SearchFolder[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SearchFolder.dll
Size

316KB
MD5

88240d742c8a243610f1a776c5b12845
SHA1

c95a4add8655bdb29ba12900884503ce3ae2124a
SHA256

892ff1a4470588c43ed914d1e09feff32ff6ae7c484b230be890d1f881d3e99e
SHA512

5f0433c53e71e161de43bd79176505253c2b2938dd341c59ce799fa146c255209b683c06d6d4813a679838e5eee2c5f2e3d0d002b44c60d32338b074697b8f0c
SSDEEP

6144:N75ISTnzdhnI6X1A1WLu+ZmZB66GJqls5SCmekP:/ISTnZhnPFu+m66GIje

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SearchFolder.dll

Files

SearchFolder.dll
.dll regsvr32 windows:10 windows x86 arch:x86

f6b362a99dd143f103db138ee65bd372

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SearchFolder.pdb

Imports

msvcrt

_initterm
malloc
free
_amsg_exit
_XcptFilter
wcschr
_get_errno
_wtoi
memmove_s
_ftol2_sse
_unlock
memcmp
__dllonexit
_onexit
__CxxFrameHandler3
_lock
_set_errno
wcsncmp
memcpy_s
_vsnwprintf
_except_handler4_common
memmove
memcpy
memset

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW
SHStrDupA

api-ms-win-shcore-unicodeansi-l1-1-0

SHUnicodeToAnsi
SHAnsiToUnicode

api-ms-win-shcore-comhelpers-l1-1-0

IUnknown_SetSite
IUnknown_QueryService
IUnknown_Set

api-ms-win-shcore-registry-l1-1-1

SHRegGetValueFromHKCUHKLM

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream
SHCreateStreamOnFileEx
IStream_Read
IStream_Size
IStream_Write
IStream_Reset

api-ms-win-shcore-registry-l1-1-0

SHRegGetValueW
SHQueryValueExW

shcore

ord200
ord143
ord193
ord130
ord123
ord190
ord142
ord150

shell32

ord895
ord824
ord51
SHEvaluateSystemCommandTemplate
SHGetNameFromIDList
SHGetKnownFolderIDList
SHGetKnownFolderItem
ord21
SHCreateItemFromParsingName
SHCreateShellItemArrayFromShellItem
ord880
SHCreateItemWithParent
ord152
SHBindToParent
ord256
SHCreateDefaultContextMenu
AssocCreateForClasses
ord702
ord898
SHChangeNotify
SHBindToFolderIDListParent
ord171
ord75
ord241
SHGetSpecialFolderLocation
ord866
ord6
SHParseDisplayName
SHCreateShellItemArrayFromIDLists
ord16
ord155
ord18
ord19
ord25
ord100
SHGetIDListFromObject
SHCreateItemInKnownFolder
SHCreateItemFromIDList
ord102
SHBindToObject
ord850
ord823
ord17
SHBindToFolderIDListParentEx
SHGetKnownFolderPath
Shell_GetCachedImageIndexW

shlwapi

UrlIsW
UrlCompareW
StrStrA
ord156
ord172
PathParseIconLocationW
UrlHashW
ord15
ord152
StrDupW
PathFileExistsW
ord29
ord331
PathMatchSpecW
StrRChrW
PathRemoveFileSpecW
PathRemoveBackslashW
PathIsRootW
PathCreateFromUrlW
UrlEscapeW
ord24
StrCmpNIW
StrCmpW
StrStrNIW
StrToIntA
ord456
PathRemoveExtensionW
ord219
ord158
ord157
PathIsUNCW
StrStrIW
ord2
PathSkipRootW
PathIsURLW
PathFindNextComponentW
PathCompactPathExW
PathFindExtensionW
PathFindFileNameW
ord388
ord164
UrlGetPartW
ord236
StrPBrkW
ord154
PathMatchSpecExW
PathGetArgsW
PathRemoveArgsW
PathQuoteSpacesW
StrCmpIW
PathRemoveBlanksW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FindResourceExW
GetProcAddress
LoadResource
LockResource
DisableThreadLibraryCalls
GetModuleFileNameA
LoadStringW
LoadStringA
SizeofResource
GetModuleHandleExW
GetModuleFileNameW
LoadLibraryExW

