APMon[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

APMon.dll
Size

980KB
MD5

ee50c47c192c5ebf7e38cd9118dd0950
SHA1

d84d0b6c98c9c4b12f6ba0cdfa40c1e14bdae0c7
SHA256

4f6de0ffbdea5e67d7afcc31b6a721fefc342fff1ee15f34cb09aba337eb27cd
SHA512

f61a26d103be407b674e72d93cc262fe2d1de50a8b7aa8fe22d32c8e08611b01603f7d7fb4911a3a60cdd48d1d2f6ecd6f64a69c9455b833bd0a149190c8d2e8
SSDEEP

24576:o9YI/qOc03HlaOqTyqBXrDP4cAOJNIvS:o9YI/qOcEHo/TyMDQcA2SvS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
APMon.dll

Files

APMon.dll
.dll windows:10 windows x86 arch:x86

e76f69464e64f852c00ff98c031cb3b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

APMon.pdb

Imports

msvcrt

iswspace
wcstok_s
_wctime
wcsrchr
abort
memmove_s
_get_errno
_wcsdup
_set_errno
memchr
_wcsnicmp
wcsstr
_wsplitpath_s
__uncaught_exception
__crtLCMapStringW
sscanf_s
__pctype_func
_get_current_locale
_free_locale
towlower
_ismbblead
_wtoi
memcmp
calloc
wcspbrk
wcstoul
wcstod
wcstok
time
wcstol
__CxxFrameHandler3
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
free
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
wcschr
wcsncmp
_wcsicmp
??_V@YAXPAX@Z
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
_stricmp
_vsnprintf
sprintf_s
toupper
tolower
isupper
isdigit
memset
_wtol
_errno
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@PBD@Z
_wtof
setlocale
___mb_cur_max_func
___lc_handle_func
___lc_codepage_func
_ftol2_sse

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleW
LockResource
LoadResource
SizeofResource
GetProcAddress
LoadStringW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
ResetEvent
ReleaseMutex
SetEvent
EnterCriticalSection
WaitForSingleObject
ReleaseSRWLockShared
AcquireSRWLockShared
LeaveCriticalSection
ReleaseSemaphore
CreateEventW
InitializeCriticalSectionEx
DeleteCriticalSection
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
CreateEventExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventActivityIdControl
EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
OpenProcessToken
CreateThread
OpenThreadToken

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
FormatMessageW
GetSystemPreferredUILanguages

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags

api-ms-win-core-libraryloader-l1-2-1

FindResourceW
LoadLibraryW

rpcrt4

UuidToStringW
RpcStringFreeW
UuidFromStringW
UuidCreate

api-ms-win-devices-query-l1-1-1

DevCreateObjectQueryEx

api-ms-win-devices-query-l1-1-0

DevCloseObjectQuery

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolCleanupGroup
CreateThreadpool
CloseThreadpoolWork
CreateThreadpoolWork
CloseThreadpool
SetThreadpoolTimer
SubmitThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolThreadMaximum

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW

spoolss

GetServerPolicy
RouterAllocBidiResponseContainer
DeletePrinter
EnumPrintersW
GetPrinterDriverW
EnumPortsW
RouterAllocBidiMem
RouterFreeBidiMem
RouterFreeBidiResponseContainer
RevertToPrinterSelf
ImpersonatePrinterClient
GetJobW
SetJobW
OpenPrinterW
SetPortW
ClosePrinter
GetJobNamedPropertyValue
GetPrinterDataW
RouterCreatePrintAsyncNotificationChannel
GetPrinterDriverDirectoryW
GetPrinterW
SetPrinterW
FreePrintPropertyValue

deviceassociation

DafStartRemoveAssociation
DafStartWriteCeremonyData
DafSelectCeremony
DafCloseAssociationContext
DafCreateAssociationContext
DafStartFinalize
DafStartDeviceStatusNotification
DafCloseChallengeContext
DafCreateChallengeContext
DafChallengeDevicePresence

