AppExtension[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AppExtension.dll
Size

142KB
MD5

dc3221b8fa2f12f0dcc6c4ba5b2eae78
SHA1

1dc20d78db955a70683a6511d64dcf4d7e33f332
SHA256

157f14ca386b27aac14b92a75e66862a929ed0c4f869f73b4bb2eed399f768e3
SHA512

7b939b82fde26e8c9cb1f0c6821f08cd0266959ad7c35ab812c2068e3257ba61f0f582dbce564a52417d0906115d8079033901dd37500a033fa7dc13310493d2
SSDEEP

3072:A3+JcpzLFYKtyCXZOGdEmxt8uEGoWluPXJQgt3k3Hb3NCUEB:A3ocRkgOGdbxKuEGo8oXHwHbdTEB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AppExtension.dll

Files

AppExtension.dll
.dll windows:10 windows x86 arch:x86

b645639840f1db534a016c32d15d3266

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppExtension.pdb

Imports

msvcrt

realloc
memmove_s
wcschr
_callnewh
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
malloc
free
_amsg_exit
_CxxThrowException
memcpy
_XcptFilter
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
memmove
__CxxFrameHandler3
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
memset

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-com-l1-1-0

CoGetCallContext
CoCreateFreeThreadedMarshaler
CoGetCallerTID
CoGetApartmentType
CoGetInterfaceAndReleaseStream
CreateStreamOnHGlobal
CoReleaseMarshalData
CoMarshalInterface
CoWaitForMultipleHandles
CoCreateGuid
StringFromCLSID
CoRevertToSelf
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
OpenThreadToken
GetCurrentThread
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetProcessId

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateErrorW
RoTransformError
GetRestrictedErrorInfo
RoOriginateError

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
ReleaseMutex
EnterCriticalSection
CreateEventExW
CreateEventW
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
SetEvent
WaitForSingleObjectEx
OpenSemaphoreW
AcquireSRWLockShared
ReleaseSemaphore
InitializeSRWLock
DeleteCriticalSection
CreateMutexExW
AcquireSRWLockExclusive
CreateSemaphoreExW
WaitForMultipleObjectsEx
ReleaseSRWLockShared
LeaveCriticalSection

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LoadStringW
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-security-base-l1-1-0

CopySid
GetLengthSid
DuplicateTokenEx
GetTokenInformation

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

combase

ord168

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

ntdll

RtlInitUnicodeString
NtQueryInformationToken
RtlFreeHeap
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableAvl
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
RtlInsertElementGenericTableAvl
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlAllocateHeap

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b645639840f1db534a016c32d15d3266

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-registry-l1-1-0

combase

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

ntdll

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 123KB - Virtual size: 122KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 180B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 123KB - Virtual size: 122KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 180B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 8KB