Microsoft[.]Uev[.]Office2013CustomActions[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Microsoft.Uev.Office2013CustomActions.dll
Size

534KB
MD5

a9a54e4f38de6098feda715bcb5f27c7
SHA1

eb6e8a82adc82f9a31f6aa1c0fca398926e00308
SHA256

9b6cf5c9383828714ace8c7730563a4f8ad94a2b2a91fa4100061b99dbb602fa
SHA512

b9510885fbfd9d2954141232ddfd5acf79dd22fca55f461883873a9b7441ecfb37bc9ef22be5d9ce0deb0a0a82b5768679bf84acbc8c2304e85beb7d363cfccd
SSDEEP

12288:RsDj5ykSoy4zatxc0eoiqQvb4GBEHc97zSu71rhqf9pixJG:mD9yJo/Wti0eoivvbh6Hc9PSGhqf9YJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Microsoft.Uev.Office2013CustomActions.dll

Files

Microsoft.Uev.Office2013CustomActions.dll
.dll regsvr32 windows:10 windows x86 arch:x86

2dcf3b55115cfb044f362ea8be51891d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Uev.Office2013CustomActions.pdb

Imports

msvcrt

_purecall
_except_handler4_common
??1bad_cast@@UAE@XZ
__CxxFrameHandler3
??0bad_cast@@QAE@ABV0@@Z
??_V@YAXPAX@Z
??0bad_cast@@QAE@PBD@Z
_Wcsftime
fclose
fwrite
fputc
fflush
fgetc
fgetpos
setvbuf
ungetc
fsetpos
_fseeki64
ldiv
?name@type_info@@QBEPBDXZ
_stricmp
strerror
fseek
_wfsopen
??1type_info@@UAE@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
isdigit
isalnum
memcmp
___lc_collate_cp_func
memchr
tolower
isspace
_Strftime
_Gettnames
__mb_cur_max
??3@YAXPAX@Z
_W_Gettnames
_W_Getmonths
_W_Getdays
_Getmonths
_Getdays
ldexp
realloc
abort
_free_locale
_get_current_locale
__crtLCMapStringA
__crtLCMapStringW
__crtCompareStringA
__crtCompareStringW
??8type_info@@QBEHABV0@@Z
_wcsdup
islower
memset
_ismbblead
___mb_cur_max_func
___lc_codepage_func
___lc_handle_func
isupper
__pctype_func
__uncaught_exception
setlocale
_unlock
_lock
_errno
memmove
memcpy
_CxxThrowException
??0exception@@QAE@ABQBDH@Z
_callnewh
calloc
memmove_s
_vsnprintf_s
_wcsicmp
_vsnwprintf
wcsncpy_s
malloc
_wcsnicmp
wcscat_s
wcscpy_s
memcpy_s
sprintf_s
free
localeconv
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
strcspn

user32

CharNextW
UnregisterClassA

kernel32

GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DecodePointer
EncodePointer
GetLocaleInfoW
GetStringTypeW
WideCharToMultiByte
SleepConditionVariableSRW
WakeAllConditionVariable
TlsFree
TlsGetValue
TlsAlloc
TlsSetValue
ResetEvent
OpenEventA
FormatMessageA
AreFileApisANSI
QueryPerformanceCounter
DeviceIoControl
GetUserDefaultLCID
GetSystemInfo
GetFileAttributesW
CreateFileW
ExpandEnvironmentStringsW
LocalUnlock
LocalFree
LocalLock
IsDebuggerPresent
DebugBreak
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
Sleep
OutputDebugStringA
GetModuleFileNameW
MultiByteToWideChar
GetLastError
SizeofResource
SetThreadLocale
EnterCriticalSection
GetThreadLocale
LeaveCriticalSection
RaiseException
FindResourceExW
LoadResource
GetProcAddress
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
GetModuleFileNameA
CreateEventA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
InitializeCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
ReleaseSRWLockExclusive
OutputDebugStringW
SetEvent
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
LoadLibraryW
HeapAlloc
GetLocalTime
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime

ole32

CoCreateInstance
CoTaskMemAlloc
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CLSIDFromString

oleaut32

SysAllocStringLen
SafeArrayAccessData
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayPutElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayCreateEx
GetRecordInfoFromTypeInfo
VariantInit
SafeArrayRedim
UnRegisterTypeLi
LoadTypeLi
SysFreeString
VarUI4FromStr
SysStringLen
SysAllocString
RegisterTypeLi
LoadRegTypeLi

advapi32

EventUnregister
RegDeleteValueW
RegSetKeyValueW
RegDeleteKeyExW
RegEnumValueW
EventWriteTransfer
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
EventSetInformation
EventRegister
RegQueryInfoKeyW

mapi32

ord19
ord75
ord140
ord23
ord21
ord11

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

shell32

SHGetKnownFolderPath

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 470KB - Virtual size: 469KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2dcf3b55115cfb044f362ea8be51891d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

user32

kernel32

ole32

oleaut32

advapi32

mapi32

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

shell32

Exports

Exports

Sections

.text Size: 470KB - Virtual size: 469KB

.data Size: 21KB - Virtual size: 23KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 10KB - Virtual size: 9KB

.reloc Size: 26KB - Virtual size: 25KB

.text
Size: 470KB - Virtual size: 469KB

.data
Size: 21KB - Virtual size: 23KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 10KB - Virtual size: 9KB

.reloc
Size: 26KB - Virtual size: 25KB