SearchFolder[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SearchFolder.dll
Size

331KB
MD5

84bab7a0c8c327e587c3b0cce97931a2
SHA1

a88fd0e65b41fda348a738deb945bf1e485d5bc6
SHA256

9de450156989a4d8e09e394e7e271f20a2a57322f0dcf8d6894b8c9e5d8c1054
SHA512

eda03d20dfe300af52e4caa96bfd56e2488b7616c307b17547752215338e8991ae767b904ba237d963aa6a1de90623220d474cd2ff24423612e3f9902e72abdc
SSDEEP

6144:QoC/bhUqNIC8yYK7DnIl+HU1fcfwZEh4nHEpYN:QoCjhUH8DnIoHpw5nHEpQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SearchFolder.dll

Files

SearchFolder.dll
.dll regsvr32 windows:10 windows x86 arch:x86

b15ce41e77cc7fd40f3b202a658b540d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SearchFolder.pdb

Imports

msvcrt

malloc
free
_amsg_exit
_XcptFilter
wcschr
_get_errno
_set_errno
_wtoi
_vsnwprintf
_lock
memmove
_except_handler4_common
memcpy
memcmp
_ftol2_sse
_unlock
memmove_s
wcsncmp
memcpy_s
_initterm
__CxxFrameHandler3
_onexit
__dllonexit
memset

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupA
SHStrDupW

api-ms-win-shcore-unicodeansi-l1-1-0

SHAnsiToUnicode
SHUnicodeToAnsi

api-ms-win-shcore-comhelpers-l1-1-0

IUnknown_QueryService
IUnknown_Set
IUnknown_SetSite

api-ms-win-shcore-registry-l1-1-1

SHRegGetValueFromHKCUHKLM

api-ms-win-shcore-stream-l1-1-0

IStream_Reset
IStream_Size
SHCreateMemStream
IStream_Write
SHCreateStreamOnFileEx
IStream_Read

api-ms-win-shcore-registry-l1-1-0

SHQueryValueExW
SHRegGetValueW

shcore

ord141
ord200
ord143
ord193
ord130
ord123
ord190
ord142
ord150

shell32

SHCreateShellItemArrayFromIDLists
ord895
ord824
ord51
SHEvaluateSystemCommandTemplate
SHGetNameFromIDList
SHGetKnownFolderIDList
SHGetKnownFolderItem
ord21
SHCreateItemFromParsingName
ord880
SHCreateItemWithParent
ord152
SHBindToParent
ord256
SHCreateDefaultContextMenu
AssocCreateForClasses
ord702
ord898
SHChangeNotify
SHBindToFolderIDListParent
ord171
ord75
ord241
Shell_GetCachedImageIndexW
SHGetKnownFolderPath
SHGetSpecialFolderLocation
ord866
ord6
SHParseDisplayName
SHCreateShellItemArrayFromShellItem
ord16
ord155
ord18
ord19
ord25
ord100
SHGetIDListFromObject
SHCreateItemInKnownFolder
SHCreateItemFromIDList
ord102
SHBindToObject
ord850
ord823
ord17
SHBindToFolderIDListParentEx

shlwapi

StrCmpNIW
ord24
StrDupW
ord152
ord172
UrlCompareW
UrlIsW
StrStrA
UrlEscapeW
PathCreateFromUrlW
PathIsRootW
PathRemoveBackslashW
PathRemoveFileSpecW
StrRChrW
PathMatchSpecW
ord331
ord29
PathFileExistsW
StrCmpW
StrStrNIW
StrToIntA
ord456
ord15
UrlHashW
PathParseIconLocationW
ord156
PathFindExtensionW
ord219
ord158
ord157
PathIsUNCW
StrStrIW
ord2
PathSkipRootW
PathIsURLW
PathFindNextComponentW
PathCompactPathExW
PathRemoveExtensionW
PathFindFileNameW
ord388
ord164
UrlGetPartW
ord236
StrPBrkW
ord154
PathMatchSpecExW
PathGetArgsW
PathRemoveArgsW
PathQuoteSpacesW
StrCmpIW
PathRemoveBlanksW

