SyncInfrastructure[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

SyncInfrastructure.dll
Size

346KB
MD5

5595e0442193754b37809346390fe9c8
SHA1

f655306afe98c26f23edcbf6a196fdffc93b0414
SHA256

cb4254da6bbf162af06baef0a61dcd795f1ec16f97563bf56c7ba28b374981d4
SHA512

334c879c631b2cbc2a8a7e5c6d3f8ca872418fe9fff592980d3d7dbc12dc5c2586738acb7205913b258227ea0aaa7d53521a44cb8b7448c3ecde168cb12b6484
SSDEEP

6144:j6F4dKKw3HJ0GDnhOZSVsvmPJw8K7xYR:eF4dK3+GDhOZFq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SyncInfrastructure.dll

Files

SyncInfrastructure.dll
.dll regsvr32 windows:10 windows x86 arch:x86

2d909a556b5eeb001295dc4e0bbe1096

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SyncInfrastructure.pdb

Imports

msvcrt

_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
memmove_s
_onexit
??1type_info@@UAE@XZ
_errno
realloc
__dllonexit
_ltow
_wtoi64
_wmakepath_s
wcsrchr
_wtol
_vsnprintf
_wsplitpath_s
swprintf_s
_except_handler4_common
calloc
free
memcpy
_unlock
?terminate@@YAXXZ
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
wcscat_s
wcscpy_s
memcpy_s
_vsnwprintf
memcmp
_ftol2
_CxxThrowException
__CxxFrameHandler3
_lock
memset

kernel32

LockResource
OpenEventW
CreateFileW
WriteFile
GetModuleFileNameA
SetThreadLocale
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
GetThreadLocale
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
DisableThreadLibraryCalls
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
RaiseException
HeapAlloc
GetProcAddress
CreateMutexExW
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
CopyFileW
DebugBreak
LoadLibraryExW
IsDebuggerPresent
CreateEventW
LoadResource
CreateThread
ResetEvent
InitOnceBeginInitialize
QueueUserWorkItem
ReleaseSRWLockExclusive
InitOnceComplete
AcquireSRWLockExclusive
GetSystemTimeAsFileTime
GetTickCount64
MultiByteToWideChar
WideCharToMultiByte
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetTickCount
OutputDebugStringA
VirtualFree
SizeofResource
ReadFile
GetCurrentThread
DeleteFileW
LocalFree
FindResourceExW
SetEvent
VirtualAlloc
LoadLibraryExA
EncodePointer
DecodePointer
IsProcessorFeaturePresent
FlushInstructionCache
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetFileAttributesW
InterlockedPushEntrySList
InterlockedPopEntrySList
GetModuleHandleW

user32

GetWindowLongW
CallWindowProcW
SetTimer
CharUpperBuffW
KillTimer
CharLowerBuffW
GetMessageW
PostMessageW
DispatchMessageW
UnregisterClassA
DefWindowProcW
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
PostThreadMessageW
TranslateMessage
LoadCursorW
SetWindowLongW
GetClassInfoExW
GetSystemMetrics

ole32

StringFromCLSID
PropVariantCopy
CoCreateGuid
StgOpenStorageEx
StgCreateStorageEx
CoTaskMemFree
CoTaskMemAlloc
GetRunningObjectTable
CreateItemMoniker
CoRevokeClassObject
CoResumeClassObjects
CoRegisterClassObject
CoInitializeEx
CoUninitialize
CoReleaseServerProcess
CoAddRefServerProcess
CoCreateInstance
StringFromGUID2
PropVariantClear
CLSIDFromString

oleaut32

SysStringByteLen
SysAllocStringByteLen
VarUI8FromStr
VarBstrCmp
SysStringLen
SysAllocString
SysFreeString
DispCallFunc
VariantClear
VariantInit
VarBstrCat
SysAllocStringLen

shlwapi

SHStrDupW
ord219
StrStrIW
StrCmpIW
PathCombineW
StrStrA
StrStrW
StrCmpNIW
PathAddBackslashW

advapi32

RegCloseKey
RegQueryInfoKeyW
EventRegister
TraceMessage
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
RegOpenKeyExW
OpenThreadToken
OpenProcessToken
GetTokenInformation
EventWrite
RegSetKeyValueW
RegEnumKeyExW
RegGetValueW
ConvertSidToStringSidW
EventSetInformation
EventActivityIdControl
EventWriteTransfer
EventUnregister

propsys

PSCreateMemoryPropertyStore
PropVariantToUInt32
PropVariantToUInt64
PropVariantToBSTR
PropVariantCompareEx
InitPropVariantFromFileTime
InitPropVariantFromCLSID
PropVariantToGUID

crypt32

CryptUnprotectData
CryptProtectData

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

shell32

SHParseDisplayName
SHGetKnownFolderPath
SHCreateDirectoryExW
SHCreateShellItem
SHBindToParent

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 304KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d909a556b5eeb001295dc4e0bbe1096

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

user32

ole32

oleaut32

shlwapi

advapi32

propsys

crypt32

wtsapi32

shell32

Exports

Exports

Sections

.text Size: 304KB - Virtual size: 304KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 28B

.rsrc Size: 10KB - Virtual size: 9KB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 304KB - Virtual size: 304KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 28B

.rsrc
Size: 10KB - Virtual size: 9KB

.reloc
Size: 22KB - Virtual size: 22KB