Search[.]ProtocolHandler[.]MAPI2[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Search.ProtocolHandler.MAPI2.dll
Size

280KB
MD5

b4342ca6560a30c2ac581c5dff066cd8
SHA1

7b219366b56a1c3149f58e514c25417820813050
SHA256

d37a5df54e38c3de8b7e22edc2fad99e5ef52048695632e1adbe1189d847ae68
SHA512

bf50763200251a9ec29d7ab353f75c441c0f4a064b801e88088d271a3416225f0d96039c3aa6ee4d9bb39163dd7cdfc4a2ec613c1c47c95a15f6797331e4616d
SSDEEP

6144:TP6PQsVH890voA4BpMhoYF3VPfnAtKtVtkVG2/WUoBhz1Li04odGaH8Mu63gZBx9:TEgD+RVPhUoBhz1L98Mu6kd6yT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Search.ProtocolHandler.MAPI2.dll

Files

Search.ProtocolHandler.MAPI2.dll
.dll regsvr32 windows:10 windows x86 arch:x86

cec6a18c8cc0cca1ac1647f8a207e2f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Search.ProtocolHandler.MAPI2.pdb

Imports

msvcrt

realloc
_errno
memcpy
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
memcmp
_unlock
_lock
?terminate@@YAXXZ
_initterm
_ftol2
_amsg_exit
__CxxFrameHandler3
_XcptFilter
_CxxThrowException
calloc
_wcsupr
_wcsupr_s
_wtoi
wcstoul
_wcsnicmp
wcsncmp
iswspace
iswdigit
wcsrchr
wcschr
wcsstr
memmove_s
_wtol
vswprintf_s
_vscwprintf
_wcsicmp
_purecall
wcscat_s
_ltow
wcsncpy_s
toupper
wcscpy_s
bsearch
strrchr
_localtime64
free
malloc
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_time64
??1exception@@UAE@XZ
memmove
memcpy_s
_vsnwprintf
wcsftime
wctomb
_vsnprintf
_mktime64
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
LockResource
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameW
FreeLibrary
FindResourceExW
LoadLibraryExW
LoadResource
SizeofResource
GetModuleFileNameA
LoadStringW

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
ReleaseMutex
CreateMutexExW
CreateEventW
OpenMutexW
WaitForSingleObject
SetEvent
ReleaseSRWLockExclusive
ReleaseSemaphore
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
CreateSemaphoreExW
LeaveCriticalSection
OpenSemaphoreW
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapDestroy
HeapAlloc
HeapSize
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

SetPriorityClass
GetCurrentProcessId
CreateThread
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
OpenProcessToken

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoW
IsValidCodePage
GetSystemDefaultLCID

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

oleaut32

VarUI4FromStr
SysStringLen
VariantInit
VariantClear
SysFreeString
SysAllocString

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegGetValueW
RegDeleteKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegDeleteValueW
RegQueryValueExW

api-ms-win-core-string-l2-1-0

CharNextW

ntdll

RtlGetPersistedStateLocation
RtlIsStateSeparationEnabled
EtwEventWriteTransfer
EtwEventUnregister
EtwEventRegister
RtlNtStatusToDosError

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
GlobalFree
GlobalAlloc

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNIA
StrCmpNIW

api-ms-win-core-com-l2-1-1

StgOpenStorageOnILockBytes

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
SearchPathW

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage
GetUserDefaultUILanguage

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
InitOnceExecuteOnce
Sleep
WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

tquery

ciNewNoThrow
ciDelete

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventProviderEnabled
EventRegister
EventWriteTransfer

api-ms-win-rtcore-ntuser-window-l1-1-0

TranslateMessage
PeekMessageW
DispatchMessageW

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjects

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-core-file-l1-1-0

FlushFileBuffers
FindNextFileW
WriteFile
FindClose
CreateFileW
DeleteFileW
FileTimeToLocalFileTime
GetFileSize
FindFirstFileW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 247KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cec6a18c8cc0cca1ac1647f8a207e2f8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-string-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l2-1-0

ntdll

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-com-l2-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

tquery

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 247KB - Virtual size: 246KB

.data Size: 7KB - Virtual size: 8KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 172B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 247KB - Virtual size: 246KB

.data
Size: 7KB - Virtual size: 8KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 172B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 14KB