MbaeApi[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

MbaeApi.dll
Size

721KB
MD5

63f9a907a701306b37ee74ee7cf81a33
SHA1

882a1493292ea68a66bf71b705c4fc6f0965d8ce
SHA256

509fb04663e4c54dbd5eef1f43c875fbb9c67c9fbc8164371b38b7f27eae3347
SHA512

1d5fdbac00fa43af8b098e502fef26c43e9a08a6cba44d36acf9fd4708a07cea70998c60dc505f566a878b7f1baf5da7b95c1c8c47bd37317f3553d9054a0388
SSDEEP

12288:QzWqtTWfM020OGRE+oIP07Lh5kqnKiu28mhdFlwN1aib5kO5GBQGAWBV7Eg1nyFj:QiqDxBm3GBX12jSRTFLYSWYBz56lQOcj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MbaeApi.dll

Files

MbaeApi.dll
.dll regsvr32 windows:10 windows x86 arch:x86

3afb1b62d2d600e4f0edf95fa39b1653

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MbaeApi.pdb

Imports

msvcrt

_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
calloc
memmove_s
__dllonexit
_onexit
_errno
realloc
wcscat_s
??1type_info@@UAE@XZ
wcscpy_s
memmove
memcpy
_purecall
_except_handler4_common
??3@YAXPAX@Z
?what@exception@@UBEPBDXZ
memcmp
_wtoi
_wcsicmp
wcsrchr
toupper
free
malloc
wcsncpy_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
iswdigit
_get_errno
??0exception@@QAE@XZ
_set_errno
swprintf_s
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
_unlock
_wcsnicmp
isalpha
??0exception@@QAE@ABQBD@Z
??_V@YAXPAX@Z
__CxxFrameHandler3
_swprintf_c_l
memset

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
GetModuleHandleW
LoadResource
GetProcAddress
LoadLibraryExW
LockResource
GetModuleHandleExW
SizeofResource
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateEventW
CreateSemaphoreExW
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
InitializeCriticalSectionEx
CreateEventExW
OpenMutexW
WaitForSingleObjectEx
ResetEvent
CreateMutexExW
DeleteCriticalSection
InitializeSRWLock
InitializeCriticalSection
OpenSemaphoreW
EnterCriticalSection
LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
OpenProcessToken
CreateThread
GetCurrentThreadId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetThreadLocale
SetThreadLocale

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysAllocStringByteLen
LoadTypeLi
SysAllocString
UnRegisterTypeLi
VARIANT_UserMarshal
BSTR_UserSize
BSTR_UserUnmarshal
SysStringByteLen
SysAllocStringLen
SysFreeString
VarUI4FromStr
VariantChangeType
SysStringLen
BSTR_UserFree
VARIANT_UserUnmarshal
SysReAllocStringLen
VARIANT_UserSize
SafeArrayDestroy
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VARIANT_UserFree
VariantClear
RegisterTypeLi
VarBstrCat
BSTR_UserMarshal
VariantInit

rpcrt4

UuidFromStringW
IUnknown_AddRef_Proxy
RpcBindingBind
RpcBindingCreateW
RpcBindingFree
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
CStdStubBuffer_QueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrClientCall4
NdrOleAllocate
CStdStubBuffer_CountRefs
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient5
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient10
ObjectStublessClient4

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CLSIDFromString
CoTaskMemFree
StringFromIID
CoWaitForMultipleHandles
StringFromGUID2
IIDFromString
CoGetMalloc
CoCreateInstance
CoTaskMemRealloc

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegDeleteTreeW
RegGetValueW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CloseThreadpool
SubmitThreadpoolWork
SetThreadpoolThreadMinimum
CreateThreadpool
SetThreadpoolThreadMaximum
CreateThreadpoolWork

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventProviderEnabled
EventWriteTransfer

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

ntdll

RtlIpv6StringToAddressW
NtQueryKey
RtlIpv4StringToAddressW
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
WinSqmIncrementDWORD
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlAllocateWnfSerializationGroup
RtlUnsubscribeWnfNotificationWaitForCompletion

mobilenetworking

GetPersistentRegPath

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoGetActivationFactory
RoInitialize

api-ms-win-service-management-l1-1-0

OpenServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

crypt32

CryptUnprotectData
CryptProtectData

api-ms-win-core-file-l1-1-0

GetFullPathNameW

bcrypt

BCryptHashData
BCryptFinishHash
BCryptCreateHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptOpenAlgorithmProvider

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsCreateString
WindowsDeleteString

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-service-private-l1-1-0

SubscribeServiceChangeNotifications
UnsubscribeServiceChangeNotifications

api-ms-win-security-accesshlpr-l1-1-0

FreeTransientObjectSecurityDescriptor
QueryTransientObjectSecurityDescriptor

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 596KB - Virtual size: 595KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3afb1b62d2d600e4f0edf95fa39b1653

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ntdll

mobilenetworking

api-ms-win-core-winrt-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

crypt32

api-ms-win-core-file-l1-1-0

bcrypt

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-security-accesshlpr-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 596KB - Virtual size: 595KB

.data Size: 10KB - Virtual size: 13KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 288B

.rsrc Size: 73KB - Virtual size: 73KB

.reloc Size: 30KB - Virtual size: 30KB

.text
Size: 596KB - Virtual size: 595KB

.data
Size: 10KB - Virtual size: 13KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 288B

.rsrc
Size: 73KB - Virtual size: 73KB

.reloc
Size: 30KB - Virtual size: 30KB