AppxAllUserStore[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AppxAllUserStore.dll
Size

140KB
MD5

887dbbe8cf300a6ae9d0b5d8ff7c0915
SHA1

7550fc3c1fb31f0fa79f33478c862dde86135060
SHA256

2441bb8867308a05e24dd6370397730288fb9c177f0961bdca1b4bab69eee3b5
SHA512

023101f56c361caa36d235c87434e0420eb8bb791f2ab0f46e7c71359994f93e08cb9d830c1c610409e1475f941d1471d6a1c239f2bf5ee4de0f1ce95bf01e93
SSDEEP

3072:ZbNl06Q8bULqCchuv56bqMwOfwjHygpiyyAY8R+nQBw4M9I3t+8OFiAEApoqLE:DLev56b08ytYQSA+AApoc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AppxAllUserStore.dll

Files

AppxAllUserStore.dll
.dll windows:6 windows x86 arch:x86

457da7d1e33bb1a2e341082d937b0061

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppxAllUserStore.pdb

Imports

msvcrt

_vsnwprintf_s
wcsstr
_except_handler4_common
_onexit
__dllonexit
wcschr
_lock
_wcsnicmp
_initterm
malloc
_wcsicmp
free
_amsg_exit
memcmp
_XcptFilter
memmove
memcpy
_unlock
memset

ntdll

RtlFreeUnicodeString
RtlValidSid
RtlAllocateAndInitializeSid
RtlDowncaseUnicodeString
RtlInitUnicodeString
RtlDeleteCriticalSection
NtQuerySystemInformation
RtlReportException
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
RtlFreeSid

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
TraceMessage

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWrite
EventUnregister
EventRegister

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegCopyTreeW
RegDeleteTreeW
RegGetValueW
RegSetValueExW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringW

api-ms-win-security-base-l1-1-0

GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
GetLengthSid
ImpersonateLoggedOnUser
AdjustTokenPrivileges
CheckTokenMembership
RevertToSelf
CreateWellKnownSid
CopySid

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExW
FreeLibrary
GetProcAddress

api-ms-win-core-file-l1-1-0

GetFileAttributesW
CreateDirectoryW
CreateFileW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegOpenKeyW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

DebugBreak

api-ms-win-core-processsecurity-l1-1-0

OpenProcessToken
OpenThreadToken

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-security-provider-l1-1-0

SetSecurityInfo
GetSecurityInfo
SetEntriesInAclW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

oleaut32

VariantClear
SysStringLen
SysFreeString
SysAllocString
GetErrorInfo

Exports

Exports

AddPackageToRegistryStore
AddStagedPackageToRegistryStore
CheckPackagePreinstallPolicy
CommitTakeOwnershipSession
DeleteAllPackagesFromMainPackageArray
DeleteAllPackagesFromPackageArray
DeletePackageInfo
DeleteUserRegistryKeyFromAllUserStore
DidAppSurviveOSUpgradeForUser
DoesPerUserStoreExist
FamilyMonikerStringToSid
FindExistingVersionInRegistryStore
GetAllNonInboxPackagesFromRegistryStore
GetAllPackagesToBeInstalledForUser
GetAllStagedPackagesForMainPackageFromRegistryStore
GetAppxProvisionFactory
HasStagedPackages
IsEnterprisePolicyEnabled
IsInboxPackage
IsNonInboxAllUserPackage
IsPackageInUpgradeKey
IsSystemInAuditBoot
MarkStatusOfMainPackageForUser
PackageFamilyNameFromId
PackageIdBasicFromFullName
PackageSidToPackageCapabilitySid
RemovePackageFromRegistryStore
RemoveStagedPackageFromRegistryStore
RollbackTakeOwnershipSession
TakeOwnershipOnFolder
UpdateFrameworkPackageInRegistryStore
UpdatePackageInRegistryStore

Sections

.text
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

457da7d1e33bb1a2e341082d937b0061

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processsecurity-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

oleaut32

Exports

Exports

Sections

.text Size: 126KB - Virtual size: 126KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 126KB - Virtual size: 126KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB