MicrosoftAccountTokenProvider.pdb
Static task
static1
Behavioral task
behavioral1
Sample
MicrosoftAccountTokenProvider.dll
Resource
win10v2004-20240508-en
General
-
Target
MicrosoftAccountTokenProvider.dll
-
Size
190KB
-
MD5
bfd1a7cbf66b9be7099a3b31cfea2ea3
-
SHA1
8fa15cbdada0f42240bd4048007eb716579af3c3
-
SHA256
8b2f41027293f17ae2adad72cec65a171d489196fc55923b9397b6315b5b2649
-
SHA512
d3a3b3bb07d794d2722109a351565a6d2688503bfe9140c16803c5eb431ce482be0c98f1ce0f431028129b48de26e0294a216584df5517791bfae5805171d6fb
-
SSDEEP
3072:04/q+FOazoJE9pBAVrio/QUc4tsGcUx1DJQZn9ugFnQLUjoKFq/12aHK:vS+JEAPSQerJJQZ9ugFQLUcKm5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MicrosoftAccountTokenProvider.dll
Files
-
MicrosoftAccountTokenProvider.dll.dll regsvr32 windows:10 windows x86 arch:x86
5829fe9953f7c4e4a21f31d27d0d6776
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
memmove
_o__wcsicmp
_o__wtof
_o__wtoi
_o_calloc
_o_free
_o_isalpha
_o_isdigit
_o_iswspace
_o_isxdigit
_o_malloc
_o_memcpy_s
_o_strtol
_o_tolower
_o_wcsncpy_s
_o_wcstol
_except_handler4_common
_CxxThrowException
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
strrchr
wcsstr
wcschr
_o__crt_atexit
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler3
memcpy
api-ms-win-crt-string-l1-1-0
wcsnlen
memset
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventW
CreateSemaphoreExW
LeaveCriticalSection
CreateMutexExW
OpenSemaphoreW
CreateEventExW
WaitForMultipleObjectsEx
WaitForSingleObject
EnterCriticalSection
ReleaseSRWLockExclusive
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseMutex
ReleaseSemaphore
DeleteCriticalSection
ResetEvent
api-ms-win-core-localization-l1-2-0
GetThreadPreferredUILanguages
GetUserDefaultLocaleName
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
OpenThread
TerminateProcess
GetCurrentProcess
GetCurrentThread
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
GetProcessIdOfThread
api-ms-win-core-heap-l1-1-0
HeapFree
HeapReAlloc
HeapDestroy
HeapSize
HeapAlloc
GetProcessHeap
api-ms-win-core-libraryloader-l1-2-0
FindResourceExW
LockResource
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleFileNameW
SizeofResource
LoadResource
GetModuleHandleExW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FreeLibrary
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer
api-ms-win-core-com-l1-1-0
CoGetCallerTID
CoTaskMemFree
CoGetCallContext
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetVersionExW
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegSetKeySecurity
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegOpenCurrentUser
RegEnumValueW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW
RegDeleteKeyExW
RegGetValueW
RegDeleteTreeW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
api-ms-win-core-localization-obsolete-l1-2-0
GetUserDefaultUILanguage
ntdll
RtlGetDeviceFamilyInfoEnum
api-ms-win-security-base-l1-1-0
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
ImpersonateLoggedOnUser
RevertToSelf
IsValidSid
CreateWellKnownSid
CopySid
GetLengthSid
DuplicateTokenEx
GetTokenInformation
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
rpcrt4
NdrMesTypeFree2
MesHandleFree
MesDecodeBufferHandleCreate
UuidCreate
RpcBindingFree
RpcStringFreeW
NdrMesTypeAlignSize2
RpcStringBindingComposeW
RpcBindingFromStringBindingW
I_RpcBindingInqLocalClientPID
NdrMesTypeEncode2
RpcAsyncCancelCall
RpcAsyncCompleteCall
NdrAsyncClientCall2
RpcBindingSetAuthInfoExW
MesEncodeFixedBufferHandleCreate
RpcSsDestroyClientContext
RpcAsyncInitializeHandle
NdrMesTypeDecode2
MesBufferHandleReset
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenSCManagerW
OpenServiceW
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoInitialize
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-ntuser-sysparams-l1-1-0
GetSystemMetrics
api-ms-win-core-kernel32-legacy-l1-1-0
GetComputerNameW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