AppxApplicabilityEngine[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

AppxApplicabilityEngine.dll
Size

196KB
MD5

c389ebe29edfe7848c9a6117e0f5a650
SHA1

ec3f825bbdf935da69f16295bc7dd152de8fd4de
SHA256

36c6bb9595b98e3418b557c2f583d84e42b082bf3db19a842d220711c9b1dd2e
SHA512

3b8b77db8c05945296feb6371c6186bb8787ae38b0a57df1b33b3f2d27d6fda7c27655fe06f99ddf7a5851660acc10bd984a142d2612a54841716d48bb7b7d26
SSDEEP

6144:aX45NbAr6/CLeVaKQRkfF9Dt/w/THQW1PF1sqW++6aWWGfs3j:aX45N86tVaKQRkfjDt/w/0WlF6xVWfw

Score

1^/10

Malware Config

Signatures

Files

AppxApplicabilityEngine.dll
.dll windows:10 windows x86 arch:x86

12edc07e8b07131a5c7bb11511d3c895

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-12-2020 21:29

Not After

02-12-2021 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:14:da:6c:21:31:3f:5f:48:38:e8:10:9a:30:22:d0:e2:bd:16:ee:96:43:2c:05:aa:80:81:79:60:16:b2:e5
Signer

Actual PE Digest

35:14:da:6c:21:31:3f:5f:48:38:e8:10:9a:30:22:d0:e2:bd:16:ee:96:43:2c:05:aa:80:81:79:60:16:b2:e5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppxApplicabilityEngine.pdb

Imports

msvcrt

_lock
_initterm
_amsg_exit
_unlock
abort
_onexit
_XcptFilter
calloc
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler4_common
__pctype_func
_ftol2_sse
___lc_codepage_func
___mb_cur_max_func
_wtoi
wcscpy_s
??_V@YAXPAX@Z
towlower
swscanf_s
??8type_info@@QBEHABV0@@Z
__CxxFrameHandler3
memmove
__dllonexit
__crtCompareStringW
__crtLCMapStringW
___lc_collate_cp_func
___lc_handle_func
memcpy
setlocale
memchr
tolower
isspace
_errno
_CxxThrowException
_callnewh
malloc
_purecall
realloc
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
free
strchr
wctob
_swprintf_c_l
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
bsearch
memset

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleExW
FreeLibrary
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
LoadLibraryExW
LoadLibraryExA

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
CreateSemaphoreExW
ReleaseSemaphore
DeleteCriticalSection
CreateMutexExW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OpenSemaphoreW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
OpenThreadToken

api-ms-win-core-localization-l1-2-0

GetUserPreferredUILanguages
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegEnumValueW
RegCloseKey
RegGetValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteTreeW
RegSetValueExW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc

api-ms-win-security-base-l1-1-0

GetLengthSid
IsWellKnownSid
GetTokenInformation
IsValidSid
CopySid
EqualSid

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
GetStringTypeW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-localization-obsolete-l1-2-0

EnumUILanguagesW

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

Exports

Exports

AddDirectXFeatureLevelToContext
AddUserLanguagesToContext
CreateApplicabilityContext
CreateApplicabilityContextFromString
FreeApplicabilityContext
FreeApplicablePackages
GetApplicabilityContext
GetApplicablePackages
GetApplicablePackagesForUser
GetApplicablePackagesForUserWithAppChosenResources
GetApplicablePackagesWithAppChosenResources

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12edc07e8b07131a5c7bb11511d3c895

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

35:14:da:6c:21:31:3f:5f:48:38:e8:10:9a:30:22:d0:e2:bd:16:ee:96:43:2c:05:aa:80:81:79:60:16:b2:e5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-memory-l1-1-0

Exports

Exports

Sections

.text Size: 167KB - Virtual size: 166KB

.data Size: 4KB - Virtual size: 5KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 28B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 7KB - Virtual size: 6KB

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

35:14:da:6c:21:31:3f:5f:48:38:e8:10:9a:30:22:d0:e2:bd:16:ee:96:43:2c:05:aa:80:81:79:60:16:b2:e5
Signer

.text
Size: 167KB - Virtual size: 166KB

.data
Size: 4KB - Virtual size: 5KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 28B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 7KB - Virtual size: 6KB