MicrosoftAccountWAMExtension[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MicrosoftAccountWAMExtension.dll
Size

373KB
MD5

9f9748f2d3941aa09afe753f3e96a8de
SHA1

ea394e4ef6fcea7c1ac02433b34eab4ac42674e3
SHA256

49d71cb1d0a1e262f1f6ff499e1b57a5c0621e5351f15614234f658bc41ea469
SHA512

844a663e64c549a29cc6cbcbe88830f825fcb28a7379354854f032759352b923b4820440a52a64b2d4b4eb22459ca56bbf94de7b9e1de65d65664bf7700d0982
SSDEEP

6144:zB8JkpSlnjL4PrrbVW5KxaJ/hIr0I0PEATkjDF+VMmvSe6Vfk3I:zeGpSljL4jk56aJZIr0IgEsUDWd4k3I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MicrosoftAccountWAMExtension.dll

Files

MicrosoftAccountWAMExtension.dll
.dll windows:10 windows x86 arch:x86

97ce68f1b31cfde4c251d367605ae254

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MicrosoftAccountWAMExtension.pdb

Imports

msvcrt

_amsg_exit
free
_initterm
?terminate@@YAXXZ
_ftol2
?what@exception@@UBEPBDXZ
_ftol2_sse
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
memmove
memcpy
_lock
_XcptFilter
_unlock
__dllonexit
_onexit
_except_handler4_common
memcmp
memmove_s
_vsnwprintf_s
??_V@YAXPAX@Z
_wcsicmp
realloc
_wcsnicmp
swprintf_s
_CxxThrowException
_callnewh
malloc
__CxxFrameHandler3
_purecall
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
??1type_info@@UAE@XZ
memset

combase

ord16
ord9
ord8
ord7
ord11
ord2
ord147
CStdStubBuffer2_Connect
ord13
ord10
CStdStubBuffer2_CountRefs
ord15
ord17
ord14
CStdStubBuffer2_Disconnect
ord6
ord12
ord32
ord5
CStdStubBuffer2_QueryInterface
ord33
ord34

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadResource
DisableThreadLibraryCalls
SizeofResource
GetModuleHandleExW
FindResourceExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ReleaseSemaphore
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
ReleaseSRWLockShared
WaitForSingleObject
CreateSemaphoreExW
AcquireSRWLockShared
AcquireSRWLockExclusive
EnterCriticalSection
WaitForMultipleObjectsEx
ReleaseMutex
WaitForSingleObjectEx
CreateMutexExW
CreateEventW
OpenSemaphoreW
InitializeSRWLock
CreateEventExW
SetEvent

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapSize
HeapFree
HeapReAlloc
HeapDestroy
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
OpenProcessToken
SetThreadToken
OpenThreadToken
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventActivityIdControl
EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegEnumValueW
RegGetValueW
RegOpenCurrentUser
RegDeleteTreeW
RegEnumKeyExW
RegDeleteValueW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

ntdll

RtlNtStatusToDosError
NtSetSecurityObject
NtQuerySecurityObject
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
RtlAddAce
RtlGetAce
RtlCreateAcl
RtlLengthSid
RtlQueryInformationAcl
RtlGetDaclSecurityDescriptor
RtlCreateSecurityDescriptor

api-ms-win-shcore-stream-winrt-l1-1-0

CreateRandomAccessStreamOnFile

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 343KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97ce68f1b31cfde4c251d367605ae254

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

combase

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-service-winsvc-l1-1-0

ntdll

api-ms-win-shcore-stream-winrt-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 343KB - Virtual size: 343KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 452B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 343KB - Virtual size: 343KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 452B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 19KB