ChatApis[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

ChatApis.dll
Size

588KB
MD5

a9390156d37a76bf1671e38ef4525461
SHA1

6842355fa9c4547e7103aef5373a3efb1efc6463
SHA256

7ffd1646cec3b48a55a8d7a07b54a937342cc2b86d3d3b9f66eed125f35f3e47
SHA512

f5fc58044525bc256104d74b740f585dea54ebca2156e5190e0f2cd5c31a8ab3e9f477de945af1499d01d24ed7579f34a69051859588d4e765c55176ab88a230
SSDEEP

12288:Dg4vN6uoWhFHZ741AGLD3veZOz82cCx36tFBb0:Dg4vkuoWhP741AGLLveZOzpcqqtFBb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ChatApis.dll

Files

ChatApis.dll
.dll windows:10 windows x86 arch:x86

1229dea0b13ef129d32aab9f49f798d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ChatApis.pdb

Imports

msvcrt

memcpy
memmove
__CxxFrameHandler3
_onexit
memcmp
memcpy_s
__dllonexit
_unlock
_lock
_errno
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
_vsnwprintf
tolower
_wtol
wcstok_s
_vscwprintf
_vsnwprintf_s
wcstoul
_wtoi
realloc
memmove_s
_purecall
wcsncpy_s
malloc
free
_ftol2
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
FindResourceExW
LoadResource
SizeofResource
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleW
FreeLibrary
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete
Sleep

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
SetEvent
LeaveCriticalSection
AcquireSRWLockExclusive
WaitForSingleObject
DeleteCriticalSection
AcquireSRWLockShared
InitializeCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
ReleaseSRWLockShared
CreateEventW
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
InitializeSRWLock
CreateEventExW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventActivityIdControl
EventUnregister
EventWriteTransfer
EventRegister

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
WaitForThreadpoolWaitCallbacks
FreeLibraryWhenCallbackReturns
CloseThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWork
SetThreadpoolWait
SubmitThreadpoolWork

api-ms-win-core-processthreads-l1-1-0

SetThreadToken
GetCurrentProcessId
OpenProcessToken
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentThread
OpenThreadToken

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA
DebugBreak

api-ms-win-core-localization-l1-2-0

FormatMessageW

ntdll

RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
OpenServiceW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

RunServicesInProc
GenerateUserModeServiceName
IsCommsSystemService
StartAndWaitForServiceForUser
GetUserTokenFromContext
GetUserContextFromHandle

systemeventsbrokerclient

SebCreateChatNotificationEvent
SebCreateMessageInterceptNotificationEvent
SebCreateRcsEndUserMessageNotificationEvent
SebDeleteEvent

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 527KB - Virtual size: 527KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1229dea0b13ef129d32aab9f49f798d9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

ntdll

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-profile-l1-1-0

userdataplatformhelperutil

systemeventsbrokerclient

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 527KB - Virtual size: 527KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 260B

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 40KB - Virtual size: 39KB

.text
Size: 527KB - Virtual size: 527KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 260B

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 40KB - Virtual size: 39KB