FirewallAPI.pdb
Static task
static1
Behavioral task
behavioral1
Sample
FirewallAPI.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
FirewallAPI.dll
Resource
win10v2004-20240426-en
General
-
Target
FirewallAPI.dll
-
Size
530KB
-
MD5
d6661aa0a6c1c509f53e5b78de04bc3b
-
SHA1
15536a90de67360bb686ac89c740cac3077c49a4
-
SHA256
3f62b97607e678b2d6b6a2de531a37b4e03824abe7130edf9d630f96a7e28657
-
SHA512
1e388e1dcfb1d4f15c57be7de6423a79bb1ed77b51caa70bc96cddc8f06d054658114bbccb9e33c32696810ec63af83353d7296fee6313ba3bca9d5f155b02c6
-
SSDEEP
12288:1yNDnZ54GGlEoxN9R0s9o+uQyahEMY9QgVB9lwt:wNTcGGlEoxN9isU0hEMY9rVB9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FirewallAPI.dll
Files
-
FirewallAPI.dll.dll regsvr32 windows:6 windows x86 arch:x86
5fec608235b9f1ad74b252d183c724b1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
towupper
iswalpha
wcspbrk
memmove
wcsncmp
wcschr
wcstoul
_XcptFilter
_amsg_exit
_ultow
_wcsnicmp
qsort
wcstok
_wcsicmp
_vsnwprintf
_initterm
?terminate@@YAXXZ
_purecall
??1type_info@@UAE@XZ
_except_handler4_common
??_V@YAXPAX@Z
??_U@YAPAXI@Z
wcscpy_s
??2@YAPAXI@Z
realloc
wcscat_s
malloc
free
??3@YAXPAX@Z
memcpy
memcmp
__CxxFrameHandler3
_CxxThrowException
iswdigit
memset
ntdll
EtwEventWrite
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlCopySid
RtlLengthSid
RtlNtStatusToDosError
NtQueryObject
NtClose
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlInitUnicodeString
RtlIpv6StringToAddressW
RtlIpv4StringToAddressW
EtwTraceMessage
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
rpcrt4
UuidCreate
RpcStringFreeW
UuidToStringW
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrStubCall2
NdrOleAllocate
NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy
NdrDllUnregisterProxy
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllRegisterProxy
RpcBindingFree
NdrAsyncClientCall
NdrClientCall2
RpcAsyncCancelCall
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcEpResolveBinding
RpcAsyncCompleteCall
RpcBindingSetAuthInfoExW
RpcBindingSetOption
RpcAsyncInitializeHandle
api-ms-win-core-synch-l1-2-0
CreateEventW
Sleep
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
SetEvent
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
GetProcAddress
LoadLibraryExW
FreeLibrary
FindResourceExW
SizeofResource
GetModuleFileNameW
DisableThreadLibraryCalls
LoadResource
GetModuleHandleW
api-ms-win-core-string-l2-1-0
CharNextW
CharPrevW
api-ms-win-core-errorhandling-l1-1-1
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegEnumKeyExW
RegNotifyChangeKeyValue
RegSetValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteValueW
RegDeleteTreeW
RegCloseKey
RegEnumValueW
RegOpenCurrentUser
RegSaveKeyExW
RegRestoreKeyW
RegQueryValueExW
api-ms-win-core-sysinfo-l1-2-1
GetSystemTimeAsFileTime
GetComputerNameExW
GetVersionExW
GetTickCount
GetSystemInfo
api-ms-win-core-memory-l1-1-2
VirtualQuery
VirtualProtect
VirtualAlloc
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-heap-l1-2-0
HeapFree
HeapDestroy
GetProcessHeap
HeapAlloc
api-ms-win-security-base-l1-2-0
IsValidSecurityDescriptor
GetSecurityDescriptorDacl
GetAce
DuplicateTokenEx
FreeSid
AdjustTokenPrivileges
AllocateAndInitializeSid
CreateWellKnownSid
RevertToSelf
GetTokenInformation
CheckTokenMembership
AccessCheck
CheckTokenCapability
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
api-ms-win-core-localization-l1-2-1
GetThreadUILanguage
GetSystemDefaultLangID
FormatMessageW
api-ms-win-core-processthreads-l1-1-2
GetCurrentThreadId
OpenProcessToken
OpenThreadToken
