LocationFrameworkInternalPS[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

LocationFrameworkInternalPS.dll
Size

47KB
MD5

eb5793664155910a3c6ad5f10f7cd0ae
SHA1

85798cb1a9eaf7d5f6e646d4ae75ea71e2d2ccf0
SHA256

535fcc1649e0a4c1e8628a074bf5a8067b2e0a80fffd40fc56a4178aaa657444
SHA512

8de0ae174de7f84d977185dbb1c1e42cdd319b715e3e481e554c3493b8925820f99401bd7ec56726be07c892c4421f55b44b47215df9a96c7a99259a4fdf20d1
SSDEEP

384:IgAbGUMyhi6ZiIc/L7m73vdkhyXknnjPuu/wYHkAGc/WpUWQtEA7p2IItVw:IgABh1ZiIAo3vdNu/wYEhceGgnrw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LocationFrameworkInternalPS.dll

Files

LocationFrameworkInternalPS.dll
.dll regsvr32 windows:10 windows x86 arch:x86

2b21e2dd5e3d5c61058a647e13097176

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

LocationFrameworkInternalPS.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcmp
_except_handler4_common
_o___std_type_info_destroy_list

api-ms-win-crt-string-l1-1-0

memset

oleaut32

BSTR_UserFree
BSTR_UserSize
BSTR_UserUnmarshal
BSTR_UserMarshal

rpcrt4

CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrStubCall2
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
CStdStubBuffer_Connect
NdrCStdStubBuffer2_Release
NdrOleFree

api-ms-win-core-com-midlproxystub-l1-1-0

NdrProxyForwardingFunction13
NdrProxyForwardingFunction19
NdrProxyForwardingFunction16
NdrProxyForwardingFunction20
NdrProxyForwardingFunction15
NdrProxyForwardingFunction14
NdrProxyForwardingFunction17
NdrProxyForwardingFunction22
NdrProxyForwardingFunction23
NdrProxyForwardingFunction24
ObjectStublessClient25
ObjectStublessClient4
ObjectStublessClient24
NdrProxyForwardingFunction8
CStdStubBuffer2_Connect
CStdStubBuffer2_CountRefs
NdrProxyForwardingFunction7
ObjectStublessClient11
NdrProxyForwardingFunction3
ObjectStublessClient21
ObjectStublessClient20
ObjectStublessClient29
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient28
ObjectStublessClient18
ObjectStublessClient27
NdrProxyForwardingFunction9
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient26
ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient9
NdrProxyForwardingFunction10
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction21
NdrProxyForwardingFunction4
ObjectStublessClient3
ObjectStublessClient22
ObjectStublessClient19
CStdStubBuffer2_QueryInterface
NdrProxyForwardingFunction18
ObjectStublessClient5
ObjectStublessClient13
NdrProxyForwardingFunction11
ObjectStublessClient7
CStdStubBuffer2_Disconnect
NdrProxyForwardingFunction6
ObjectStublessClient23
NdrProxyForwardingFunction12

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b21e2dd5e3d5c61058a647e13097176

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

oleaut32

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

Exports

Exports

Sections

.text Size: 35KB - Virtual size: 34KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 35KB - Virtual size: 34KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB