StorageContextHandler[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

StorageContextHandler.dll
Size

86KB
MD5

8db655c1dcdbe9d0802bd8c03add872a
SHA1

1ca9041ff4b914b70b709156373084c5b2afc038
SHA256

f1da59b2ece7dbb2a6f344a220524b098df1f69fce869f32669f057fd86cd064
SHA512

0747079ec1ab0e5f35c064a0785bfb60f4185c3210ff3beeea43bc4cded1a0ae72e36357dbf86b68c589fb938459a6970f8266eacfd80ba6a3ccb465de6d1cf6
SSDEEP

1536:nxFgCS89Avbp04SPKw6yV9ejsdns19R22tFi9VmU2BQfkzKRITNA7ANt2bFiRO5:c8CpvJI9nsV7jUYQfMNAsHGiRG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
StorageContextHandler.dll

Files

StorageContextHandler.dll
.dll regsvr32 windows:10 windows x86 arch:x86

50b869ca09c406f1fb1388702e238c34

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

StorageContextHandler.pdb

Imports

msvcrt

_amsg_exit
realloc
_initterm
_onexit
_XcptFilter
?terminate@@YAXXZ
__CxxFrameHandler3
_callnewh
_ftol2
calloc
_errno
_lock
__dllonexit
_CxxThrowException
_unlock
_except_handler4_common
memmove_s
_purecall
_wcsupr
iswspace
malloc
wcsncpy_s
wcscat_s
free
wcscpy_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
??1type_info@@UAE@XZ
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadLibraryExW
FreeLibrary
GetModuleFileNameA
LoadStringW
GetModuleHandleExW
GetModuleHandleW
SizeofResource
LoadResource
FindResourceExW
GetProcAddress
DisableThreadLibraryCalls
LockResource

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
WaitForSingleObject
CreateSemaphoreExW
ResetEvent
CreateEventW
ReleaseMutex
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
EnterCriticalSection
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
HeapDestroy
GetProcessHeap
HeapFree
HeapSize

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
SetThreadLocale
GetThreadLocale

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VarUI4FromStr
SysAllocString
VariantClear
VariantInit

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegGetValueW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc
CoGetMalloc
CoCreateInstance
StringFromGUID2
PropVariantClear
CoTaskMemRealloc
CLSIDFromString

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar

api-ms-win-devices-config-l1-1-1

CM_Locate_DevNodeW
CM_Get_Device_Interface_ListW
CM_Get_Device_IDW
CM_Get_Device_Interface_List_SizeW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-file-l1-1-0

CreateFileW
GetDriveTypeW

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrIW
QISearch
StrCmpICW
StrCmpNICW

api-ms-win-shcore-comhelpers-l1-1-0

IUnknown_Set
IUnknown_GetSite
IUnknown_QueryService

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

cfgmgr32

CM_Get_Parent_Ex
CM_Get_DevNode_Registry_Property_ExW
CM_Get_DevNode_Custom_PropertyW

api-ms-win-appmodel-runtime-l1-1-0

GetApplicationUserModelId

api-ms-win-shlwapi-winrt-storage-l1-1-1

ord348
IUnknown_GetWindow

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

api-ms-win-dx-d3dkmt-l1-1-4

D3DKMTGetProcessList
D3DKMTGetProcessDeviceRemovalSupport

ntdll

NtQueryInformationProcess

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-shell-namespace-l1-1-0

SHGetIDListFromObject
SHCreateItemFromParsingName

api-ms-win-devices-query-l1-1-0

DevGetObjects
DevFreeObjects

api-ms-win-dx-d3dkmt-l1-1-0

D3DKMTOpenAdapterFromDeviceName
D3DKMTQueryAdapterInfo

api-ms-win-core-shlwapi-legacy-l1-1-0

PathGetDriveNumberW

setupapi

SetupDiCreateDeviceInfoList
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiGetDevicePropertyW
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInfoW
SetupDiEnumDeviceInterfaces

shell32

ord100
SHCreateItemInKnownFolder
ShellExecuteExW

user32

UnregisterClassA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

50b869ca09c406f1fb1388702e238c34

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-shcore-comhelpers-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

cfgmgr32

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-shlwapi-winrt-storage-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-4

ntdll

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-shell-namespace-l1-1-0

api-ms-win-devices-query-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

setupapi

shell32

user32

Exports

Exports

Sections

.text Size: 70KB - Virtual size: 70KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 7KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 70KB - Virtual size: 70KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB