AppxSip[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

AppxSip.dll
Size

93KB
MD5

3a91ae889f89fb8178f83ed516e58007
SHA1

d07f7a2213a7345fe561da4e3a91aee778b03798
SHA256

958e98cd981e7b8c9ed4253cdd098e03c5bf2cc5ce8ff146cbc7eadfc7e05406
SHA512

1e1082460b9987d73ec5444afa23f96f70427f79d68769161e853b0b9cfdfa02b7b5c6889c20726652e1dd3aa13bdd3b239f82a06303bd75b802b8896bfc60d4
SSDEEP

1536:nMXD1qNcTJVmH7REratw5bJyR8lvK1DTnpofc3c:nMXD0YmFl1wvEvpoE3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AppxSip.dll

Files

AppxSip.dll
.dll regsvr32 windows:6 windows x86 arch:x86

a40c9471638c9355b85de82a0b30fff4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppxSip.pdb

Imports

ntdll

RtlAllocateHeap
RtlNtStatusToDosError
RtlDeleteCriticalSection
RtlGetVersion
RtlFreeHeap
qsort
memmove
memcmp
memcpy
memset

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-synch-l1-2-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWrite

crypt32

CertGetSubjectCertificateFromStore
CryptQueryObject
CryptMsgGetParam
CertNameToStrW
CryptEncodeObject
CertCloseStore
CryptMsgClose
CryptSIPAddProvider
CryptSIPRemoveProvider
CertFreeCertificateContext
CryptFindOIDInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleHandleW

api-ms-win-core-file-l1-2-1

DeleteFileA
DeleteFileW
GetTempFileNameW
GetTempPathW
GetFileAttributesW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-1

CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
CompareStringEx

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileEx

wintrust

CryptCATCDFOpen
CryptCATCDFClose
CryptCATCDFEnumCatAttributes

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentVariableW

api-ms-win-core-file-l2-1-1

MoveFileExW
ReplaceFileW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-kernel32-legacy-l1-1-1

FileTimeToDosDateTime
DosDateTimeToFileTime
CopyFileW

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

opcservices

ord12

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

Exports

Exports

AppxBundleSipCreateIndirectData
AppxBundleSipGetSignedDataMsg
AppxBundleSipIsFileSupportedName
AppxBundleSipPutSignedDataMsg
AppxBundleSipRemoveSignedDataMsg
AppxBundleSipVerifyIndirectData
AppxSipCreateIndirectData
AppxSipGetSignedDataMsg
AppxSipIsFileSupportedName
AppxSipPutSignedDataMsg
AppxSipRemoveSignedDataMsg
AppxSipVerifyIndirectData
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
P7xSipCreateIndirectData
P7xSipGetSignedDataMsg
P7xSipIsFileSupportedName
P7xSipPutSignedDataMsg
P7xSipRemoveSignedDataMsg
P7xSipVerifyIndirectData

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a40c9471638c9355b85de82a0b30fff4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-eventing-provider-l1-1-0

crypt32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-shcore-stream-l1-1-0

wintrust

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-delayload-l1-1-1

opcservices

api-ms-win-core-heap-l1-2-0

Exports

Exports

Sections

.text Size: 82KB - Virtual size: 82KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

minATL Size: 512B - Virtual size: 12B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 82KB - Virtual size: 82KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

minATL
Size: 512B - Virtual size: 12B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB