PortableDeviceTypes[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

PortableDeviceTypes.dll
Size

142KB
MD5

feb91c32d92376ec2799ca27741ecb03
SHA1

bb0723817198ec9d9253240b03efad92ab6d2e0e
SHA256

1d8d0610ea13b7d137aa699cf9325d93cbd715a29846d6d46f0ed857d110df5d
SHA512

20d49054519b392af36469dddaef61bbc0caab2f19dc8c653cdd7e6f1b2836fbd2e0312af79a73d7e82989fc6f0b8ce1e3a3c56f35e168664972841efd64a078
SSDEEP

3072:b9IuJRdM4DHLJpg3m5RbKs3pE9m18Oi4uV46N5ya34z8e:xIurdM4DHtNcmupNpN9y8e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PortableDeviceTypes.dll

Files

PortableDeviceTypes.dll
.dll regsvr32 windows:10 windows x86 arch:x86

2992ffc54fda06f07dbacfe4187fd7cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PortableDeviceTypes.pdb

Imports

msvcrt

__dllonexit
_onexit
_unlock
_lock
memcpy
realloc
_errno
__CxxFrameHandler3
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
calloc
memmove_s
_purecall
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
??1type_info@@UAE@XZ
_CxxThrowException
memcmp
memset

oleaut32

LoadTypeLi
UnRegisterTypeLi
LPSAFEARRAY_UserMarshal
BSTR_UserSize
SysStringLen
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserSize
SysAllocString
SysFreeString
BSTR_UserMarshal
RegisterTypeLi
BSTR_UserUnmarshal
BSTR_UserFree
VarUI4FromStr

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
GetModuleHandleW

api-ms-win-core-com-l1-1-0

PropVariantCopy
CoTaskMemRealloc
PropVariantClear
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoCreateFreeThreadedMarshaler

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegOpenKeyExW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

rpcrt4

CStdStubBuffer_Connect
NdrDllUnregisterProxy
IUnknown_Release_Proxy
NdrDllCanUnloadNow
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllGetClassObject
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy

kernel32

lstrcmpiW

user32

UnregisterClassA

propsys

PropVariantToInt32
PropVariantToStringAlloc
PropVariantToInt64
PropVariantToBoolean
PropVariantToGUID
PropVariantToUInt64
PropVariantToUInt32
PropVariantChangeType

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2992ffc54fda06f07dbacfe4187fd7cd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

rpcrt4

kernel32

user32

propsys

Exports

Exports

Sections

.text Size: 79KB - Virtual size: 79KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 49KB - Virtual size: 49KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 79KB - Virtual size: 79KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 49KB - Virtual size: 49KB

.reloc
Size: 6KB - Virtual size: 6KB