EmailApis[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

EmailApis.dll
Size

788KB
MD5

83e11529431e1cb1c1e23f3ea40f065c
SHA1

751fe1b271af4c6474514704afa5f1b88a18fff0
SHA256

1a9d3144ec3984b4ffa2fbdbede809220903a218831d39afd7d3923fdc7348b3
SHA512

b43ac6963bf3295726472bc98b5dbaddf02232aa70e84ef6720450704906ec988e975c9104715263b9a972a410e7959388d3a2b6c9fcdc9105008b6f732025b8
SSDEEP

12288:/7vD6cAVhFsbSfppSo6NY7fzSg5MS5Ac:DLLahFQSCzNY7fzSBS5v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EmailApis.dll

Files

EmailApis.dll
.dll windows:10 windows x86 arch:x86

6bc3414bdf2b885bf0f37c5fe9681b7b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

EmailApis.pdb

Imports

msvcrt

__CxxFrameHandler3
_onexit
__dllonexit
memmove
memcpy
memcmp
_unlock
_lock
_except_handler4_common
memcpy_s
_amsg_exit
_XcptFilter
_callnewh
wcstoul
wcschr
wcsncmp
_errno
_vsnwprintf_s
memmove_s
realloc
_vsnwprintf
_purecall
wcsncpy_s
malloc
free
_initterm
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
LoadLibraryExW
FindResourceExW
LoadResource
FreeLibrary
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
SizeofResource

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
CreateEventExW
SetEvent
CreateEventW
InitializeCriticalSectionEx
DeleteCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateMutexExW
InitializeSRWLock

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegSetValueExW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventActivityIdControl
EventRegister
EventSetInformation

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA
DebugBreak

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
OpenThreadToken
GetCurrentThreadId
GetCurrentThread
TerminateProcess
SetThreadToken

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW
InitOnceExecuteOnce
Sleep

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
FreeLibraryWhenCallbackReturns
SubmitThreadpoolWork
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolWork

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-url-l1-1-0

UrlEscapeW
UrlUnescapeW

api-ms-win-core-file-l1-1-0

GetTempFileNameW
FindNextFileW
DeleteFileW
FindClose
FindFirstFileW
CreateDirectoryW
RemoveDirectoryW

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchCombine

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW

ntdll

RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

IsCommsSystemService
StartAndWaitForServiceForUser
GetUserContextFromHandle
GenerateUserModeServiceName
GetUserTokenFromContext
RunServicesInProc

systemeventsbrokerclient

SebDeleteEvent
SebCreateEmailNotificationEvent

appointmentapis

CreatePropertiesFromRecurrencePattern
CreateRecurrencePatternFromProperties

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 717KB - Virtual size: 717KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bc3414bdf2b885bf0f37c5fe9681b7b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-url-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

ntdll

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-profile-l1-1-0

userdataplatformhelperutil

systemeventsbrokerclient

appointmentapis

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 717KB - Virtual size: 717KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 276B

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 61KB - Virtual size: 60KB

.text
Size: 717KB - Virtual size: 717KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 276B

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 61KB - Virtual size: 60KB