PortableDeviceStatus[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

PortableDeviceStatus.dll
Size

417KB
MD5

f7cf764f8155492eb50e4505a6da8d87
SHA1

519d40e3c658cc0cfddb85a8f2889932ab420f4d
SHA256

cb97fde0592082551dc1e8a55a4783603107c222a79832a26ed14ee07a2697fb
SHA512

d8001d219286cafcd34750db7b19e7a9c729452202aa0c2a8b1679d11744942b0a0bfd0c1c25d07e7793964a9730cb9d64a10e274210ee2b1725db7ab2052f7a
SSDEEP

3072:PtlGf1bE1NHzS10Eh8Hq9ksAOnoeR1jKiYya/LZeehw:Pta1bE210Ekq9ag

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PortableDeviceStatus.dll

Files

PortableDeviceStatus.dll
.dll regsvr32 windows:6 windows x86 arch:x86

0fcf92d4d78cff95e82945a13c201f37

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PortableDeviceStatus.pdb

Imports

msvcrt

_amsg_exit
malloc
free
memcpy_s
wcscpy_s
wcsncpy_s
wcscat_s
??_V@YAXPAX@Z
??_U@YAPAXI@Z
_onexit
_lock
__dllonexit
memset
_purecall
??2@YAPAXI@Z
_unlock
_errno
realloc
_except_handler4_common
??3@YAXPAX@Z
_initterm
_XcptFilter
_vsnwprintf
memmove_s

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringA
GetSystemTimeAsFileTime
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
GetModuleFileNameW
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
SetThreadLocale
GetThreadLocale
CloseHandle
WaitForSingleObject
OpenThread
GetCurrentThreadId
CreateFileW
CompareStringOrdinal
GetModuleHandleExW
FormatMessageW
GetVersionExA
InterlockedExchange
Sleep
InterlockedCompareExchange

user32

GetMessageW
DefWindowProcW
PostQuitMessage
SetWindowLongW
PeekMessageW
GetWindowLongW
IsWindow
DispatchMessageW
RegisterClassExW
LoadStringW
UnregisterClassA
DestroyWindow
CreateWindowExW
UnregisterClassW
CharNextW
PostMessageW
RegisterDeviceNotificationW
UnregisterDeviceNotification

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance
PropVariantClear
CoUninitialize
PropVariantCopy
CreateItemMoniker
GetRunningObjectTable
CoInitializeEx

oleaut32

UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysFreeString
SysAllocString
LoadTypeLi
SysStringLen

shlwapi

ord16
ord354

advapi32

GetTraceEnableLevel
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegGetValueW
RegEnumKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
RegDeleteValueW
GetTraceEnableFlags
TraceMessage
EventWrite
EventUnregister
EventRegister

propsys

PSGetNameFromPropertyKey
InitPropVariantFromFileTime
PSCreateMemoryPropertyStore
InitPropVariantFromCLSID
PropVariantCompareEx

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 360KB - Virtual size: 359KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0fcf92d4d78cff95e82945a13c201f37

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

user32

ole32

oleaut32

shlwapi

advapi32

propsys

Exports

Exports

Sections

.text Size: 51KB - Virtual size: 51KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 360KB - Virtual size: 359KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 51KB - Virtual size: 51KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 360KB - Virtual size: 359KB

.reloc
Size: 4KB - Virtual size: 4KB