api-ms-win-core-synch-l1-1-0

ReleaseMutex
OpenSemaphoreW
CreateSemaphoreExW
AcquireSRWLockShared
AcquireSRWLockExclusive
InitializeCriticalSectionEx
CreateMutexExW
LeaveCriticalSection
ReleaseSRWLockShared
CreateMutexW
WaitForSingleObject
WaitForSingleObjectEx
EnterCriticalSection
ReleaseSRWLockExclusive
DeleteCriticalSection
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoCreateFreeThreadedMarshaler
PropVariantCopy
CoTaskMemFree
CoGetMalloc
StringFromGUID2
CreateStreamOnHGlobal
GetHGlobalFromStream
PropVariantClear
CoTaskMemAlloc
CoTaskMemRealloc

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
IsDBCSLeadByteEx
FindNLSStringEx
LCMapStringEx
LCMapStringW
IsDBCSLeadByte
GetSystemDefaultLCID
LocaleNameToLCID
ResolveLocaleName
GetSystemPreferredUILanguages
FindNLSString

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegCloseKey
RegQueryInfoKeyW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
GetTickCount64
GetLocalTime
GetSystemTime

ntdll

EtwEventWrite
EtwEventActivityIdControl
EtwEventRegister
EtwEventUnregister
EtwEventWriteTransfer
EtwEventSetInformation
EtwEventEnabled

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

RegisterClipboardFormatW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalSize
GlobalUnlock

api-ms-win-rtcore-ntuser-window-l1-1-0

SendMessageW
GetCursorPos
GetWindowRect

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrlenA
lstrcmpiA
lstrcmpW
lstrlenW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-path-l1-1-0

PathCchCombine
PathCchAppend
PathCchRemoveFileSpec

api-ms-win-winrt-search-folder-l1-1-0

SHCreateScopeFromIDListsEx
SHCreateTransientVFolderIDList
SHCreateScopeFromShellItemArray
CreateDefaultProviderResolver
GetScopeFolderType
SHCreateScopeItemFromKnownFolder
SHCreateScopeItemFromShellItem
GetGatherAdmin
IsMSSearchEnabled
SHCreateScopeItemFromIDList
SHCreateAutoListWithID
SEARCH_WriteAutoListContents
SHCreateScope
CreateSingleVisibleInList
SEARCH_RemoteLocationsCscStateCache_IsRemoteLocationInCsc
SHCreateSearchIDListFromAutoList
SHCreateAutoList
CreateResultSetFactory

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-string-l2-1-0

CharLowerW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-sidebyside-l1-1-0

CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-localization-ansi-l1-1-0

GetStringTypeExA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AppendHiddenSearchContext
CDBFolderUI_CreateInstance
CSearchDelegateFolderUI_CreateInstance
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetAggregateQueryError
s_GetStartMenuFilesScope

Sections

.text
Size: 269KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6b362a99dd143f103db138ee65bd372

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-shcore-unicodeansi-l1-1-0

api-ms-win-shcore-comhelpers-l1-1-0

api-ms-win-shcore-registry-l1-1-1

api-ms-win-shcore-stream-l1-1-0

api-ms-win-shcore-registry-l1-1-0

shcore

shell32

shlwapi

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ntdll

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-path-l1-1-0

api-ms-win-winrt-search-folder-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-localization-ansi-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 269KB - Virtual size: 268KB

.data Size: 1KB - Virtual size: 3KB

.idata Size: 10KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 420B

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 269KB - Virtual size: 268KB

.data
Size: 1KB - Virtual size: 3KB

.idata
Size: 10KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 420B

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 16KB - Virtual size: 16KB