ProximityCommon[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ProximityCommon.dll
Size

118KB
MD5

20080c0cdd1dc38839735da025f09769
SHA1

34e1d260f1a938fd69ee3adeb8716239c8ded278
SHA256

bb3aecccc6161e261c4b155435cef8a7d7d7b620b756246bd2e941d13f86146b
SHA512

0939d00a24fd489fc919a138b727bd4a50b2d64bb0a9b807c663ec58eb9f35c54fd994812b2778d7dce8b2791e14937626c6ad498f57856fd3d2af40ae5917c8
SSDEEP

3072:CJDUzxUzTGXr8npXH+Tj4aS3NN+sWxRSOf5SzkEsarXQFmgaZy5kDcWf:CJ4zxUzTGX4npXH+H4aS3NN+sWxRSOfg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ProximityCommon.dll

Files

ProximityCommon.dll
.dll windows:10 windows x86 arch:x86

6e5e8e250da50b1333e5c8bd0e3a9a78

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ProximityCommon.pdb

Imports

msvcrt

__dllonexit
_unlock
_vsnwprintf
_onexit
memcmp
free
_lock
_except_handler4_common
_callnewh
_initterm
malloc
_amsg_exit
_XcptFilter
memset

rpcrt4

CStdStubBuffer_DebugServerQueryInterface
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
CStdStubBuffer_Invoke
NdrDllCanUnloadNow
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_IsIIDSupported
NdrCStdStubBuffer_Release
NdrStubCall2
IUnknown_AddRef_Proxy
CStdStubBuffer_Connect
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrStubForwardingFunction
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-com-l1-1-0

CoGetMalloc
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoSetProxyBlanket
CoGetClassObject
CLSIDFromString
CoInitializeEx
CoTaskMemFree

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
TraceMessage
GetTraceEnableLevel
RegisterTraceGuidsW
GetTraceEnableFlags
UnregisterTraceGuids

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister

api-ms-win-core-processthreads-l1-1-0

TlsAlloc
GetCurrentProcessId
TlsSetValue
TerminateProcess
TlsGetValue
TlsFree
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW

proximitycommonpal

PAL_RegisterAppSuspendResumeCallback
PAL_GetSupportedBrowseTypes
PAL_GetAppPlatformQualifier
PAL_FreeTransientObjectSecurityAttribute
PAL_QueryTransientObjectSecurityAttribute
PAL_UnregisterAppSuspendResumeCallback

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetEvent
InitializeCriticalSectionEx
CreateEventW
WaitForSingleObject

ws2_32

shutdown
WSACreateEvent
WSACloseEvent
WSAGetLastError
send
recv
WSASetEvent
WSAIoctl
WSARecv
WSAWaitForMultipleEvents
WSAGetOverlappedResult
WSAStartup
getsockname
bind
socket
connect
setsockopt
listen
WSACleanup
closesocket

api-ms-win-core-threadpool-l1-2-0

CancelThreadpoolIo
StartThreadpoolIo
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
CreateThreadpoolIo
CloseThreadpoolWork
CallbackMayRunLong
SubmitThreadpoolWork
CreateThreadpoolWait
WaitForThreadpoolWorkCallbacks
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolWork

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch

devobj

DevObjDestroyDeviceInfoList
DevObjEnumDeviceInterfaces
DevObjGetClassDevs
DevObjCreateDeviceInfoList
DevObjGetDeviceInterfaceProperty
DevObjGetDeviceInterfaceDetail
DevObjGetDeviceProperty
DevObjOpenDeviceInterface

api-ms-win-devices-query-l1-1-0

DevCloseObjectQuery
DevCreateObjectQuery

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-devices-config-l1-1-1

CM_Unregister_Notification
CM_Register_Notification

api-ms-win-core-io-l1-1-0

CancelIoEx
DeviceIoControl
GetOverlappedResult

iphlpapi

GetUnicastIpAddressTable
NotifyUnicastIpAddressChange
CancelMibChangeNotify2

mswsock

GetAcceptExSockaddrs
AcceptEx

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient17
NdrProxyForwardingFunction5
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
NdrProxyForwardingFunction4
ObjectStublessClient5
ObjectStublessClient20
ObjectStublessClient22
ObjectStublessClient16
ObjectStublessClient4
ObjectStublessClient6
ObjectStublessClient15
NdrProxyForwardingFunction3
ObjectStublessClient23
ObjectStublessClient24
ObjectStublessClient21
ObjectStublessClient8
ObjectStublessClient7
CStdStubBuffer2_Connect
ObjectStublessClient12
ObjectStublessClient3
ObjectStublessClient14
CStdStubBuffer2_CountRefs
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient9
CStdStubBuffer2_Disconnect
ObjectStublessClient18
ObjectStublessClient13

api-ms-win-core-winrt-string-l1-1-0

HSTRING_UserFree
HSTRING_UserUnmarshal
HSTRING_UserMarshal
HSTRING_UserSize

Exports

Exports

DllCanUnloadNow
DllGetClassObject
GetProxyDllInfo

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e5e8e250da50b1333e5c8bd0e3a9a78

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

proximitycommonpal

api-ms-win-core-synch-l1-1-0

ws2_32

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

devobj

api-ms-win-devices-query-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-io-l1-1-0

iphlpapi

mswsock

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 91KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 7KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 92KB - Virtual size: 91KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 9KB - Virtual size: 8KB