Windows[.]Data[.]Pdf[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Windows.Data.Pdf.dll
Size

8.5MB
MD5

0e2b153e443cd97f98cf164d5551b6ed
SHA1

e026d628b6bad98956b97819b93a480d66c7fe8e
SHA256

69e8df4161b6b913fe25dadac95f5c5e63eacc66adf7d322caf44a2fe96859c3
SHA512

f4a9e68a14ebc86266d6510c1ac28d19561cdef4f28520ff51797210951ad85367f711a7c6f8650d2e5696f87549582d526dd6635d867c299c9d979b924e40f0
SSDEEP

196608:hKTo04rrJRYMdVLmzLEXhkpRGyqpxvQewIi+Xmq1TKSMdozuR/PU1VYY4:0TD4rrJRYEhqGyqpxvQewIi+Xmq1TKSB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows.Data.Pdf.dll

Files

Windows.Data.Pdf.dll
.dll windows:6 windows x86 arch:x86

cacbce150e9bc579143ca2fdc4d8bd26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Windows.Data.Pdf.pdb

Imports

msvcrt

___lc_collate_cp_func
memchr
tolower
isspace
memcpy_s
_free_locale
_get_current_locale
__crtLCMapStringA
__crtLCMapStringW
__crtCompareStringA
__RTDynamicCast
__crtCompareStringW
_CIsin
??8type_info@@QBEHABV0@@Z
_wcsdup
ldexp
memmove
abort
_CIpow
islower
__uncaught_exception
_initterm
?terminate@@YAXXZ
memcmp
_onexit
calloc
isupper
__pctype_func
??1type_info@@UAE@XZ
_ftol2_sse
_ismbblead
___lc_codepage_func
___lc_handle_func
___mb_cur_max_func
setlocale
_errno
_unlock
_lock
_callnewh
malloc
_CIlog10
_CIlog
_CIfmod
_CIcos
_CIatan2
_CIatan
isalnum
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@XZ
memcpy
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fputc
fgetpos
isdigit
_CIsqrt
_XcptFilter
_amsg_exit
__CxxFrameHandler3
_CxxThrowException
__dllonexit
_ftol2
ceil
_vsnwprintf
strcspn
localeconv
sprintf_s
free
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
??3@YAXPAX@Z
_purecall
??_V@YAXPAX@Z
_except_handler4_common
memset
realloc
_finite
strtod
_set_errno
strtol
strchr
swprintf_s
wcsnlen
wprintf
isalpha
_mktime64
strnlen
_itoa_s
strncmp
rand_s
_ultoa_s
_ui64toa_s
exit
iswupper
isxdigit
_HUGE
qsort
bsearch
__iob_func
fclose
fflush
fgetc
floor

ntdll

WinSqmEndSession
WinSqmAddToStream
WinSqmSetDWORD
WinSqmStartSession

api-ms-win-core-com-l1-1-1

CoSetProxyBlanket
CoCopyProxy
StringFromGUID2
CoTaskMemAlloc
CoMarshalInterface
RoGetAgileReference
CoCreateInstance
CoCreateInstanceFromApp
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoReleaseMarshalData
CreateStreamOnHGlobal
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoUninitialize
CoGetApartmentType
CoTaskMemFree
CoTaskMemRealloc

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadStringW
GetModuleHandleExW
FreeLibrary
FreeLibraryAndExitThread

api-ms-win-core-synch-l1-2-0

SetEvent
LeaveCriticalSection
EnterCriticalSection
InitOnceInitialize
InitializeSRWLock
OpenSemaphoreW
InitializeCriticalSectionEx
InitOnceExecuteOnce
AcquireSRWLockShared
WaitForMultipleObjectsEx
AcquireSRWLockExclusive
ReleaseSRWLockShared
CreateEventExW
ReleaseSemaphore
WaitForSingleObjectEx
WaitForSingleObject
Sleep
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSRWLockExclusive
DeleteCriticalSection

api-ms-win-core-winrt-error-l1-1-1

RoTransformError
RoReportFailedDelegate
SetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-errorhandling-l1-1-1

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWrite

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString
HSTRING_UserFree
HSTRING_UserSize
HSTRING_UserMarshal
HSTRING_UserUnmarshal

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-2

TlsGetValue
GetCurrentProcessId
TlsAlloc
GetCurrentProcess
TerminateProcess
OpenProcessToken
OpenProcess
GetCurrentThreadId
TlsFree
TlsSetValue
IsProcessorFeaturePresent
CreateThread

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
CallbackMayRunLong
TrySubmitThreadpoolCallback
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer

api-ms-win-security-base-l1-2-0

GetTokenInformation

rpcrt4

CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
IUnknown_AddRef_Proxy
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
NdrStubCall2
CStdStubBuffer_CountRefs
NdrOleAllocate
NdrStubForwardingFunction
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
CStdStubBuffer_Invoke
NdrOleFree
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllGetClassObject

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
GetStringTypeExW
CompareStringOrdinal

api-ms-win-core-localization-l1-2-1

FindNLSStringEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernel32

IsNormalizedString
NormalizeString
RaiseFailFastException
CreateSemaphoreW

ole32

ObjectStublessClient6
ObjectStublessClient13
ObjectStublessClient11
NdrProxyForwardingFunction3
ObjectStublessClient7
ObjectStublessClient10
ObjectStublessClient8
ObjectStublessClient17
ObjectStublessClient12
NdrProxyForwardingFunction4
ObjectStublessClient14
ObjectStublessClient3
ObjectStublessClient9
NdrProxyForwardingFunction5
ObjectStublessClient16
ObjectStublessClient15

d2d1

ord5
ord4
ord1
ord2

dwrite

DWriteCreateFactory

d3d11

D3D11CreateDevice

shlwapi

SHGetThreadRef
SHCreateThreadRef
SHSetThreadRef

xmllite

CreateXmlWriter
CreateXmlReader

user32

TranslateMessage
PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjectsEx
PostThreadMessageW

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
PdfCreateRenderer

Sections

.text
Size: 7.8MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 279B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 249KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 435KB - Virtual size: 434KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cacbce150e9bc579143ca2fdc4d8bd26

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-com-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-2-0

rpcrt4

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-profile-l1-1-0

kernel32

ole32

d2d1

dwrite

d3d11

shlwapi

xmllite

user32

api-ms-win-shcore-stream-winrt-l1-1-0

api-ms-win-core-winrt-robuffer-l1-1-0

Exports

Exports

Sections

.text Size: 7.8MB - Virtual size: 7.8MB

.orpc Size: 512B - Virtual size: 279B

.data Size: 249KB - Virtual size: 256KB

.idata Size: 9KB - Virtual size: 8KB

minATL Size: 512B - Virtual size: 20B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 435KB - Virtual size: 434KB

.text
Size: 7.8MB - Virtual size: 7.8MB

.orpc
Size: 512B - Virtual size: 279B

.data
Size: 249KB - Virtual size: 256KB

.idata
Size: 9KB - Virtual size: 8KB

minATL
Size: 512B - Virtual size: 20B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 435KB - Virtual size: 434KB