Geolocation[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Geolocation.dll
Size

361KB
MD5

a0cffe731e9fde15fe1b46e2afc5a7b7
SHA1

cbacbfdd0a5367419ab7726731ec5737f42beb04
SHA256

0fd6e7a9413bd681ec99f11fdd417b06846664f696833784bdc9421ed71f1f9d
SHA512

8872c6d6ab41d33c7106cab720356370aadcb42f8e5d457b4fd0804a330916959c4e039c9c4da36fe1229566f8cf7885d33832b694c8e1124493919460e4b76a
SSDEEP

6144:AGOxjN/J1i9WzZ58TTeiH6dUNp4elatJeHy:AGgJ/Diwz3Kad2bvS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Geolocation.dll

Files

Geolocation.dll
.dll windows:10 windows x86 arch:x86

95ca6214f4afd95af64fac6da1c2e0a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Geolocation.pdb

Imports

msvcp110_win

?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
_Nan
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_function_call@std@@YAXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??0id@locale@std@@QAE@I@Z

msvcrt

memmove
memcpy
memcmp
_ftol2
_CxxThrowException
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_isnan
realloc
memmove_s
wcsnlen
_unlock
_lock
?terminate@@YAXXZ
_initterm
free
_amsg_exit
_XcptFilter
_callnewh
memset
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
__CxxFrameHandler3
_CIfmod
??3@YAXPAX@Z
malloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
LoadStringW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
LeaveCriticalSection
InitializeSRWLock
ReleaseMutex
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
OpenSemaphoreW
AcquireSRWLockShared
WaitForSingleObjectEx
CreateMutexExW
EnterCriticalSection
CreateEventW
ReleaseSemaphore
SetEvent
InitializeCriticalSection
OpenEventW
InitializeCriticalSectionEx
CreateEventExW
DeleteCriticalSection
WaitForSingleObject
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsGetStringLen
WindowsDuplicateString
HSTRING_UserUnmarshal
HSTRING_UserMarshal
WindowsIsStringEmpty
HSTRING_UserFree
HSTRING_UserSize

api-ms-win-core-com-l1-1-0

CoDecrementMTAUsage
CoQueryProxyBlanket
CoGetInterfaceAndReleaseStream
CoGetApartmentType
CoUninitialize
CoCreateInstance
CoIncrementMTAUsage
CoGetCallerTID
CoTaskMemFree
CoInitializeEx
CoMarshalInterface
CoCreateFreeThreadedMarshaler
CoReleaseMarshalData
CreateStreamOnHGlobal
CoSetProxyBlanket
CoTaskMemAlloc

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
SetThreadToken
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
OpenProcessToken
GetCurrentThread
GetCurrentProcessId

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW
SetRestrictedErrorInfo
RoOriginateError

api-ms-win-core-localization-l1-2-0

GetGeoInfoW
GetUserGeoID
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

oleaut32

SysStringLen
SysFreeString

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

ntdll

NtQuerySystemInformation
RtlQueryPackageIdentityEx
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlUnsubscribeWnfStateChangeNotification
RtlReportException

combase

ord8
ord7
ord5
ord34
ord33
CStdStubBuffer_CountRefs
CStdStubBuffer_AddRef
ord16
ord12
CStdStubBuffer2_Disconnect
ord14
ord2
CStdStubBuffer_DebugServerQueryInterface
ord10
ord13
ord11
ord9
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerRelease
ord15
CStdStubBuffer_Disconnect
ord32
CStdStubBuffer_IsIIDSupported
CStdStubBuffer2_Connect
CStdStubBuffer_Connect
ord17
ord6
CStdStubBuffer2_CountRefs
CStdStubBuffer2_QueryInterface

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
TrySubmitThreadpoolCallback
CloseThreadpoolWait
FreeLibraryWhenCallbackReturns
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoGetActivationFactory
RoInitialize

api-ms-win-security-base-l1-1-0

ImpersonateSelf
GetTokenInformation
RevertToSelf

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-com-l1-1-1

RoGetAgileReference

userenv

UnloadUserProfile

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

rpcrt4

IUnknown_Release_Proxy
NdrStubCall2
NdrStubForwardingFunction
IUnknown_AddRef_Proxy
NdrOleAllocate
NdrDllCanUnloadNow
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy
NdrOleFree

biwinrt

BiRtDeleteEventForApp
BiRtCreateEventForApp

api-ms-win-core-psm-app-l1-1-0

PsmQueryCurrentAppState

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 320KB - Virtual size: 319KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

95ca6214f4afd95af64fac6da1c2e0a9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp110_win

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ntdll

combase

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-capability-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-com-l1-1-1

userenv

api-ms-win-core-string-l1-1-0

api-ms-win-core-quirks-l1-1-0

rpcrt4

biwinrt

api-ms-win-core-psm-app-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

Exports

Exports

Sections

.text Size: 320KB - Virtual size: 319KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 24B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 320KB - Virtual size: 319KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 24B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 27KB - Virtual size: 27KB