SyncController[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SyncController.dll
Size

465KB
MD5

4656548594c8083274d3c4d8ed8f121b
SHA1

c2b089456d5fe0122cd88500b80b05810da225d3
SHA256

cc57dab248a1346e86ff95da76b636a7fbf7002247c6eef09f642b90e62a8c2d
SHA512

d3ac843095493ede87402c936215956a9c88e4def1c07afd840494536804d9583de3e9741194e15c63e27d4f5fab005d4cf157269f1a77d7784b3a7e8fc42b84
SSDEEP

12288:ZJDTLKadieoyKFajb1xZq84fn7OHOoFDsMT0KAgUuAxMm:7uadieoyKFajb1i84fn7OHOoFDsMT0KN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SyncController.dll

Files

SyncController.dll
.dll windows:10 windows x86 arch:x86

81e9102f5fa5cf1e7af10bcab969984b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SyncController.pdb

Imports

msvcrt

_ftol2
wcsstr
_vsnwprintf
memcpy_s
_purecall
free
malloc
_callnewh
__CxxFrameHandler3
_wcsicmp
wcschr
_wcsnicmp
ceil
memcmp
memcpy
memmove
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
wcscpy_s
_strnicmp
memset

ntdll

NtDeleteWnfStateName
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
NtCreateWnfStateName
RtlPublishWnfStateData
RtlReportException
RtlCaptureContext
RtlNtStatusToDosError

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
FindResourceExW
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
LockResource
GetModuleHandleExW
SizeofResource
LoadResource

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
InitializeCriticalSectionEx
EnterCriticalSection
DeleteCriticalSection
OpenSemaphoreW
LeaveCriticalSection
WaitForSingleObjectEx
CreateEventW
ReleaseSemaphore
CreateMutexExW
SetEvent
ReleaseSRWLockShared
ReleaseSRWLockExclusive
ReleaseMutex
InitializeSRWLock
CreateSemaphoreExW
InitializeCriticalSection
AcquireSRWLockShared
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
OpenProcessToken
TerminateProcess
GetCurrentThreadId
GetCurrentThread
SetThreadPriority
GetCurrentProcessId
GetThreadPriority

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

oleaut32

SysFreeString
SafeArrayGetDim
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree
BSTR_UserSize
SafeArrayDestroy
SafeArrayCreate
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayUnlock
VariantChangeType
SysAllocString
SysStringLen
SafeArrayGetElemsize
SysAllocStringLen
VariantInit
VariantClear

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventActivityIdControl
EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-com-l1-1-0

StringFromCLSID
CoUninitialize
CoInitializeEx
CoCreateGuid
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CLSIDFromString
CoFreeUnusedLibrariesEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
GetTickCount64

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegCreateKeyExW
RegCloseKey
RegEnumValueW
RegDeleteTreeW
RegSetValueExW
RegFlushKey
RegEnumKeyExW
RegGetValueW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

rpcrt4

RpcStringFreeW
RpcServerInqDefaultPrincNameW
RpcServerUseProtseqW
RpcEpRegisterW
RpcServerInqBindings
RpcBindingVectorFree
RpcEpUnregister
RpcServerUnregisterIfEx
RpcServerInterfaceGroupClose
RpcServerUnregisterIf
I_RpcBindingInqLocalClientPID
RpcServerRegisterIf3
NdrServerCall2
RpcServerRegisterAuthInfoW

