AppIdPolicyEngineApi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
AppIdPolicyEngineApi.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
AppIdPolicyEngineApi.dll
Resource
win10v2004-20240508-en
General
-
Target
AppIdPolicyEngineApi.dll
-
Size
220KB
-
MD5
1fa9fdcef5d0dbd20ebd7d1356baf198
-
SHA1
97b8ac7ec3de557e66bdf5c1708984e2a5754189
-
SHA256
3a2c61b523ee855b5492952083d28466961d8c0e96d2552369f6caa0d19833ce
-
SHA512
eaaca31d1b26cf80ebdda288f5ee1ed63b3f5be30fd0e7f494ce0e937ee7a9c028061f7ac5cfe7e1b27e8bb1bc5f0c8424bc919fa274a63fdd986b4256971182
-
SSDEEP
3072:tl/Tf85BQH0eTlBkfgMFnVbT9VCYEE2uq7fxGbDTg+3xdDwxX+vt4VTasHDhRkd:tl/QBePBkP9euhDTzDwp+vtCVRkd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AppIdPolicyEngineApi.dll
Files
-
AppIdPolicyEngineApi.dll.dll windows:6 windows x86 arch:x86
ef9f814dcd88d332d836e7616050416f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler4_common
memcmp
__RTDynamicCast
_onexit
memmove_s
memset
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
__CxxFrameHandler3
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_errno
realloc
_lock
_unlock
__dllonexit
wcsncpy_s
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_callnewh
_purecall
memcpy_s
free
malloc
_wtoi
_wtof
tolower
towupper
_vsnwprintf_s
_ui64tow_s
wcstol
memcpy
ntdll
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
user32
CharNextW
UnregisterClassA
kernel32
RegDeleteTreeW
RegQueryValueExW
ResolveDelayLoadedAPI
DelayLoadFailureHook
SetLastError
CloseHandle
CreateFileW
GetSystemWindowsDirectoryW
LocalFree
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
Sleep
RaiseException
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
SetUnhandledExceptionFilter
advapi32
RegCreateKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSidToSidW
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetAce
RegEnumKeyW
rpcrt4
UuidToStringW
RpcStringFreeW
UuidCreate
UuidCompare
UuidFromStringW
authz
AuthzInitializeResourceManager
AuthzInitializeContextFromSid
AuthzFreeContext
AuthziModifySecurityAttributes
AuthziAccessCheckEx
AuthzFreeResourceManager
appidapi
AppIDEncodeAttributeString
AppIDGetAppxFileAttributes
AppIDDecodeAttributeString
AppIDConstructAppxAttributes
AppIDGetFileAttributes
AppIDReleaseAppxFileAttributes
AppIDReleaseFileAttributes
AppIDFreeAttributeString
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
api-ms-win-core-path-l1-1-0
PathCchAppend
shlwapi
SHCreateStreamOnFileEx
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