AppxSip[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

AppxSip.dll
Size

96KB
MD5

4183a5d2c84106b6de1d8646a0cf6cf8
SHA1

a72d396869a3341a29e89f4e74fd152b9094d0c6
SHA256

ac1d8f69030930d0573fa850e262f811bce4f54b570908966730380a076d15e4
SHA512

f481f0d84ec184b895e93b1dd5d64a2357854ef33e224b6eb3434b1bace88a4ce199dcc0a9ed77422ec9d8a7e7b873aa43b7d3a724600161b366e747c92fd546
SSDEEP

1536:Y5kGsHUNkjIo4J0qHKhbnTeTtGJtedrDaCGwOe21eIxJDaopEfWdtRX5kEcLX:2kfFd4JghbSI/edjgeiDR2nL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AppxSip.dll

Files

AppxSip.dll
.dll regsvr32 windows:6 windows x86 arch:x86

a40c9471638c9355b85de82a0b30fff4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppxSip.pdb

Imports

ntdll

RtlAllocateHeap
RtlNtStatusToDosError
RtlDeleteCriticalSection
RtlGetVersion
RtlFreeHeap
qsort
memmove
memcmp
memcpy
memset

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-synch-l1-2-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWrite

crypt32

CertGetSubjectCertificateFromStore
CryptQueryObject
CryptMsgGetParam
CertNameToStrW
CryptEncodeObject
CertCloseStore
CryptMsgClose
CryptSIPAddProvider
CryptSIPRemoveProvider
CertFreeCertificateContext
CryptFindOIDInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleHandleW

api-ms-win-core-file-l1-2-1

DeleteFileA
DeleteFileW
GetTempFileNameW
GetTempPathW
GetFileAttributesW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-1

CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
CompareStringEx

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileEx

wintrust

CryptCATCDFOpen
CryptCATCDFClose
CryptCATCDFEnumCatAttributes

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableW

api-ms-win-core-file-l2-1-1

MoveFileExW
ReplaceFileW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-kernel32-legacy-l1-1-1

FileTimeToDosDateTime
DosDateTimeToFileTime
CopyFileW

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

opcservices

ord12

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

Exports

Exports

AppxBundleSipCreateIndirectData
AppxBundleSipGetSignedDataMsg
AppxBundleSipIsFileSupportedName
AppxBundleSipPutSignedDataMsg
AppxBundleSipRemoveSignedDataMsg
AppxBundleSipVerifyIndirectData
AppxSipCreateIndirectData
AppxSipGetSignedDataMsg
AppxSipIsFileSupportedName
AppxSipPutSignedDataMsg
AppxSipRemoveSignedDataMsg
AppxSipVerifyIndirectData
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
P7xSipCreateIndirectData
P7xSipGetSignedDataMsg
P7xSipIsFileSupportedName
P7xSipPutSignedDataMsg
P7xSipRemoveSignedDataMsg
P7xSipVerifyIndirectData

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a40c9471638c9355b85de82a0b30fff4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-eventing-provider-l1-1-0

crypt32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-shcore-stream-l1-1-0

wintrust

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-delayload-l1-1-1

opcservices

api-ms-win-core-heap-l1-2-0

Exports

Exports

Sections

.text Size: 85KB - Virtual size: 85KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 56B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 85KB - Virtual size: 85KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 56B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB