PhotoMetadataHandler[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

PhotoMetadataHandler.dll
Size

337KB
MD5

69e2a1fd4f18491d9ed0a21d0192531a
SHA1

b5e6e180dff8df5a3e0b513c3210a72ff21dc6f3
SHA256

30af1030537ee4eb063b49c367aa2c552ab32ff60e68e179af2c7154aafa1cd7
SHA512

177d0a5f94e4792281065807f4d14ba9ca4d07fbc57400100785eb3d668e591669e5c45e059f18b6d620f42af29dbdfb23917baaa5cd264d5ec05bc25f0099a9
SSDEEP

6144:TDxJip/nnlrwHxm//YOtvC9KdKe5MQxakcztSrC0:vm/wOrdNMua43

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PhotoMetadataHandler.dll

Files

PhotoMetadataHandler.dll
.dll regsvr32 windows:6 windows x86 arch:x86

ef770e816903953cf38e01508f255195

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PhotoMetadataHandler.pdb

Imports

msvcrt

wcstombs
iswctype
ferror
wctomb
_itoa
_snprintf
_iob
__mb_cur_max
mbtowc
_read
__badioinfo
__pioinfo
localeconv
_fileno
isleadbyte
isspace
isxdigit
isdigit
memmove
memcpy
_isatty
_onexit
__dllonexit
_write
_lock
realloc
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
_lseeki64
ungetc
floor
memset
__CxxFrameHandler
_CxxThrowException
_purecall
_errno
_vscwprintf
iswspace
wcsstr
_wcsicmp
wcschr
strtol
strtoul
wcstod
_wtof
_wcstoi64
towupper
calloc
wcsrchr
_vsnwprintf
free
malloc
_wtol
wcstok
_unlock
memcmp

propsys

PropVariantGetElementCount
PropVariantCompareEx
InitPropVariantFromStringAsVector
PropVariantChangeType
InitPropVariantFromStringVector

rpcrt4

CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllUnregisterProxy

windowscodecs

WICConvertBitmapSource

ntdll

RtlUnwind

api-ms-win-core-file-l1-1-0

GetTempFileNameW
DeleteFileW
FileTimeToSystemTime

api-ms-win-shcore-unicodeansi-l1-1-0

SHAnsiToUnicode
SHUnicodeToAnsi

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW

api-ms-win-shell-shellfolders-l1-1-0

SHGetFolderPathW

api-ms-win-core-synch-l1-2-0

DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
Sleep
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection

api-ms-win-core-com-l1-1-1

CoTaskMemRealloc
PropVariantClear
PropVariantCopy
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoGetMalloc
CLSIDFromString

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
TraceEvent
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameW
LockResource
LoadResource
SizeofResource
LoadLibraryExW
GetProcAddress
FreeLibrary
FindResourceExW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
WideCharToMultiByte

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime

api-ms-win-core-file-l1-2-1

GetTempPathW

api-ms-win-core-localization-l1-2-1

GetSystemDefaultLCID

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapDestroy
HeapReAlloc
GetProcessHeap
HeapFree
HeapSize

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetVersion
GetTickCount

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

LoadLibraryW
MulDiv

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrlenA
lstrcmpW
lstrcmpiW

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrTrimW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 307KB - Virtual size: 306KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef770e816903953cf38e01508f255195

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

propsys

rpcrt4

windowscodecs

ntdll

api-ms-win-core-file-l1-1-0

api-ms-win-shcore-unicodeansi-l1-1-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-shell-shellfolders-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-debug-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

Exports

Exports

Sections

.text Size: 307KB - Virtual size: 306KB

.orpc Size: 512B - Virtual size: 78B

.data Size: 5KB - Virtual size: 4KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 307KB - Virtual size: 306KB

.orpc
Size: 512B - Virtual size: 78B

.data
Size: 5KB - Virtual size: 4KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 13KB - Virtual size: 12KB