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

pimstore

GetAppointmentFromUniqueId
GetAppointmentUniqueId
GetPartnerGUID
?SubmitSynchronously@AccountProviderHostJobBase@@QAEJPAXKPAT_SNJobOutParams@@@Z
?Submit@AccountProviderHostJobBase@@QAEJPAK@Z
POutlookAppManager_CreateInstance

syncutil

IsPwdSaved
DeletePwd
WritePasswordForPartnership
ord109
ord37
ord36
GetGoldenPartnershipId
ord288
ord290
UpdateYahooAccountType
ord27
ord10
ord26
ord475
WaitForSignalOrShutdown
ord511
IsFirstSyncEver
ord44
ord510
CreateDataStoreLock
InitializeCredVault
GetSyncWorkOnBehalfTicket
SetSyncWorkOnBehalfTicket
CloseDataStoreLock
GetCurrentSyncStats
AcquireDataStoreLock
ReleaseDataStoreLock
GetGalSearchResultsFolderAndPartnerGuidEx
ord29
ord506
ord504
TryGetDefaultSignInAccountInfo
RegisterSsoAccountsCallback
ord30
ord23
ord24
ord299
GetDefaultMsaWebAccountId
ord720
ord87
ord721
ord722
CredVaultWrite
IsScreenOn
ord31
DoesServerSupportAutoMoveSentItem
GetBatterySaverWnfName
SetMonitorDisplayState
ord21
ord61
DeleteOAuthRefreshTokenForPartnership
ord111
ord257
ord9
IsACOn
ord291
CredVaultRead
ord39
ord363
ord307
ord118
ord122
ord241
SetBatterySaverWnfName
ord271
ord270
ord705
HasNeverSyncedSuccessfully
ord255
ord275
ord274
ord283
ord277
ord281
ord38
ord48
ord52
ord451
ord56
ord14
ord49
ord242
ord50
ord13
GetWebAccountId
GetWebAccountProviderFromProviderId
ord272
VerifyDataStoreLockOwner
WaitForServerReady
ord441
ord51
ord742
LoadHeartbeatValues

aphostclient

CreateAPHostClient

accountaccessor

UpdateGoogleAccountConversationFlags
UpdateWebDavAccountProperties
UpdateGoogleAccountServerSendsMeetingProp
FindMatchingPartnership
LoadGoldenPartnershipAccessor

dsclient

DSOpenSharedFile

mccspal

ord15
ord14
ord12
ord10
ord27
ord9
ord13
ord11

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait
SubmitThreadpoolWork
SetThreadpoolWait
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

api-ms-win-power-base-l1-1-0

PowerRegisterSuspendResumeNotification
PowerUnregisterSuspendResumeNotification

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

systemeventsbrokerclient

SebEnumerateEventsByType
SebQueryEventPackage

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

userdatalanguageutil

UninitializeLanguageUtil
InitializeLanguageUtil

Exports

Exports

AccountsMgmtAdviseAccount
AccountsMgmtConvertWebAccountIdFromAppSpecificId
AccountsMgmtConvertWebAccountIdToAppSpecificId
AccountsMgmtCreateAccount
AccountsMgmtDeleteAccount
AccountsMgmtDiscoverExchangeServerConfig
AccountsMgmtEnumAccounts
AccountsMgmtGetNotifications
AccountsMgmtMayIgnoreInvalidServerCertificate
AccountsMgmtQueryAccountProperties
AccountsMgmtSaveAccountProperties
AccountsMgmtSyncAccount
AccountsMgmtSyncAccountAndWaitForCompletion
AccountsMgmtUnadviseAccount
AccountsMgmtVerifyExchangeMailBoxTokenAuth
DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81e9102f5fa5cf1e7af10bcab969984b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

rpcrt4

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l2-1-0

pimstore

syncutil

aphostclient

accountaccessor

dsclient

mccspal

api-ms-win-core-threadpool-l1-2-0

api-ms-win-power-setting-l1-1-0

api-ms-win-power-base-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

systemeventsbrokerclient

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

userdatalanguageutil

Exports

Exports

Sections

.text Size: 412KB - Virtual size: 411KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 332B

.rsrc Size: 17KB - Virtual size: 16KB

.reloc Size: 24KB - Virtual size: 24KB

.text
Size: 412KB - Virtual size: 411KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 332B

.rsrc
Size: 17KB - Virtual size: 16KB

.reloc
Size: 24KB - Virtual size: 24KB