TerminateProcess
GetCurrentProcessId
SetThreadToken
GetCurrentThread
GetCurrentProcess
api-ms-win-core-processenvironment-l1-2-0
ExpandEnvironmentStringsW
api-ms-win-core-file-l1-2-1
CreateFileW
GetLongPathNameW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
api-ms-win-core-debug-l1-1-1
IsDebuggerPresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-shlwapi-legacy-l1-1-0
PathCanonicalizeW
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
UnregisterWaitEx
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
api-ms-win-core-string-obsolete-l1-1-0
lstrcpynW
lstrcmpiW
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
api-ms-win-core-shlwapi-obsolete-l1-1-0
SHLoadIndirectString
combase
ord15
ord18
ord19
ord34
ord14
ord24
ord22
ord7
ord16
ord25
ord11
ord33
ord13
ord35
ord21
ord17
ord32
ord10
ord12
ord9
ord6
ord8
ord23
ord20
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
DelayLoadFailureHook
Exports
Exports
CalculateOpenPortOrAuthAppAddrStringSize
CreateDefaultPerInterfaceIcmpRule
CreateDefaultPerInterfaceOpenPortRule
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FWAddAuthenticationSet
FWAddConnectionSecurityRule
FWAddCryptoSet
FWAddFirewallRule
FWAddMainModeRule
FWChangeNotificationCreate
FWChangeNotificationDestroy
FWChangeTransactionalState
FWClosePolicyStore
FWCopyAuthenticationSet
FWCopyConnectionSecurityRule
FWCopyCryptoSet
FWCopyFirewallRule
FWDeleteAllAuthenticationSets
FWDeleteAllConnectionSecurityRules
FWDeleteAllCryptoSets
FWDeleteAllFirewallRules
FWDeleteAllMainModeRules
FWDeleteAuthenticationSet
FWDeleteConnectionSecurityRule
FWDeleteCryptoSet
FWDeleteFirewallRule
FWDeleteMainModeRule
FWDeletePhase1SAs
FWDeletePhase2SAs
FWDiagGetAppList
FWEnumAdapters
FWEnumAuthenticationSets
FWEnumConnectionSecurityRules
FWEnumCryptoSets
FWEnumFirewallRules
FWEnumMainModeRules
FWEnumNetworks
FWEnumPhase1SAs
FWEnumPhase2SAs
FWEnumProducts
FWExportPolicy
FWFreeAdapters
FWFreeAuthenticationSet
FWFreeAuthenticationSets
FWFreeAuthenticationSetsByHandle
FWFreeConnectionSecurityRule
FWFreeConnectionSecurityRules
FWFreeConnectionSecurityRulesByHandle
FWFreeCryptoSet
FWFreeCryptoSets
FWFreeCryptoSetsByHandle
FWFreeDiagAppList
FWFreeFirewallRule
FWFreeFirewallRules
FWFreeFirewallRulesByHandle
FWFreeFirewallRulesOld
FWFreeMainModeRule
FWFreeMainModeRules
FWFreeMainModeRulesByHandle
FWFreeNetworks
FWFreePhase1SAs
FWFreePhase2SAs
FWFreeProducts
FWGPLock
FWGPUnlock
FWGetConfig
FWGetConfig2
FWGetGlobalConfig
FWGetGlobalConfig2
FWGetGlobalConfig3
FWGetIndicatedPortInUse
FWImportPolicy
FWIndicatePortInUse
FWIndicateProxyForUrl
FWIndicateProxyResolverRefresh
FWIndicateTupleInUse
FWIsTargetAProxy
FWOpenPolicyStore
FWQueryAuthenticationSets
FWQueryConnectionSecurityRules
FWQueryCryptoSets
FWQueryFirewallRules
FWQueryIsolationType
FWQueryMainModeRules
FWRegisterProduct
FWResetIndicatedPortInUse
FWResetIndicatedTupleInUse
FWResolveGPONames
FWRestoreDefaults
FWRestoreGPODefaults
FWRevertTransaction
FWSelectConSecRule
FWSetAuthenticationSet
FWSetConfig
FWSetConnectionSecurityRule
FWSetCryptoSet
FWSetFirewallRule
FWSetGPHelperFnPtrs
FWSetGlobalConfig
FWSetGlobalConfig2
FWSetMainModeRule
FWStatusMessageFromStatusCode
FWUnregisterProduct
FWVerifyAuthenticationSet
FWVerifyAuthenticationSetQuery
FWVerifyConnectionSecurityRule
FWVerifyConnectionSecurityRuleQuery
FWVerifyCryptoSet
FWVerifyCryptoSetQuery
FWVerifyFirewallRule
FWVerifyFirewallRuleQuery
FWVerifyMainModeRule
FWVerifyMainModeRuleQuery
FreeAbsoluteInterfaces
FwActivate
FwAddRule
FwAddSet
