UserDataPlatformHelperUtil.pdb
Static task
static1
Behavioral task
behavioral1
Sample
UserDataPlatformHelperUtil.dll
Resource
win10v2004-20240426-en
General
-
Target
UserDataPlatformHelperUtil.dll
-
Size
49KB
-
MD5
8d0ef48e8ee39083e619883a3514dda2
-
SHA1
fa632ab355b8dedc60a86daae061bc2b8d7c1c4c
-
SHA256
a3233c458accced8bb04a819495c2bf82e69c78b4a6702cb2848c913fbbcbf54
-
SHA512
e92c0eabca9417da5b7536beed370e7cacb7286083b5ae45a02940edf5dc2109f43e5b6880d771f564e4e6a9d8c63fb784eb30d7853ec8bfdaf9f7c49492209a
-
SSDEEP
1536:jA93Wy81mzW15N8ZSVLF4MmrEogV8jo3oOq4e8rJYIHC9zQO:jeqL1YZSVLF4MmYoG8jlOqb8rJYIHCBQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource UserDataPlatformHelperUtil.dll
Files
-
UserDataPlatformHelperUtil.dll.dll windows:10 windows x86 arch:x86
45e7e5a1990f671ebb8fdf4059cc1c9e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_unlock
_XcptFilter
_onexit
_CIsqrt
_amsg_exit
__dllonexit
memmove
memcpy
_initterm
??1type_info@@UAE@XZ
_ftol2
_vsnwprintf
_lock
_except_handler4_common
free
memcpy_s
rand
srand
_purecall
__CxxFrameHandler3
?raw_name@type_info@@QBEPBDXZ
malloc
_callnewh
memset
rpcrt4
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcImpersonateClient
RpcStringFreeW
RpcRevertToSelf
RpcBindingFree
RpcBindingSetAuthInfoExW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
UnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
InitializeCriticalSection
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryExW
GetModuleHandleW
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
api-ms-win-core-file-l1-1-0
GetTempFileNameW
GetFileAttributesW
CreateFileW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-shell-shdirectory-l1-1-0
ord290
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCloseKey
RegGetValueW
RegCreateKeyExW
api-ms-win-security-base-l1-1-0
MakeAbsoluteSD
MakeSelfRelativeSD
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-service-winsvc-l1-1-0
ControlService
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindExtensionW
PathMatchSpecW
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrStrIW
ntdll
NtQueryInformationThread
NtSetInformationThread
api-ms-win-core-synch-l1-2-0
InitOnceComplete
InitOnceBeginInitialize
WakeAllConditionVariable
InitOnceExecuteOnce
SleepConditionVariableSRW
Sleep
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
??0CalculateSize@Comms@@QAE@_N0@Z
??0Deserializer@Comms@@QAE@PBE0_N1@Z
??0RpcClient@Comms@@QAE@XZ
??0SecureRpcClient@Comms@@QAE@XZ
??0SerializeBuffer@Comms@@QAE@ABVCalculateSize@1@_N1@Z
??1Deserializer@Comms@@QAE@XZ
??1RpcClient@Comms@@QAE@XZ
??1SecureRpcClient@Comms@@UAE@XZ
?CopyBytesIn@CalculateSize@Comms@@UAEXPBXIABVtype_info@@@Z
?CopyBytesIn@SerializeBuffer@Comms@@UAEXPBXIABVtype_info@@@Z
?CopyBytesOut@Deserializer@Comms@@QAE_NPAXIABVtype_info@@@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAPAD@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAPAG@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAPBD@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAPBG@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAV?$basic_string@GU?$char_traits@G@utl@@V?$allocator@G@2@@utl@@@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAV?$vector@EV?$allocator@E@utl@@@utl@@@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@AAVNullType@detail@1@@Z
?DeserializeObject@Comms@@YG_NAAVDeserializer@1@ABVNullType@detail@1@@Z
?GetBuffer@Deserializer@Comms@@QAEPAXI@Z
?GetBuffer@SerializeBuffer@Comms@@QAEXAAV?$vector@EV?$allocator@E@utl@@@utl@@@Z
?GetBuffer@SerializeBuffer@Comms@@QBEPBV?$vector@EV?$allocator@E@utl@@@utl@@XZ
?GetTotal@CalculateSize@Comms@@QBEIXZ
?Initialize@SerializeBuffer@Comms@@QAE_NXZ
?InitializeBinding@RpcClient@Comms@@QAEJPBGAAPAX@Z
?ReleaseBuffer@Deserializer@Comms@@QAEXPBX@Z
?SerializeObject@Comms@@YGXAAVSerializeBase@1@ABV?$basic_string@GU?$char_traits@G@utl@@V?$allocator@G@2@@utl@@@Z
?SerializeObject@Comms@@YGXAAVSerializeBase@1@ABV?$vector@EV?$allocator@E@utl@@@utl@@@Z
?SerializeObject@Comms@@YGXAAVSerializeBase@1@ABVNullType@detail@1@@Z
?SerializeObject@Comms@@YGXAAVSerializeBase@1@PBD@Z
?SerializeObject@Comms@@YGXAAVSerializeBase@1@PBG@Z
?_InitializeSecureRpcBinding@SecureRpcClient@Comms@@IAEJPBG0@Z
ConvertHtmlStringToPlainTextStringOneCore
ConvertPlainTextStringToHtmlStringOneCore
CreateKnownFolderPath
DefaultMakeHresultFromJetError
DllCanUnloadNow
DllGetClassObject
FreeEnumColumn
GenerateUserModeServiceName
GetCalendarColors
GetCombinedTransientObjectSecurityDescriptor
GetContentTypeFromFilePath
GetFileExtensionFromContentType
GetNextNewCalendarColor
GetQueryProcessHandle
GetRpcClientThreadToken
GetSupportedImageFileExtensions
GetTempFileNameWithExt
GetThreadIOPriority
GetUserContextFromHandle
GetUserTokenFromContext
IsActiveDebugger
IsCommsSystemService
IsImageExtension
JetReallocMethod
PrependHtmlOneCore
ResizeImageBySizeInMemory
ResizeImageBySizeToStream
RunServicesInProc
SetCommsServiceJetGlobalSystemParameters
SetPoolThreadBasePriority
SetThreadIOPriority
StartAndWaitForService
StartAndWaitForServiceForUser
StopAndWaitForService
UT_UninitializeTrident
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