UserDataPlatformHelperUtil.pdb
Static task
static1
Behavioral task
behavioral1
Sample
UserDataPlatformHelperUtil.dll
Resource
win10v2004-20240426-en
General
-
Target
UserDataPlatformHelperUtil.dll
-
Size
50KB
-
MD5
bf15702eda020cc2894d2088ddf84faf
-
SHA1
64acfc95d7f4cec28c0bfd252a2e20a302723e3d
-
SHA256
15e0add71214c237421832c459f14d642b8124b237f6c26d78b09bd3903e4960
-
SHA512
240090c49c6f55ac9fd0b8ae3c60d509c2cbdd43109d038c3f3a24a7d46728d69c00506b976af2520eba892367807f29f4f22aab61e12be2d124746f5ba54f26
-
SSDEEP
1536:iT9zOey7n3o066UP7Lr2IwuUeQF6ssBHoOq4edGx0FZMAzMt:KzORb662Lr2IwuUastOqbdGx0FZMUMt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource UserDataPlatformHelperUtil.dll
Files
-
UserDataPlatformHelperUtil.dll.dll windows:10 windows x86 arch:x86
5570312364fa6b9303b141d5e849f0c3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
__dllonexit
_unlock
_onexit
_callnewh
_CIsqrt
_XcptFilter
memmove
memcpy
_ftol2
_initterm
??1type_info@@UAE@XZ
_vsnwprintf
_lock
_except_handler4_common
free
memcpy_s
rand
srand
_purecall
__CxxFrameHandler3
?raw_name@type_info@@QBEPBDXZ
malloc
_amsg_exit
memset
rpcrt4
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcImpersonateClient
RpcStringFreeW
RpcRevertToSelf
RpcBindingFree
RpcBindingSetAuthInfoExW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
UnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
InitializeCriticalSectionEx
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleHandleW
DisableThreadLibraryCalls
FreeLibrary
GetProcAddress
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
api-ms-win-core-file-l1-1-0
GetTempFileNameW
GetFileAttributesW
CreateFileW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-shell-shdirectory-l1-1-0
ord290
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegGetValueW
RegCreateKeyExW
RegSetValueExW
api-ms-win-security-base-l1-1-0
MakeSelfRelativeSD
MakeAbsoluteSD
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-service-winsvc-l1-1-0
ControlService
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindExtensionW
PathMatchSpecW
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrStrIW
ntdll
NtQueryInformationThread
NtSetInformationThread
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
??0CalculateSize@Comms@@QAE@_N0@Z
??0Deserializer@Comms@@QAE@PBE0_N1@Z
??0RpcClient@Comms@@QAE@XZ
??0SecureRpcClient@Comms@@QAE@XZ
??0SerializeBuffer@Comms@@QAE@ABVCalculateSize@1@_N1@Z
??1Deserializer@Comms@@QAE@XZ
??1RpcClient@Comms@@QAE@XZ
??1SecureRpcClient@Comms@@UAE@XZ
?CopyBytesIn@CalculateSize@Comms@@UAEXPBXIABVtype_info@@@Z
?CopyBytesIn@SerializeBuffer@Comms@@UAEXPBXIABVtype_info@@@Z
?CopyBytesOut@Deserializer@Comms@@QAE_NPAXIABVtype_info@@@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAPAD@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAPAG@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAPBD@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAPBG@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAV?$basic_string@GU?$char_traits@G@utl@@V?$allocator@G@2@@utl@@@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAV?$vector@EV?$allocator@E@utl@@@utl@@@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAVNullType@detail@1@@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@ABVNullType@detail@1@@Z
?GetBuffer@Deserializer@Comms@@QAEPAXI@Z
?GetBuffer@SerializeBuffer@Comms@@QAEXAAV?$vector@EV?$allocator@E@utl@@@utl@@@Z
?GetBuffer@SerializeBuffer@Comms@@QBEPBV?$vector@EV?$allocator@E@utl@@@utl@@XZ
?GetTotal@CalculateSize@Comms@@QBEIXZ
?Initialize@SerializeBuffer@Comms@@QAE_NXZ
?InitializeBinding@RpcClient@Comms@@QAEJPBGAAPAX@Z
?ReleaseBuffer@Deserializer@Comms@@QAEXPBX@Z
?SerializeObject@Comms@@YGXAAVSerializeBase@1@ABV?$basic_string@GU?$char_traits@G@utl@@V?$allocator@G@2@@utl@@@Z
?SerializeObject@Comms@@YGXAAVSerializeBase@1@ABV?$vector@EV?$allocator@E@utl@@@utl@@@Z
?SerializeObject@Comms@@YGXAAVSerializeBase@1@ABVNullType@detail@1@@Z
?SerializeObject@Comms@@YGXAAVSerializeBase@1@PBD@Z
?SerializeObject@Comms@@YGXAAVSerializeBase@1@PBG@Z
?_InitializeSecureRpcBinding@SecureRpcClient@Comms@@IAEJPBG0@Z
ConvertHtmlStringToPlainTextStringOneCore
ConvertPlainTextStringToHtmlStringOneCore
CreateKnownFolderPath
DefaultMakeHresultFromJetError
DllCanUnloadNow
DllGetClassObject
FreeEnumColumn
GenerateUserModeServiceName
GetCalendarColors
GetCombinedTransientObjectSecurityDescriptor
GetContentTypeFromFilePath
GetFileExtensionFromContentType
GetNextNewCalendarColor
GetQueryProcessHandle
GetRpcClientThreadToken
GetSupportedImageFileExtensions
GetTempFileNameWithExt
GetThreadIOPriority
GetUserContextFromHandle
GetUserTokenFromContext
IsActiveDebugger
IsCommsSystemService
IsImageExtension
JetReallocMethod
PrependHtmlOneCore
ResizeImageBySizeInMemory
ResizeImageBySizeToStream
RunServicesInProc
SetCommsServiceJetGlobalSystemParameters
SetPoolThreadBasePriority
SetThreadIOPriority
StartAndWaitForService
StartAndWaitForServiceForUser
StopAndWaitForFullyNamedService
StopAndWaitForService
UT_UninitializeTrident
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