api-ms-win-core-libraryloader-l1-2-0

SizeofResource
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
LoadLibraryExW
GetModuleFileNameA
LoadStringA
LockResource
LoadStringW
LoadResource
FindResourceExW
GetModuleFileNameW
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
ReleaseSemaphore
EnterCriticalSection
WaitForSingleObject
ReleaseSRWLockShared
AcquireSRWLockShared
AcquireSRWLockExclusive
DeleteCriticalSection
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObjectEx
CreateMutexW
OpenSemaphoreW
CreateMutexExW
InitializeCriticalSectionEx
LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoGetMalloc
CoGetApartmentType
CoTaskMemRealloc
PropVariantCopy
StringFromGUID2
CoCreateInstance
CoTaskMemFree
PropVariantClear
CreateStreamOnHGlobal
GetHGlobalFromStream

api-ms-win-core-processthreads-l1-1-0

TlsAlloc
GetCurrentProcessId
TlsGetValue
TlsFree
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
TlsSetValue

api-ms-win-core-localization-l1-2-0

ResolveLocaleName
GetSystemPreferredUILanguages
IsDBCSLeadByteEx
LCMapStringEx
FindNLSStringEx
FindNLSString
IsDBCSLeadByte
FormatMessageW
LocaleNameToLCID
GetSystemDefaultLCID
LCMapStringW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW
CompareStringOrdinal

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
SleepConditionVariableSRW
InitOnceExecuteOnce
InitOnceBeginInitialize
WakeAllConditionVariable

api-ms-win-core-heap-l2-1-0

LocalFree
LocalReAlloc
LocalAlloc

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegGetValueW
RegQueryInfoKeyW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetLocalTime
GetSystemTime
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

ntdll

EtwEventWrite
EtwEventActivityIdControl
EtwEventSetInformation
EtwEventRegister
EtwEventUnregister
EtwEventWriteTransfer
EtwEventEnabled

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

RegisterClipboardFormatW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize
GlobalLock
GlobalUnlock

api-ms-win-rtcore-ntuser-window-l1-1-0

GetWindowRect
GetCursorPos
SendMessageW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA
lstrlenW
lstrcmpiW
lstrcmpiA
lstrcmpW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-path-l1-1-0

PathCchCombine
PathCchAppend
PathCchRemoveFileSpec

api-ms-win-winrt-search-folder-l1-1-0

SEARCH_WriteAutoListContents
GetGatherAdmin
IsMSSearchEnabled
SHCreateAutoListWithID
SHCreateScopeItemFromShellItem
SHCreateScope
SHCreateScopeItemFromKnownFolder
CreateResultSetFactory
CreateSingleVisibleInList
SHCreateScopeItemFromIDList
SHCreateTransientVFolderIDList
SHCreateScopeFromIDListsEx
SHCreateScopeFromShellItemArray
SHCreateSearchIDListFromAutoList
SEARCH_RemoteLocationsCscStateCache_IsRemoteLocationInCsc
CreateDefaultProviderResolver
GetScopeFolderType
SHCreateAutoList

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-com-private-l1-1-0

CoRevokeInitializeSpy
CoRegisterInitializeSpy

api-ms-win-core-string-l2-1-0

CharLowerW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
CreateActCtxW
ReleaseActCtx
ActivateActCtx

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-localization-ansi-l1-1-0

GetStringTypeExA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AppendHiddenSearchContext
CDBFolderUI_CreateInstance
CSearchDelegateFolderUI_CreateInstance
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetAggregateQueryError
s_GetStartMenuFilesScope

Sections

.text
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b15ce41e77cc7fd40f3b202a658b540d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-shcore-unicodeansi-l1-1-0

api-ms-win-shcore-comhelpers-l1-1-0

api-ms-win-shcore-registry-l1-1-1

api-ms-win-shcore-stream-l1-1-0

api-ms-win-shcore-registry-l1-1-0

shcore

shell32

shlwapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-2-0

ntdll

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-path-l1-1-0

api-ms-win-winrt-search-folder-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-localization-ansi-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 284KB - Virtual size: 284KB

.data Size: 1024B - Virtual size: 3KB

.idata Size: 10KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 420B

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 284KB - Virtual size: 284KB

.data
Size: 1024B - Virtual size: 3KB

.idata
Size: 10KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 420B

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 16KB - Virtual size: 16KB