SyncCenter[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SyncCenter.dll
Size

379KB
MD5

ca62a1149dc2c5e90f74798b6cd2f279
SHA1

e36d83b731ac9532f74307737a556c6ffd903629
SHA256

c979b2df05b7e5a77a8a63a317f27fb6696fca31787e7c38e50011ec5dfb1493
SHA512

0c8d6e371bc0b8a3f7179b3e6c5e993f6b3a4c2e960d49174e9388948d22460839f42fbc4952834845f646063b8a8604728e0513cac0ed131b6c158eb43e8b21
SSDEEP

6144:AIDkG7hFDy0kwz72GlDe00D8jcIwE1y3S2BlDtuS7ZRWVENpZ3qOLGaJ0LceJZu7:APGPO+Kky3K8RWVENp9ea7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SyncCenter.dll

Files

SyncCenter.dll
.dll windows:10 windows x86 arch:x86

e5578fe86f2f73d9e158d47fa1540154

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SyncCenter.pdb

Imports

msvcrt

memcmp
memcpy
_vsnwprintf
wcstol
wcschr
??1type_info@@UAE@XZ
memmove
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
memcpy_s
__CxxFrameHandler3
wcstoul
memset

shell32

ord21
ord153
SHChangeNotify
ord155
SHGetKnownFolderIDList
ShellExecuteExW
ord704
Shell_NotifyIconW
SHGetDesktopFolder
ord747
ord25
ord19
ord147
SHBindToFolderIDListParentEx
SHBindToParent
SHParseDisplayName
ord256
SHCreateDefaultContextMenu
ord83
ord264
AssocGetDetailsOfPropKey
ord702
SHBindToObject
SHGetFileInfoW
ord152
ord18
SHCreateItemFromIDList
Shell_GetCachedImageIndexW
SHGetIDListFromObject
SHCreateItemWithParent
ord6
SHCreateDefaultExtractIcon
ord716
AssocCreateForClasses
ord744
ord24
ord866
SHCreateShellItemArrayFromDataObject

shlwapi

ord219
ord615
ord16
ord437
ord24
ord278
StrChrW
SHDeleteKeyW
SHSetValueW
SHRegGetValueW
ord217
ord215
StrCmpW
AssocCreate
ord388
ord611
ord158
ord199
ord619
ord476
StrRetToBufW
SHStrDupW
ord157
ord10
ord9
ord8
ord7
StrCmpNW
ord213
ord12
StrToIntExW
StrStrW
StrTrimW
ord172
ord354
ord176
PathAddBackslashW
ord174
ord363
ord256
ord344
StrPBrkW

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
GetModuleFileNameW
GetModuleHandleExW
DisableThreadLibraryCalls
LoadStringA
SizeofResource
LockResource
LoadResource
LoadStringW
GetModuleHandleW
LoadLibraryExW
GetModuleFileNameA
GetProcAddress

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
ReleaseMutex
CreateMutexExW
EnterCriticalSection
WaitForSingleObject
LeaveCriticalSection
ReleaseSemaphore
AcquireSRWLockExclusive
ResetEvent
SetWaitableTimer
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForSingleObjectEx
CreateWaitableTimerExW
SetEvent
InitializeCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
CreateSemaphoreExW
CreateMutexW
OpenMutexW
CreateEventW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
OpenThreadToken
GetCurrentProcess
OpenThread
GetCurrentProcessId
OpenProcessToken
GetCurrentThreadId
TerminateProcess
CreateThread

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
CLSIDFromString
CoGetMalloc
CoRevokeClassObject
StringFromGUID2
PropVariantCopy
CoResumeClassObjects
CoRegisterClassObject
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoCreateGuid
CoAddRefServerProcess
CoReleaseServerProcess
CoTaskMemAlloc
PropVariantClear

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW
WaitForMultipleObjects

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegNotifyChangeKeyValue
RegSetValueExW
RegDeleteValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalReAlloc
GlobalFree
GlobalAlloc
LocalAlloc

api-ms-win-core-file-l1-1-0

LocalFileTimeToFileTime
CompareFileTime

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformationForYear
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte
CompareStringW

api-ms-win-core-path-l1-1-0

PathCchAddBackslash

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock
GlobalSize

api-ms-win-core-sidebyside-l1-1-0

ActivateActCtx
CreateActCtxW
DeactivateActCtx
ReleaseActCtx

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW
lstrlenW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

ntdll

EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwEventWriteTransfer
EtwEventUnregister
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW

kernel32

SetWaitableTimerEx
WaitForMultipleObjectsEx

ole32

ReleaseStgMedium
CreateBindCtx
CoAllowSetForegroundWindow

user32

DialogBoxParamW
DestroyIcon
UnregisterClassW
PostThreadMessageW
CopyIcon
PostMessageW
GetSystemMetrics
IsWindow
DestroyWindow
DefWindowProcW
RegisterClassExW
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
GetWindowLongW
SetWindowLongW
KillTimer
PostQuitMessage
GetCursorPos
LoadMenuW
GetSubMenu
SetForegroundWindow
TrackPopupMenu
GetMenuItemCount
EnableMenuItem
SetMenuItemInfoW
GetMenuItemInfoW
SendDlgItemMessageW
FindWindowW
DestroyMenu
SetTimer
GetWindowThreadProcessId
SendMessageW
FindWindowExW
SwitchToThisWindow
GetLastActivePopup
GetParent
GetDlgItem
SetDlgItemTextW
EnableWindow
ShowWindow
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
GetClassNameW
GetWindow
GetClientRect
EndDialog
RegisterClipboardFormatW
DeleteMenu
SetMenuDefaultItem
GetWindowRect
RegisterClassW
LoadCursorW

gdi32

CreateFontIndirectW
GetObjectW
DeleteObject
GetStockObject

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5578fe86f2f73d9e158d47fa1540154

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shell32

shlwapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

ntdll

kernel32

ole32

user32

gdi32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-registry-l1-1-1

Exports

Exports

Sections

.text Size: 333KB - Virtual size: 333KB

.data Size: 6KB - Virtual size: 8KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 168B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 333KB - Virtual size: 333KB

.data
Size: 6KB - Virtual size: 8KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 168B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 25KB - Virtual size: 24KB