PortableDeviceApi[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

PortableDeviceApi.dll
Size

506KB
MD5

da3501fdb41935d9dd58c788f8e23c0d
SHA1

66088320e195c955334b719157d0aa01fd19e184
SHA256

bae846e237151fd0c84ff1cc70907929138d2e4c0a3bede1b932bc2ac9ac20da
SHA512

0b703c58951124d2387e47bb8064cf63df3b7483a5ac4c6e23b21dde6c3c8ee249b7e1a2bd757889860895fc1f1f25c6ac4493c5fbe465a96cef5b4b3d74e957
SSDEEP

12288:MvnnY0PEvsqEft9vO9FTXl1BFP33tZa5On:MPn7PE0qEft9vOXTXlVP33qwn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PortableDeviceApi.dll

Files

PortableDeviceApi.dll
.dll regsvr32 windows:10 windows x86 arch:x86

7ba14331dcb8740bd079f8124dbbf05a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PortableDeviceApi.pdb

Imports

msvcrt

__CxxFrameHandler3
realloc
_errno
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
wcsncmp
wcsnlen
vswprintf_s
_vscwprintf
_wcsicmp
calloc
memmove_s
_purecall
wcscat_s
wcscpy_s
free
malloc
wcsncpy_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
memcpy
_CxxThrowException
_ftol2
memcmp
memset

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetModuleFileNameA
GetModuleHandleW
LockResource
FreeLibraryAndExitThread
DisableThreadLibraryCalls
LoadStringW
GetProcAddress
GetModuleHandleExW
LoadResource
GetModuleFileNameW
SizeofResource
FindResourceExW

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
ReleaseSRWLockExclusive
WaitForMultipleObjectsEx
CreateEventW
SetEvent

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapReAlloc
GetProcessHeap
HeapSize
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

ResumeThread
TerminateProcess
GetCurrentProcess
CreateThread
GetCurrentProcessId
OpenThreadToken
GetCurrentThread
OpenProcessToken
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
TraceEvent
GetTraceLoggerHandle
GetTraceEnableLevel
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW
RegOpenKeyExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventActivityIdControl
EventSetInformation
EventUnregister

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-security-base-l1-1-0

GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount

api-ms-win-core-io-l1-1-0

CancelIoEx
DeviceIoControl
GetOverlappedResult

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
TrySubmitThreadpoolCallback
FreeLibraryWhenCallbackReturns

api-ms-win-core-processthreads-l1-1-3

SetProcessInformation

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
InitOnceComplete
InitOnceBeginInitialize
WakeAllConditionVariable

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

kernel32

lstrcmpiW
GetCurrentPackageFamilyName

rpcrt4

NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
NdrDllGetClassObject
NdrDllRegisterProxy
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
NdrDllUnregisterProxy
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
NdrCStdStubBuffer2_Release
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
NdrClientCall2
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 397KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ba14331dcb8740bd079f8124dbbf05a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-3

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l2-1-0

kernel32

rpcrt4

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 397KB - Virtual size: 397KB

.data Size: 5KB - Virtual size: 9KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 296B

.rsrc Size: 63KB - Virtual size: 62KB

.reloc Size: 32KB - Virtual size: 31KB

.text
Size: 397KB - Virtual size: 397KB

.data
Size: 5KB - Virtual size: 9KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 296B

.rsrc
Size: 63KB - Virtual size: 62KB

.reloc
Size: 32KB - Virtual size: 31KB