EmailApis[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

EmailApis.dll
Size

791KB
MD5

0b4b01c3aab90e8f682aa188d40c0018
SHA1

3d4b966e4daa6616462cd3a64926a9fd590448ba
SHA256

320a9ba254d95a80665ce5c65f634dcf79d4c7a7561c359a454c9a4c354137d7
SHA512

8a98f0253dc930154f8e4d3f90ee7c12ecb829e3d76d85e724dc068ff737261d134bf530bc5fb6bca98dc6c3a89ecc1f76fc56dae9562c44c8514aa83986b325
SSDEEP

12288:M4z+/jUnCpASpemTPtZhgYIw2n8sMNA2glTM:1S/wnCpA+emDtZhgYT2n8sMNA2g2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EmailApis.dll

Files

EmailApis.dll
.dll windows:10 windows x86 arch:x86

6bc3414bdf2b885bf0f37c5fe9681b7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

EmailApis.pdb

Imports

msvcrt

__CxxFrameHandler3
_onexit
__dllonexit
memmove
memcpy
memcmp
_unlock
_lock
_except_handler4_common
memcpy_s
_amsg_exit
_XcptFilter
_callnewh
wcstoul
wcschr
wcsncmp
_errno
_vsnwprintf_s
memmove_s
realloc
_vsnwprintf
_purecall
wcsncpy_s
malloc
free
_initterm
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
LoadLibraryExW
FindResourceExW
LoadResource
FreeLibrary
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
SizeofResource

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
CreateEventExW
SetEvent
CreateEventW
InitializeCriticalSectionEx
DeleteCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateMutexExW
InitializeSRWLock

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegSetValueExW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventActivityIdControl
EventRegister
EventSetInformation

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA
DebugBreak

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
OpenThreadToken
GetCurrentThreadId
GetCurrentThread
TerminateProcess
SetThreadToken

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW
InitOnceExecuteOnce
Sleep

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
SubmitThreadpoolWork
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolWork

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-url-l1-1-0

UrlEscapeW
UrlUnescapeW

api-ms-win-core-file-l1-1-0

GetTempFileNameW
FindNextFileW
DeleteFileW
FindClose
FindFirstFileW
CreateDirectoryW
RemoveDirectoryW

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchCombine

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW

ntdll

RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

IsCommsSystemService
StartAndWaitForServiceForUser
GetUserContextFromHandle
GenerateUserModeServiceName
GetUserTokenFromContext
RunServicesInProc

systemeventsbrokerclient

SebDeleteEvent
SebCreateEmailNotificationEvent

appointmentapis

CreatePropertiesFromRecurrencePattern
CreateRecurrencePatternFromProperties

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 720KB - Virtual size: 720KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bc3414bdf2b885bf0f37c5fe9681b7b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-url-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

ntdll

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-profile-l1-1-0

userdataplatformhelperutil

systemeventsbrokerclient

appointmentapis

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 720KB - Virtual size: 720KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 276B

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 61KB - Virtual size: 60KB

.text
Size: 720KB - Virtual size: 720KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 276B

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 61KB - Virtual size: 60KB