MicrosoftAccountTokenProvider[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MicrosoftAccountTokenProvider.dll
Size

162KB
MD5

0ba58f29510ddc77fdbb6817e723e8d7
SHA1

3f8c4fac79a96c96df4029cc9b94a095173b884b
SHA256

c3bb36befffafda0bbbcdbd9be227fca89986288ded6f5a7ed4835bc1c47fb1b
SHA512

20746bad5a07773c8d7b492fcfe685fdadf6ff0406b7905b414c044f4e1dd923860e2e167e70ce30f1a09ff72f523c515ea58380640df40492dbb86f87943d3e
SSDEEP

3072:TdDLu+1OwR5otxdE1CJZ3h7RJynCYGUJym9JrihnZuDC5dxgOrq7Ilv5:1u+vRwEcZ3h7RYCYGE5aZoDYTgOU8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MicrosoftAccountTokenProvider.dll

Files

MicrosoftAccountTokenProvider.dll
.dll regsvr32 windows:10 windows x86 arch:x86

49f35dfeb6907a5e7ab14fe5672c1a28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MicrosoftAccountTokenProvider.pdb

Imports

msvcrt

_wcsicmp
tolower
isalpha
strtol
isxdigit
isdigit
__CxxFrameHandler3
swprintf_s
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler4_common
wcschr
_amsg_exit
_XcptFilter
calloc
_CxxThrowException
?what@exception@@UBEPBDXZ
_wtof
strrchr
malloc
_ftol2
_callnewh
_vsnprintf_s
wcsstr
memmove_s
memcpy_s
_initterm
_vsnwprintf
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
_set_errno
wcstol
vswprintf_s
_vscwprintf
iswspace
wcsncpy_s
wcsnlen
_wtoi
_purecall
free
memset

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
OpenSemaphoreW
EnterCriticalSection
ResetEvent
ReleaseSemaphore
DeleteCriticalSection
InitializeCriticalSection
CreateMutexExW
CreateSemaphoreExW
SetEvent
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateEventExW
ReleaseSRWLockExclusive
CreateEventW
ReleaseMutex
WaitForSingleObject
AcquireSRWLockExclusive

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
SizeofResource
LockResource
LoadResource
FindResourceExW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLocaleName
GetThreadPreferredUILanguages

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
OpenThreadToken
TerminateProcess
GetProcessIdOfThread
OpenThread
GetCurrentProcessId
OpenProcessToken

api-ms-win-core-heap-l1-1-0

HeapFree
HeapReAlloc
HeapDestroy
GetProcessHeap
HeapSize
HeapAlloc

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
EventActivityIdControl

api-ms-win-core-com-l1-1-0

CoUninitialize
CoGetCallContext
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoGetCallerTID

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetVersionExW
GetTickCount

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegDeleteValueW
RegGetValueW
RegDeleteTreeW
RegQueryInfoKeyW
RegEnumValueW
RegOpenCurrentUser
RegCloseKey
RegSetKeySecurity
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

ntdll

RtlGetDeviceFamilyInfoEnum

api-ms-win-security-base-l1-1-0

GetTokenInformation
CopySid
GetSecurityDescriptorSacl
ImpersonateLoggedOnUser
RevertToSelf
GetSecurityDescriptorDacl
DuplicateTokenEx
IsValidSid
GetLengthSid
CreateWellKnownSid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

rpcrt4

NdrMesTypeEncode2
NdrMesTypeDecode2
MesEncodeFixedBufferHandleCreate
MesBufferHandleReset
MesHandleFree
MesDecodeBufferHandleCreate
UuidCreate
I_RpcBindingInqLocalClientPID
RpcAsyncInitializeHandle
RpcSsDestroyClientContext
NdrAsyncClientCall2
RpcAsyncCompleteCall
RpcAsyncCancelCall
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
NdrMesTypeAlignSize2
NdrMesTypeFree2

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize
RoGetActivationFactory

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49f35dfeb6907a5e7ab14fe5672c1a28

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

ntdll

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

rpcrt4

api-ms-win-core-version-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-capability-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-stateseparation-helpers-l1-1-0

Exports

Exports

Sections

.text Size: 138KB - Virtual size: 138KB

.data Size: 1KB - Virtual size: 11KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 92B

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 138KB - Virtual size: 138KB

.data
Size: 1KB - Virtual size: 11KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 92B

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 8KB