f128a7ba448e53ade3c24
SHA512

b258d1b50d5b95d458142f14b88bf699d69bfefa5e6275022b7836479be0f8568fd42d10347811ebc1d951fc6499ea2b1616ec25c8357028f4baba22942fd491
SSDEEP

12288:fe2gFYA6jFLltwVrOIqtf0K7CEV0YuntPE8:fe28YRjdluVrOIqB0KeC0YunpE8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ChatApis.dll

Files

ChatApis.dll
.dll windows:10 windows x86 arch:x86

6b1c892aa0b5662dcb51f4a885c06dcb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ChatApis.pdb

Imports

msvcrt

_except_handler4_common
__CxxFrameHandler3
_onexit
__dllonexit
_lock
_initterm
memcmp
_ftol2
_unlock
memcpy_s
_XcptFilter
memset
_callnewh
_vsnwprintf
tolower
wcstok_s
memmove
_wtoi
_errno
_vsnwprintf_s
realloc
memmove_s
_purecall
wcstoul
wcsncpy_s
malloc
free
_amsg_exit
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadLibraryExW
SizeofResource
GetModuleFileNameW
FreeLibrary
FindResourceExW
GetModuleHandleExW
GetModuleFileNameA
LoadResource
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-synch-l1-2-0

InitializeCriticalSectionEx
InitOnceBeginInitialize
CreateEventExW
InitOnceExecuteOnce
CreateEventW
InitializeSRWLock
EnterCriticalSection
SetEvent
LeaveCriticalSection
InitOnceComplete
Sleep
CreateMutexExW
WaitForSingleObject
DeleteCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
OpenSemaphoreW
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSRWLockExclusive
InitializeCriticalSection
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegCreateKeyExW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventWrite
EventRegister
EventWriteTransfer

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW

api-ms-win-core-errorhandling-l1-1-1

RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-sysinfo-l1-2-1

GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

FreeLibraryWhenCallbackReturns
SubmitThreadpoolWork
CloseThreadpoolWork
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolWork
CreateThreadpoolWait

api-ms-win-core-processthreads-l1-1-2

SetThreadToken
GetCurrentProcessId
OpenProcess
GetCurrentProcess
TerminateProcess
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
OpenProcessToken

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
DebugBreak
OutputDebugStringA

api-ms-win-core-file-l1-2-1

CompareFileTime

api-ms-win-core-url-l1-1-0

UrlEscapeW

ntdll

RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
OpenServiceW

api-ms-win-service-winsvc-l1-2-0

QueryServiceStatus

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

StartAndWaitForServiceForUser
IsActiveDebugger
GetUserTokenFromContext
IsCommsSystemService
GenerateUserModeServiceName
GetUserContextFromHandle

systemeventsbrokerclient

SebDeleteEvent
SebCreateMessageInterceptNotificationEvent
SebCreateRcsEndUserMessageNotificationEvent
SebCreateChatNotificationEvent

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
SetLocalRpcConnection

Sections

.text
Size: 504KB - Virtual size: 503KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b1c892aa0b5662dcb51f4a885c06dcb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-debug-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-url-l1-1-0

ntdll

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-profile-l1-1-0

userdataplatformhelperutil

systemeventsbrokerclient

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 504KB - Virtual size: 503KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 244B

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 42KB - Virtual size: 41KB

.text
Size: 504KB - Virtual size: 503KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 244B

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 42KB - Virtual size: 41KB