OneDriveSettingSyncProvider[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

OneDriveSettingSyncProvider.dll
Size

516KB
MD5

69b0582e3eea5ef35b327f114032e55d
SHA1

854acd700ed13346e722bc6e1b5d5c2943b57569
SHA256

6bf1759d2872125d7c002e15c13e5d3711d96e17442b3e42b644073880a00714
SHA512

7e1dce43cbf75192bef25048e56dff2cddb4457aa29b77de587099d6f7f8224521810ab54a827603e5f7f55081ff4df942902a14a0c49d5008c2f6633a1a8210
SSDEEP

6144:mst5HTBmQOQ2nEaCILleesxTY5o3EJp/Y3TDZrrI5R015wKzVxAKvPcirgg5:msfHTIeILWTY5uELA3prprLxJvPc4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OneDriveSettingSyncProvider.dll

Files

OneDriveSettingSyncProvider.dll
.dll windows:10 windows x86 arch:x86

71e1b10e2ced7393eb66e2fc9b1d2b47

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

OneDriveSettingSyncProvider.pdb

Imports

msvcrt

free
_except_handler4_common
swscanf_s
_wcsicmp
_set_errno
_get_errno
wcsstr
_wcsnicmp
wcschr
wcstok_s
_wcstoui64
memmove_s
realloc
malloc
time
rand
wcsncpy_s
strncmp
iswalnum
toupper
?what@exception@@UBEPBDXZ
?terminate@@YAXXZ
memcmp
_CxxThrowException
_onexit
_initterm
__dllonexit
_ftol2
_amsg_exit
_unlock
_callnewh
_XcptFilter
_purecall
??0exception@@QAE@ABQBDH@Z
memmove
??1type_info@@UAE@XZ
memcpy
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_vsnprintf_s
memcpy_s
srand
_vsnwprintf
??3@YAXPAX@Z
??1exception@@UAE@XZ
__CxxFrameHandler3
_lock
??0exception@@QAE@ABQBD@Z
memset

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventProviderEnabled
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
GetModuleFileNameW

api-ms-win-core-localization-l1-2-0

GetGeoInfoW
FormatMessageW
GetUserGeoID
LCMapStringEx

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
OpenThreadToken

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
ReleaseMutex
InitializeSRWLock
WaitForSingleObjectEx
CreateMutexW
AcquireSRWLockExclusive
InitializeCriticalSectionEx
SetEvent
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockShared
WaitForSingleObject
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
OpenSemaphoreW
CreateEventExW
DeleteCriticalSection
ReleaseSemaphore
ReleaseSRWLockExclusive
CreateMutexExW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
Sleep
InitOnceExecuteOnce
InitOnceComplete
WakeAllConditionVariable
InitOnceBeginInitialize

api-ms-win-core-registry-l1-1-0

RegDeleteTreeW
RegEnumKeyExW
RegDeleteValueW
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
GetTraceLoggerHandle
UnregisterTraceGuids

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoTransformError
RoOriginateError

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-heap-l2-1-0

LocalFree
LocalReAlloc
LocalAlloc

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrW
StrToIntExW
StrStrIW

api-ms-win-shcore-stream-l1-1-0

IStream_Read
SHOpenRegStream2W
IStream_Copy
IStream_WriteStr
SHCreateMemStream
IStream_Reset
IStream_Write
IStream_Size

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

ntdll

AlpcInitializeMessageAttribute
TpWaitForAlpcCompletion
vDbgPrintEx
ZwAlpcConnectPort
RtlWaitOnAddress
RtlInitUnicodeString
ZwAlpcQueryInformation
TpReleaseAlpcCompletion
ZwAlpcSendWaitReceivePort
ZwAlpcDisconnectPort
TpAllocAlpcCompletion
RtlWakeAddressAll
ZwAlpcCancelMessage
RtlFreeHeap
AlpcGetMessageAttribute
ZwClose
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
NtPowerInformation
RtlGetSuiteMask
RtlNtStatusToDosError
EtwEventActivityIdControl
EtwTraceMessage
RtlAllocateHeap

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsCreateString

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-shcore-registry-l1-1-0

SHRegGetPathW
SHDeleteValueW
SHRegSetPathW
SHDeleteKeyW
SHRegGetValueW
SHSetValueW

api-ms-win-core-file-l1-1-0

SetFileAttributesW
RemoveDirectoryW
FindClose
FindNextFileW
FindFirstFileW
CreateFileW
DeleteFileW
GetFileAttributesW
CompareFileTime
GetTempFileNameW
SetFileTime

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-path-l1-1-0

PathAllocCombine

api-ms-win-security-base-l1-1-0

GetTokenInformation
CreateWellKnownSid

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathGetCharTypeW
PathStripPathW

api-ms-win-core-url-l1-1-0

UrlUnescapeW
UrlEscapeW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

bcrypt

BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptGetProperty

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpool
CreateThreadpoolTimer
CloseThreadpool

api-ms-win-appmodel-state-l1-2-0

OpenStateExplicit
CloseState
GetSystemAppDataKey

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 459KB - Virtual size: 459KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71e1b10e2ced7393eb66e2fc9b1d2b47

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

ntdll

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-shcore-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

bcrypt

api-ms-win-core-threadpool-l1-2-0

api-ms-win-appmodel-state-l1-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 459KB - Virtual size: 459KB

.data Size: 1024B - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 224B

.rsrc Size: 21KB - Virtual size: 20KB

.reloc Size: 23KB - Virtual size: 23KB

.text
Size: 459KB - Virtual size: 459KB

.data
Size: 1024B - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 224B

.rsrc
Size: 21KB - Virtual size: 20KB

.reloc
Size: 23KB - Virtual size: 23KB