P2PGraph[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

P2PGraph.dll
Size

348KB
MD5

0e8eb5126fb6206b936099b2d1fbe017
SHA1

b67d43351f307175805dce087e79f7950654cd72
SHA256

fd1b8d2a84432646bfde4b833f01c86da398da06abe1cf4e9a7d70a06e43a0a3
SHA512

027ffcf3f6219879af920f2add7e458b3e72e8e60aac799a1566fb951b83fbb573322098b743ccdd36edcb3f3a4946d9677729c8f5f07c690e9b587126c64487
SSDEEP

6144:v5z9OqbsmCiS6c+EGD9COAYOIA3m2p/YofBDRK2jL0URzVXDnOryJDe:vRQmClGdAYK2OYmBDRK2/n7Org

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
P2PGraph.dll

Files

P2PGraph.dll
.dll windows:10 windows x86 arch:x86

42eb6717070f20c14108d99551a700bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P2PGraph.pdb

Imports

msvcrt

_CIexp
_ftol2
memcmp
memcpy
_wcsicmp
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcscat_s
fread
_dup
_wfopen
fwrite
_fileno
_close
rand
fclose
ferror
_vsnwprintf
_wcsnicmp
iswalnum
_wtoi64
_vsnprintf
swscanf_s
towlower
_purecall
iswprint
memmove
fprintf
_fdopen
__CxxFrameHandler3
ftell
fputc
fopen
memset

ntdll

_errno
strcpy_s
sprintf_s
NtClose
RtlOpenCurrentUser
RtlCreateServiceSid
RtlInitUnicodeString
RtlSetIoCompletionCallback
EtwTraceMessage
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
LoadLibraryExW
FreeLibrary
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

SetEvent
WaitForSingleObject
ResetEvent
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
DeleteCriticalSection
CreateEventW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetErrorMode
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

DuplicateHandle
SetHandleInformation
CloseHandle

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentThread
TerminateProcess
SetThreadToken
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
GetCurrentProcess

api-ms-win-core-file-l1-1-0

GetShortPathNameW
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
GetFileAttributesW
CreateDirectoryW
DeleteFileW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
StringFromCLSID
CLSIDFromString
CoCreateGuid

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-path-l1-1-0

PathCchAppend

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-heap-l1-1-0

HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueue
UnregisterWaitEx
QueueUserWorkItem
DeleteTimerQueueEx

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpW

api-ms-win-security-grouppolicy-l1-1-0

RegisterGPNotificationInternal
UnregisterGPNotificationInternal

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

esent

JetRollback
JetCreateIndex2A
JetUpdate
JetRetrieveColumns
JetBeginSessionA
JetEndSession
JetMakeKey
JetCreateDatabaseW
JetDelete
JetSetSystemParameterA
JetCloseTable
JetTerm2
JetGetTableColumnInfoA
JetSetSystemParameterW
JetSetColumns
JetRestoreInstanceW
JetInit
JetSetColumn
JetTerm
JetCreateTableColumnIndexA
JetSeek
JetSetIndexRange
JetPrepareUpdate
JetAddColumnA
JetCommitTransaction
JetAttachDatabaseW
JetMove
JetRetrieveColumn
JetGetColumnInfoA
JetSetCurrentIndexA
JetOpenTableA
JetBeginTransaction
JetOpenDatabaseW
JetCloseDatabase
JetBackupInstanceW
JetCreateInstanceA

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

PeerGraphAddRecord
PeerGraphClose
PeerGraphCloseDirectConnection
PeerGraphConnect
PeerGraphCreate
PeerGraphDelete
PeerGraphDeleteRecord
PeerGraphEndEnumeration
PeerGraphEnumConnections
PeerGraphEnumNodes
PeerGraphEnumRecords
PeerGraphExportDatabase
PeerGraphForceStopPresencePrivate
PeerGraphFreeData
PeerGraphGetEventData
PeerGraphGetItemCount
PeerGraphGetNextItem
PeerGraphGetNodeInfo
PeerGraphGetProperties
PeerGraphGetRecord
PeerGraphGetStatus
PeerGraphImportDatabase
PeerGraphListen
PeerGraphOpen
PeerGraphOpenDirectConnection
PeerGraphPeerTimeToUniversalTime
PeerGraphRegisterEvent
PeerGraphSearchRecords
PeerGraphSendData
PeerGraphSetNodeAttributes
PeerGraphSetPresence
PeerGraphSetProperties
PeerGraphShutdown
PeerGraphStartup
PeerGraphSuspendTimers
PeerGraphUniversalTimeToPeerTime
PeerGraphUnregisterEvent
PeerGraphUpdateRecord
PeerGraphValidateDeferredRecords
pMemoryHelper

Sections

.text
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42eb6717070f20c14108d99551a700bf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-security-grouppolicy-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

esent

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 315KB - Virtual size: 315KB

.data Size: 6KB - Virtual size: 8KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 200B

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 315KB - Virtual size: 315KB

.data
Size: 6KB - Virtual size: 8KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 200B

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 17KB - Virtual size: 17KB