Unistore[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Unistore.dll
Size

912KB
MD5

0c63b1a1734f9f818e073bd63155487f
SHA1

8d83663fd4ef215394e2dce43af26a2066cfae62
SHA256

2086b269ff6b1bc51b1b56ccc8e1ec8dddd04caf37c256765abf30cb1684112e
SHA512

1178b1c330108006eb9716ad9a70e929563fbb0b4d2b1a9043170a7ceb1537323f292084f5b511cded0044b6cfe6665e9100b0fd35f4cab078af09d6f7293359
SSDEEP

24576:eUYX3NgmFx5oOJ+HituThaQJXOEZrcWH4mJ98s3:eU43Gox5otitMwQJwWH4S93

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Unistore.dll

Files

Unistore.dll
.dll windows:10 windows x86 arch:x86

1ed3209ac8f09121f414667aa9a8d116

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

unistore.pdb

Imports

msvcrt

__CxxFrameHandler3
_onexit
__dllonexit
_unlock
strcpy_s
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_vsnprintf
strtoul
_wcsnicmp
wcstol
wcscspn
wcsrchr
_wcsicmp
memmove
memcmp
memcpy
wcsncmp
memcpy_s
_purecall
_vsnwprintf
strrchr
_lock
memset

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
AcquireSRWLockShared
CreateEventW
CreateSemaphoreExW
ReleaseSemaphore
SetEvent
ReleaseSRWLockExclusive
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
OpenEventW
InitializeCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeSRWLock

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError
GetLastError

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWrite
EventWriteTransfer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalReAlloc
LocalAlloc

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetProcAddress
GetModuleHandleW
LoadStringW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW
RegFlushKey
RegSetValueExW
RegOpenKeyExW
RegGetValueW
RegDeleteValueW

api-ms-win-core-path-l1-1-0

PathCchCombine
PathAllocCombine

api-ms-win-core-file-l1-1-0

FindClose
SetEndOfFile
SetFilePointer
WriteFile
FindFirstFileW
GetFileAttributesW
FindNextFileW
SetFileAttributesW
CompareFileTime
RemoveDirectoryW
CreateDirectoryW
FindFirstFileExW
GetTempFileNameW
CreateFileW
DeleteFileW
ReadFile
GetFileSize
GetFullPathNameW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx
MoveFileExW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
TlsGetValue
GetCurrentProcess
OpenThreadToken
GetProcessId
TlsFree
GetCurrentThread
GetCurrentThreadId
TerminateProcess
TlsAlloc
TlsSetValue
SetThreadToken
GetThreadPriority
SetThreadPriority

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-localization-l1-2-0

GetSystemDefaultLCID
FormatMessageW

api-ms-win-security-base-l1-1-0

GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceComplete
SleepConditionVariableCS
InitializeConditionVariable
InitOnceBeginInitialize
Sleep

esent

JetConvertDDLA
JetSetCurrentIndexA
JetIdle
JetGetResourceParam
JetGetSessionParameter
JetEscrowUpdate
JetMove
JetBeginTransaction
JetSetColumns
JetGetTableIndexInfoA
JetRetrieveColumns
JetBeginSessionA
JetRetrieveColumn
JetEndSession
JetGetBookmark
JetMakeKey
JetCreateDatabaseW
JetDelete
JetResetSessionContext
JetCloseDatabase
JetCreateTableColumnIndex3A
JetGetTableColumnInfoA
JetBackupInstanceW
JetCloseTable
JetDeleteIndexA
JetTerm2
JetInit2
JetSetSessionContext
JetAttachDatabaseW
JetIndexRecordCount
JetDetachDatabaseA
JetCreateIndex3A
JetOpenTableW
JetCommitTransaction
JetAddColumnA
JetRetrieveKey
JetGotoBookmark
JetEnumerateColumns
JetGetSecondaryIndexBookmark
JetResizeDatabase
JetStopServiceInstance
JetOpenDatabaseW
JetUpdate
JetPrepareUpdate
JetBeginTransaction2
JetCommitTransaction2
JetRollback
JetSetSystemParameterW
JetSetSystemParameterA
JetSetCurrentIndex2A
JetCreateInstance2W
JetSetIndexRange
JetGetErrorInfoW
JetSeek
JetGotoSecondaryIndexBookmark

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpool
CreateThreadpoolTimer
CreateThreadpoolWork
WaitForThreadpoolTimerCallbacks
SetThreadpoolThreadMaximum
FreeLibraryWhenCallbackReturns
CloseThreadpoolTimer
IsThreadpoolTimerSet
CreateThreadpoolWait
CloseThreadpoolWait
SetThreadpoolTimer
CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
WaitForThreadpoolWaitCallbacks
CloseThreadpool
SetThreadpoolWait

ntdll

RtlIsCriticalSectionLockedByThread
RtlNtStatusToDosError
RtlGetThreadWorkOnBehalfTicket

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
GetTimeZoneInformation
FileTimeToSystemTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AddDWORDPropertyRestrictions
AppRevisionBlobToUSBlob
ClearUSCache
CreateStoreManager
CreateStoreManagerWithToken
DetectExistingCorruption
DisableLocalUnistore
EnableLocalUnistore
EndUnifiedStoreWorkForClient
FindMaxSeenRevisionForAppInBlob
GetCurrentProcessRundownProtectionIdentifier
GetDeviceStoreDefaultName
GetRealStoreManager
GetUSDataFolderPath
GetUSDeviceStoreCorruptedVolumeFolderPath
GetUSDeviceStoreFolderPath
GetUSDeviceStoreVolumePath
GetUSFileStreamPath
GetUnistoreJetInstance
IsCEPropValPresent
IsUSPropValPresent
IsUnistoreInProc
IsUnistoreLocal
LowerRPCPriority
RegisterRundownProtectionForProcess
ReleaseUnistoreJetInstance
RemoveStaleChangeTrackingDataOnStore
ServiceMain
SetMaxRevisionBlobSize
SetUnistoreProcessEventFilter
SetUnistoreVersion
StartUnifiedStoreWorkForClient
SvchostPushServiceGlobals
USBlobToAppRevisionBlob
USComparePropVals
USCopyPropVals
USDeleteFileEx
USEventMaskToObjectType
USGetPropValsAncillaryBufferSize
USIsObjectHidden
USIsSameObject
USObjectTypeToEventMask

Sections

.text
Size: 847KB - Virtual size: 846KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ed3209ac8f09121f414667aa9a8d116

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-synch-l1-2-0

esent

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-2-0

ntdll

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 847KB - Virtual size: 846KB

.data Size: 4KB - Virtual size: 10KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 364B

.rsrc Size: 17KB - Virtual size: 16KB

.reloc Size: 34KB - Virtual size: 33KB

.text
Size: 847KB - Virtual size: 846KB

.data
Size: 4KB - Virtual size: 10KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 364B

.rsrc
Size: 17KB - Virtual size: 16KB

.reloc
Size: 34KB - Virtual size: 33KB