ConfigureExpandedStorage[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ConfigureExpandedStorage.dll
Size

51KB
MD5

fedac8bc4dece9c01712658835e54772
SHA1

d5f16556a554da3b21634d43c94921cdb36a13e5
SHA256

4803809edf85bdd77603f0ca3274e075c6758e3d07482ac1b78e743a5ce19413
SHA512

630448fdce14a93b974877f7bc52edb4746ed4c7938c245d183b4b59d5890a3a33637d27b70173b9c5fc059e9ca600f8aa0902360e827460ddca0d28d380a303
SSDEEP

768:3vRR3Lm8nkEglg4uin4KMlAZ+GyntL6u+hJL+/db9:3JRyOFin/MA+7tLROSb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ConfigureExpandedStorage.dll

Files

ConfigureExpandedStorage.dll
.dll windows:6 windows x86 arch:x86

66602e0b9b64b38d3e53b80e9aefedf8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ConfigureExpandedStorage.pdb

Imports

msvcrt

memset
_vsnwprintf
_purecall
??3@YAXPAX@Z
_set_errno
_get_errno
_XcptFilter
_amsg_exit
free
malloc
_initterm
_lock
_unlock
__dllonexit
_onexit
??2@YAPAXI@Z
__CxxFrameHandler3
_except_handler4_common

kernel32

CloseThreadpoolTimer
TlsGetValue
FreeLibrary
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateDirectoryW
GetModuleHandleExW
WaitForSingleObject
SetEvent
ReleaseSRWLockExclusive
GetTickCount
AcquireSRWLockExclusive
TlsSetValue
OpenProcess
Sleep
InitOnceExecuteOnce
ReleaseSemaphore
RaiseException
FreeLibraryAndExitThread
GetLastError
CreateSemaphoreW
FreeLibraryWhenCallbackReturns
CreateEventExW
CreateThreadpoolTimer
CallbackMayRunLong
GetCurrentThreadId
OpenSemaphoreW
TlsAlloc
TrySubmitThreadpoolCallback
CloseHandle
GetCurrentProcessId
TlsFree
CreateThread
EncodePointer
GetProcessHeap
ReleaseSRWLockShared
DecodePointer
AcquireSRWLockShared
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

ole32

CoUninitialize
CoTaskMemRealloc
CreateStreamOnHGlobal
CoReleaseMarshalData
RoGetAgileReference
CoWaitForMultipleHandles
CoCopyProxy
CoGetMalloc
CoGetApartmentType
CoTaskMemAlloc
CoInitializeEx
CoMarshalInterface
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoCreateFreeThreadedMarshaler

shell32

SHGetKnownFolderItem
ord850
SHCreateItemFromParsingName

secur32

GetUserNameExW

api-ms-win-core-path-l1-1-0

PathAllocCombine

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError
RoTransformError
IsErrorPropagationEnabled
RoOriginateErrorW
SetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
GetRestrictedErrorInfo

api-ms-win-core-processthreads-l1-1-2

OpenProcessToken

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsCreateString
WindowsCreateStringReference
WindowsStringHasEmbeddedNull

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-heap-l1-2-0

HeapFree

shlwapi

SHGetThreadRef
PathFileExistsW
SHSetThreadRef
SHCreateThreadRef

user32

TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
PostThreadMessageW
DispatchMessageW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66602e0b9b64b38d3e53b80e9aefedf8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

ole32

shell32

secur32

api-ms-win-core-path-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-heap-l1-2-0

shlwapi

user32

Exports

Exports

Sections

.text Size: 33KB - Virtual size: 33KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

minATL Size: 512B - Virtual size: 16B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 33KB - Virtual size: 33KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

minATL
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 9KB