cfgmgr32

CMP_WaitNoPendingInstallEvents
SwDeviceCreate
SwDeviceClose
DevGetObjectProperties
SwDeviceSetLifetime
DevCreateObjectQueryFromIdEx
DevCreateObjectQueryFromId
DevSetObjectProperties
DevFreeObjectProperties

wsdapi

WSDCreateOutboundAttachment
WSDXMLCreateContext
WSDCreateDeviceProxy
WSDFreeLinkedMemory
WSDAllocateLinkedMemory

netutils

NetApiBufferFree

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
CompareStringOrdinal

api-ms-win-core-file-l1-1-0

GetFileAttributesW

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalAlloc
LocalFree

api-ms-win-security-base-l1-1-0

CopySid
GetTokenInformation
EqualSid
ImpersonateLoggedOnUser
GetLengthSid
RevertToSelf

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream
SHCreateStreamOnFileW

ntdll

TpReleaseAlpcCompletion
TpWaitForAlpcCompletion
TpReleaseIoCompletion
TpWaitForIoCompletion
TpReleaseTimer
TpWaitForTimer
TpReleaseWait
TpWaitForWait
EtwEventWrite
TpWaitForWork
TpAllocAlpcCompletion
TpStartAsyncIoOperation
TpAllocIoCompletion
TpSetTimer
TpAllocTimer
TpAllocWait
TpPostWork
TpAllocWork
RtlNtStatusToDosError
TpSimpleTryPost
TpSetWait
TpCallbackMayRunLong
TpReleasePool
EtwTraceMessage
EtwEventEnabled
TpReleaseWork

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer
CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileSectionW
GetPrivateProfileStringW

api-ms-win-security-activedirectoryclient-l1-1-0

DsUnBindW
DsCrackNamesW
DsFreeNameResultW

api-ms-win-core-string-l2-1-0

CharUpperBuffW

bcrypt

BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptGetProperty

winhttp

WinHttpSetOption
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpConnect
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpWriteData
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpSetTimeouts
WinHttpReadData
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

setupapi

SetupDiDestroyDeviceInfoList
SetupDiOpenDeviceInfoW
SetupDiGetDevicePropertyW
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiCreateDeviceInfoList
SetupDiDeleteDeviceInfo
SetupDiDestroyDriverInfoList
SetupDiGetSelectedDriverW
SetupDiBuildDriverInfoList
SetupDiCreateDeviceInfoW
SetupDiSetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoListExW

kernel32

GetUserDefaultLocaleName
LoadLibraryExW
InitializeCriticalSectionAndSpinCount

wtsapi32

WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsW

sspicli

GetUserNameExW

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

policymanager

PolicyManager_GetPolicyString
PolicyManager_FreeStringValue

Exports

Exports

InitializePrintMonitor2

Sections

.text
Size: 679KB - Virtual size: 678KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 233KB - Virtual size: 233KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e76f69464e64f852c00ff98c031cb3b2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

rpcrt4

api-ms-win-devices-query-l1-1-1

api-ms-win-devices-query-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

spoolss

deviceassociation

cfgmgr32

wsdapi

netutils

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-shcore-stream-l1-1-0

ntdll

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-security-activedirectoryclient-l1-1-0

api-ms-win-core-string-l2-1-0

bcrypt

winhttp

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

setupapi

kernel32

wtsapi32

sspicli

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-util-l1-1-0

policymanager

Exports

Exports

Sections

.text Size: 679KB - Virtual size: 678KB

.data Size: 13KB - Virtual size: 15KB

.idata Size: 12KB - Virtual size: 11KB

.didat Size: 512B - Virtual size: 140B

.rsrc Size: 233KB - Virtual size: 233KB

.reloc Size: 41KB - Virtual size: 40KB

.text
Size: 679KB - Virtual size: 678KB

.data
Size: 13KB - Virtual size: 15KB

.idata
Size: 12KB - Virtual size: 11KB

.didat
Size: 512B - Virtual size: 140B

.rsrc
Size: 233KB - Virtual size: 233KB

.reloc
Size: 41KB - Virtual size: 40KB