FwAddrChangeSourceInitialize
FwAddrChangeSourceShutdown
FwAddrChangeSourceSignal
FwAdvPolicyDecodeFirewallRule
FwAdvPolicyEncodeRule
FwAlloc
FwAllocCheckSize
FwAnalyzeFirewallPolicy
FwAnalyzeFirewallPolicyOnProfile
FwAppContainerChangeFree
FwAreAllContainedInAddresses
FwBinariesFree
FwBstrToPorts
FwCSRuleEmpty
FwCSRuleVerify
FwCanonizeAuthorizedApps
FwChangeSourceInitialize
FwChangeSourceShutdown
FwChangeSourceSignal
FwChangeSourceSignalStart
FwChkBuildSidAndAttributesFree
FwClosePolicyStore
FwConvertIPv6SubNetToRange
FwCopyAuthSet
FwCopyAuthSetListToLowerVersion
FwCopyAuthsetToHigherVersion
FwCopyCSRule
FwCopyCryptoSet
FwCopyICMPTypeCode
FwCopyInterfaceLuids
FwCopyLUID
FwCopyMMRule
FwCopyMainModeRule
FwCopyPlatform
FwCopyPortRange
FwCopyPortsContents
FwCopyRule
FwCopyWFAddressesContents
FwCreateLocalTempStore
FwDeleteAllRules
FwDeleteAllSets
FwDeleteRule
FwDeleteSet
FwDestroyLocalTempStore
FwDoNothingOnObject
FwEmptyWFAddresses
FwEmptyWFRule
FwEnableMemTracing
FwEnumRules
FwEnumSets
FwFree
FwFreeAddresses
FwFreeRules
FwFreeSets
FwFreeWFRule
FwGetAddressesAsString
FwGetAppBlockList
FwGetConfig
FwGetCurrentProfile
FwGetGlobalConfig
FwGetGlobalConfigFromLocalTempStore
FwGetRule
FwGetVersionField
FwICFProfileToWfProfile
FwICFProtocolToWfProtocol
FwIPV4RangeContainsMulticast
FwIPV6RangeContainsMulticast
FwImageListDestroy
FwImageListHasImage
FwIsGroupPolicyEnforced
FwIsRemoteManagementEnabled
FwIsV6AddrLoopback
FwMMRuleVerify
FwMergeAddresses
FwMigrateLegacyAuthenticatedBypassSddl
FwMigrateLegacySettings
FwNegateAddresses
FwOpenAppCDbPolicyStore
FwOpenPolicyStore
FwParseAddressToken
FwPortsToString
FwReduceObjectsToVersion
FwRemoveDuplicateAddresses
FwResolveIndirectString
FwRuleResolveFlags
FwSddlStringVerify
FwSetConfig
FwSetGlobalConfig
FwSetMemLeakPolicy
FwSetResolveFlags
FwSetRule
FwSetSet
FwSidAndAttributesCopy
FwSidAndAttributesFree
FwSidCopy
FwSidsToString
FwStringToAddresses
FwStringToSids
FwSubtractAddresses
FwUniteWFAddressesContents
FwVerifyNoHeapLeaks
FwVerifyWFRuleSemantics
FwWfProtocolToICFProtocol
GetDisabledInterfaces
GetOpenPortOrAuthAppAddrScope
IcfAddrChangeNotificationCreate
IcfChangeNotificationCreate
IcfChangeNotificationDestroy
IcfConnect
IcfDisconnect
IcfFreeDynamicFwPorts
IcfFreeProfile
IcfFreeTickets
IcfGetCurrentProfileType
IcfGetDynamicFwPorts
IcfGetOperationalMode
IcfGetProfile
IcfGetTickets
IcfIsPortAllowed
IcfOpenDynamicFwPortWithoutSocket
IcfSubNetsGetScope
IsAddressesEmpty
IsEqualAddresses
IsFirewallInCoExistanceMode
IsPortOrICMPAllowed
IsPortsEmpty
IsRuleOldAuthApp
IsRuleOldGlobalOpenPort
IsRuleOpenPortOrAuthApp
IsRulePerInterfaceIcmp
IsRulePerInterfaceOpenPort
IsUnicastExplicitAddressesEmpty
Isv4Orv6AddressesEmpty
LoadGPExtensionDll
MakeAbsoluteInterfaces
NetworkIsolationCreateAppContainer
NetworkIsolationDeleteAppContainer
NetworkIsolationDiagnoseConnectFailure
NetworkIsolationDiagnoseConnectFailureAndGetInfo
NetworkIsolationDiagnoseListen
NetworkIsolationDiagnoseSocketCreation
NetworkIsolationEnumAppContainers
NetworkIsolationEnumerateAppContainerRules
NetworkIsolationFreeAppContainers
NetworkIsolationGetAppContainerConfig
NetworkIsolationRegisterForAppContainerChanges
NetworkIsolationSetAppContainerConfig
NetworkIsolationSetupAppContainerBinaries
NetworkIsolationUnregisterForAppContainerChanges
OpenPortOrAuthAppAddrToString
ValidatePortOrAppAddressString
Sections
.text Size: 454KB - Virtual size: 453KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 373B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