OneDriveSettingSyncProvider[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

OneDriveSettingSyncProvider.dll
Size

533KB
MD5

595e06961f7a5eadc78a0e1dca50c060
SHA1

a9d90a1272b77101bd8ea7bff96f26ea6ab92d20
SHA256

d1705b950448fbcfe2c594a8e9aa032205526670707eda6c1774c68783ea7e18
SHA512

7fc964bdf0050f3ec0bafbaa7783457da367a0e6ac21d7425ebaacf37cc251da185fbb4c092feb7d27757bd1889d4ebbd14ced7b6334d2e4e4d11ce6dfa743e8
SSDEEP

6144:Xnciy0WlHTBCrVsY/Z9kXbPSEtcrTlRqfIbbttp7lryIKuAKUSCXMAKToDLBysRR:s0+HTU5/fkLntXLB7RthItfDg0nIlxo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OneDriveSettingSyncProvider.dll

Files

OneDriveSettingSyncProvider.dll
.dll windows:10 windows x86 arch:x86

40020244307052ff422ca3e3db3b5649

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

OneDriveSettingSyncProvider.pdb

Imports

msvcrt

_set_errno
_get_errno
wcsstr
_wcsnicmp
wcschr
wcstok_s
_wcstoui64
memmove_s
realloc
_wcsicmp
time
rand
wcsncpy_s
strncmp
toupper
iswalnum
swscanf_s
__CxxFrameHandler3
_callnewh
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
memcmp
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_ftol2
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_vsnprintf_s
_CxxThrowException
memcpy_s
_vsnwprintf
??3@YAXPAX@Z
memcpy
??1exception@@UAE@XZ
memmove
??0exception@@QAE@ABQBD@Z
srand
memset

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventProviderEnabled
EventUnregister
EventSetInformation
EventWriteTransfer

api-ms-win-core-localization-l1-2-0

LCMapStringEx
GetGeoInfoW
GetUserGeoID
FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
OpenThreadToken
GetCurrentProcessId
TerminateProcess

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
DeleteCriticalSection
AcquireSRWLockExclusive
EnterCriticalSection
CreateMutexExW
AcquireSRWLockShared
InitializeSRWLock
ReleaseSRWLockExclusive
WaitForSingleObject
CreateEventExW
WaitForSingleObjectEx
OpenSemaphoreW
TryAcquireSRWLockExclusive
CreateSemaphoreExW
LeaveCriticalSection
ReleaseSemaphore
SetEvent
ReleaseMutex
ReleaseSRWLockShared

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegDeleteTreeW
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
RegQueryValueExW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
SetRestrictedErrorInfo
RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetVersionExW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalReAlloc
LocalFree

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrToIntExW
StrStrIW

api-ms-win-shcore-stream-l1-1-0

IStream_Reset
SHCreateMemStream
IStream_WriteStr
IStream_Size
IStream_Write
SHOpenRegStream2W
IStream_Read
IStream_Copy

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

ntdll

RtlUnsubscribeWnfNotificationWaitForCompletion
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
NtPowerInformation
RtlGetSuiteMask
RtlNtStatusToDosError
EtwEventActivityIdControl
EtwTraceMessage
EtwEventWriteTransfer
NtSetInformationFile

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsCreateString
WindowsCompareStringOrdinal
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-shcore-registry-l1-1-0

SHRegGetValueW
SHRegSetPathW
SHDeleteValueW
SHSetValueW
SHDeleteKeyW
SHRegGetPathW

api-ms-win-core-file-l1-1-0

CompareFileTime
SetFileTime
GetTempFileNameW
FindClose
FindNextFileW
FindFirstFileW
SetFileAttributesW
RemoveDirectoryW
GetFileAttributesW
DeleteFileW
CreateFileW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-path-l1-1-0

PathAllocCombine

api-ms-win-security-base-l1-1-0

GetTokenInformation
CreateWellKnownSid

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathGetCharTypeW
PathStripPathW

api-ms-win-core-url-l1-1-0

UrlUnescapeW
UrlEscapeW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

bcrypt

BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty

shcore

ord190

umpdc

Pdcv2ActivationClientRegister
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientActivate

api-ms-win-core-sysinfo-l1-2-0

GetOsSafeBootMode

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-shell-shdirectory-l1-1-0

ord290

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 470KB - Virtual size: 469KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40020244307052ff422ca3e3db3b5649

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

ntdll

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-shcore-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

bcrypt

shcore

umpdc

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

Exports

Exports

Sections

.text Size: 470KB - Virtual size: 469KB

.data Size: 1024B - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 212B

.rsrc Size: 28KB - Virtual size: 27KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 470KB - Virtual size: 469KB

.data
Size: 1024B - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 212B

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 24KB - Virtual size: 23KB