AppContracts[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AppContracts.dll
Size

776KB
MD5

11ac8ade5c6d81003d20899c7962ba22
SHA1

0f829f76df460da45e69a3be0015e02e449273a9
SHA256

4970c1f856de9ff4f4cf7cec6960021d5f9e51123c2f102f47102c35ebaabdc1
SHA512

a41fa31b8a620d1a61e5aaac98211598c7441c400b9fe32915e20c260fedcec8704dd96fcdac4889e29d1902e935bc0a4348a0cc0e08481e3b52ca0275fe272f
SSDEEP

24576:u3nfigaPMAWNJLZr1UoDY0NKBmKyr9Z9bC8W:UnfizuZr1UoDY0NKBmKyr9zbC8W

Score

1^/10

Malware Config

Signatures

Files

AppContracts.dll
.dll windows:10 windows x86 arch:x86

2dc5e98af1de0df31b3a14c10797cc4c

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:ed:1f:c7:f9:fb:34:2e:23:51:cf:22:92:35:d7:62:d9:07:f7:c6:ec:d9:80:0f:44:1a:ca:ba:3b:cd:2b:ef
Signer

Actual PE Digest

2c:ed:1f:c7:f9:fb:34:2e:23:51:cf:22:92:35:d7:62:d9:07:f7:c6:ec:d9:80:0f:44:1a:ca:ba:3b:cd:2b:ef

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppContracts.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__get_errno
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__cexit
memmove
_o__wcsicmp
_o_ceil
_o_free
_o_malloc
_o_mbstowcs
_o_realloc
_o_terminate
__current_exception
__current_exception_context
_except_handler4_common
_o__callnewh
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler3
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

ntdll

RtlQueryPackageClaims
RtlIsMultiUsersInSessionSku
RtlIsMultiSessionSku
RtlGetDeviceFamilyInfoEnum

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
LoadStringW
GetModuleFileNameA
GetModuleHandleExA
FreeLibrary
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

CreateMutexExW
OpenSemaphoreW
WaitForSingleObject
SetEvent
CreateEventExW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
CreateEventW
ResetEvent
InitializeCriticalSectionEx
AcquireSRWLockShared
WaitForMultipleObjectsEx
LeaveCriticalSection
InitializeSRWLock
EnterCriticalSection
DeleteCriticalSection
OpenEventW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsCreateStringReference
WindowsDuplicateString
WindowsPreallocateStringBuffer
WindowsGetStringRawBuffer
WindowsDeleteStringBuffer
WindowsPromoteStringBuffer
WindowsDeleteString

api-ms-win-core-com-l1-1-0

CoImpersonateClient
CoGetMalloc
CoRevertToSelf
StringFromCLSID
CoRevokeClassObject
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoReleaseMarshalData
CoTaskMemRealloc
CoCreateGuid
CoGetInterfaceAndReleaseStream
CoRegisterClassObject
CoCreateInstance
CoGetCallContext
CoMarshalInterface
CreateStreamOnHGlobal
CoTaskMemAlloc

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetProcessId
GetCurrentThreadId
GetCurrentProcessId
OpenThreadToken
GetCurrentThread
OpenProcessToken

rpcrt4

UuidCreate
RpcStringFreeW
RpcStringFreeA
UuidToStringW
I_RpcBindingInqLocalClientPID
UuidToStringA

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventActivityIdControl
EventRegister
EventWriteTransfer

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoGetActivationFactory
RoInitialize
RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError
GetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-appmodel-runtime-l1-1-1

GetPackageFamilyNameFromToken
GetPackageFullNameFromToken

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate

api-ms-win-core-file-l1-1-0

WriteFile
FlushFileBuffers
CreateFileW
ReadFile

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW
ConnectNamedPipe

api-ms-win-core-io-l1-1-0

CancelIoEx
GetOverlappedResult

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
SetThreadpoolWait
CancelThreadpoolIo
StartThreadpoolIo
WaitForThreadpoolWaitCallbacks
FreeLibraryWhenCallbackReturns
SetThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolIo
CreateThreadpoolIo

api-ms-win-security-base-l1-1-0

IsWellKnownSid
GetTokenInformation
DuplicateTokenEx

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFullName
PackageFamilyNameFromFullName
GetPackageFamilyName

api-ms-win-appmodel-runtime-internal-l1-1-2

GetEffectivePackageStatusForUser

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream

api-ms-win-shcore-stream-winrt-l1-1-0

CreateRandomAccessStreamOverStream

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

combase

ord167
ord184
ord168

msvcp_win

_Mtx_unlock
_Mtx_lock
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 701KB - Virtual size: 701KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2dc5e98af1de0df31b3a14c10797cc4c

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

2c:ed:1f:c7:f9:fb:34:2e:23:51:cf:22:92:35:d7:62:d9:07:f7:c6:ec:d9:80:0f:44:1a:ca:ba:3b:cd:2b:efSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

rpcrt4

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-appmodel-runtime-l1-1-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-appmodel-runtime-internal-l1-1-2

api-ms-win-core-winrt-propertysetprivate-l1-1-1

api-ms-win-shcore-stream-l1-1-0

api-ms-win-shcore-stream-winrt-l1-1-0

api-ms-win-security-capability-l1-1-0

api-ms-win-core-apiquery-l1-1-0

combase

msvcp_win

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 701KB - Virtual size: 701KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 9KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 76B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 46KB - Virtual size: 46KB

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

2c:ed:1f:c7:f9:fb:34:2e:23:51:cf:22:92:35:d7:62:d9:07:f7:c6:ec:d9:80:0f:44:1a:ca:ba:3b:cd:2b:ef
Signer

.text
Size: 701KB - Virtual size: 701KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 9KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 76B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 46KB - Virtual size: 46KB