ConfigureExpandedStorage[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

ConfigureExpandedStorage.dll
Size

51KB
MD5

9a037e13deddc5c1b792dc4f9b1658fc
SHA1

9f97827a4e36c557599007e84290c85cada8f058
SHA256

c541ce069f91b2ca5ee8ccd7fc3b724ff79613067feee08902b43775883f2bdf
SHA512

95b5173c9f9a7442cab9663f0d0b8d6d754eddf581f56850b573724f858e9bb8326b56c15c3efabc47a66f7aaa34dce2603737f49bb9cb1dd15001079ee46dd4
SSDEEP

768:NKsR065PczxpKAMGR54/56kuRUjmkl2VIBneViqKqCQEzsYL+/n0p:csRlMKAT4/kkuRUjmk8+peVilHf0Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ConfigureExpandedStorage.dll

Files

ConfigureExpandedStorage.dll
.dll windows:6 windows x86 arch:x86

66602e0b9b64b38d3e53b80e9aefedf8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ConfigureExpandedStorage.pdb

Imports

msvcrt

memset
_vsnwprintf
_purecall
??3@YAXPAX@Z
_set_errno
_get_errno
_XcptFilter
_amsg_exit
free
malloc
_initterm
_lock
_unlock
__dllonexit
_onexit
??2@YAPAXI@Z
__CxxFrameHandler3
_except_handler4_common

kernel32

CloseThreadpoolTimer
TlsGetValue
FreeLibrary
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateDirectoryW
GetModuleHandleExW
WaitForSingleObject
SetEvent
ReleaseSRWLockExclusive
GetTickCount
AcquireSRWLockExclusive
TlsSetValue
OpenProcess
Sleep
InitOnceExecuteOnce
ReleaseSemaphore
RaiseException
FreeLibraryAndExitThread
GetLastError
CreateSemaphoreW
FreeLibraryWhenCallbackReturns
CreateEventExW
CreateThreadpoolTimer
CallbackMayRunLong
GetCurrentThreadId
OpenSemaphoreW
TlsAlloc
TrySubmitThreadpoolCallback
CloseHandle
GetCurrentProcessId
TlsFree
CreateThread
EncodePointer
GetProcessHeap
ReleaseSRWLockShared
DecodePointer
AcquireSRWLockShared
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

ole32

CoUninitialize
CoTaskMemRealloc
CreateStreamOnHGlobal
CoReleaseMarshalData
RoGetAgileReference
CoWaitForMultipleHandles
CoCopyProxy
CoGetMalloc
CoGetApartmentType
CoTaskMemAlloc
CoInitializeEx
CoMarshalInterface
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoCreateFreeThreadedMarshaler

shell32

SHGetKnownFolderItem
ord850
SHCreateItemFromParsingName

secur32

GetUserNameExW

api-ms-win-core-path-l1-1-0

PathAllocCombine

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError
RoTransformError
IsErrorPropagationEnabled
RoOriginateErrorW
SetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
GetRestrictedErrorInfo

api-ms-win-core-processthreads-l1-1-2

OpenProcessToken

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsCreateString
WindowsCreateStringReference
WindowsStringHasEmbeddedNull

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-heap-l1-2-0

HeapFree

shlwapi

SHGetThreadRef
PathFileExistsW
SHSetThreadRef
SHCreateThreadRef

user32

TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
PostThreadMessageW
DispatchMessageW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66602e0b9b64b38d3e53b80e9aefedf8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

ole32

shell32

secur32

api-ms-win-core-path-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-heap-l1-2-0

shlwapi

user32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 40KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 40KB - Virtual size: 40KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB