AppxAllUserStore[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AppxAllUserStore.dll
Size

136KB
MD5

a281999524d452068f03c0d6cce7d9de
SHA1

4aa3e22a55973fc0534967cca393cbe078fe1369
SHA256

85fc107be0512864a43aab5206f1d1612a6aae0d18794c25c13c661cc812889b
SHA512

f0a17a908f64f60accc1feef90ec1004ace0dc0d5c202f571455f92ed784853e99cf10ecaee8053f0e8982b31daf6b4df99a9c1e25c524caef438a15914e30bc
SSDEEP

3072:hrZQ8bUwqCxhuv56bqWbN9TOfwZ8xIWTcS6Gc/MG19IpIVjmzlnXRoU:Ruv56bNOs1Jgp+jGlXRo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AppxAllUserStore.dll

Files

AppxAllUserStore.dll
.dll windows:6 windows x86 arch:x86

457da7d1e33bb1a2e341082d937b0061

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AppxAllUserStore.pdb

Imports

msvcrt

_vsnwprintf_s
wcsstr
_except_handler4_common
_onexit
__dllonexit
wcschr
_lock
_wcsnicmp
_initterm
malloc
_wcsicmp
free
_amsg_exit
memcmp
_XcptFilter
memmove
memcpy
_unlock
memset

ntdll

RtlFreeUnicodeString
RtlValidSid
RtlAllocateAndInitializeSid
RtlDowncaseUnicodeString
RtlInitUnicodeString
RtlDeleteCriticalSection
NtQuerySystemInformation
RtlReportException
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
RtlFreeSid

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
TraceMessage

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWrite
EventUnregister
EventRegister

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegCopyTreeW
RegDeleteTreeW
RegGetValueW
RegSetValueExW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringW

api-ms-win-security-base-l1-1-0

GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
GetLengthSid
ImpersonateLoggedOnUser
AdjustTokenPrivileges
CheckTokenMembership
RevertToSelf
CreateWellKnownSid
CopySid

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExW
FreeLibrary
GetProcAddress

api-ms-win-core-file-l1-1-0

GetFileAttributesW
CreateDirectoryW
CreateFileW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegOpenKeyW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

DebugBreak

api-ms-win-core-processsecurity-l1-1-0

OpenProcessToken
OpenThreadToken

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-security-provider-l1-1-0

SetSecurityInfo
GetSecurityInfo
SetEntriesInAclW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

oleaut32

VariantClear
SysStringLen
SysFreeString
SysAllocString
GetErrorInfo

Exports

Exports

AddPackageToRegistryStore
AddStagedPackageToRegistryStore
CheckPackagePreinstallPolicy
CommitTakeOwnershipSession
DeleteAllPackagesFromMainPackageArray
DeleteAllPackagesFromPackageArray
DeletePackageInfo
DeleteUserRegistryKeyFromAllUserStore
DidAppSurviveOSUpgradeForUser
DoesPerUserStoreExist
FamilyMonikerStringToSid
FindExistingVersionInRegistryStore
GetAllNonInboxPackagesFromRegistryStore
GetAllPackagesToBeInstalledForUser
GetAllStagedPackagesForMainPackageFromRegistryStore
GetAppxProvisionFactory
HasStagedPackages
IsEnterprisePolicyEnabled
IsInboxPackage
IsNonInboxAllUserPackage
IsPackageInUpgradeKey
IsSystemInAuditBoot
MarkStatusOfMainPackageForUser
PackageFamilyNameFromId
PackageIdBasicFromFullName
PackageSidToPackageCapabilitySid
RemovePackageFromRegistryStore
RemoveStagedPackageFromRegistryStore
RollbackTakeOwnershipSession
TakeOwnershipOnFolder
UpdateFrameworkPackageInRegistryStore
UpdatePackageInRegistryStore

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

457da7d1e33bb1a2e341082d937b0061

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processsecurity-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

oleaut32

Exports

Exports

Sections

.text Size: 122KB - Virtual size: 121KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 122KB - Virtual size: 121KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB