StorageContextHandler[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

StorageContextHandler.dll
Size

79KB
MD5

6d9b529830132260027a85cc6573704f
SHA1

696684f7e91793509c4eaa272080478460d4b0d1
SHA256

9226f61651f4ff9beb3167cabaf0a980795849cd438395925d070473bcdbabf2
SHA512

b4b8a8207dc86f399f3cdc9357bdfef9eacaede80e035efed22621eae6fc4922d3f923517165dd37bac4bf8ce501937b718b4a3ccf1966f5915dfdec4ba09ece
SSDEEP

1536:u9XwMwQIOU8pnhWv59WATXk7ssysuzftI1iRK2pnAPWHaNqmOHWt44LPr:QtIX8h2eATXkAsysU+0RK2pnAPuZmYwd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
StorageContextHandler.dll

Files

StorageContextHandler.dll
.dll regsvr32 windows:10 windows x86 arch:x86

a20327a05fe05446f5d86ab1d25dcb5a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

StorageContextHandler.pdb

Imports

msvcrt

_amsg_exit
realloc
_initterm
_onexit
_XcptFilter
?terminate@@YAXXZ
__CxxFrameHandler3
_callnewh
_ftol2
calloc
_errno
_lock
__dllonexit
_CxxThrowException
_unlock
_except_handler4_common
memmove_s
_purecall
_wcsupr
iswspace
malloc
wcsncpy_s
wcscat_s
free
wcscpy_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_vsnwprintf
??1type_info@@UAE@XZ
memset

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA
FreeLibrary
LoadStringW
GetModuleFileNameW
GetModuleHandleW
SizeofResource
LoadResource
FindResourceExW
GetProcAddress
DisableThreadLibraryCalls
LockResource

api-ms-win-core-synch-l1-1-0

CreateEventW
WaitForSingleObject
CreateSemaphoreExW
ResetEvent
EnterCriticalSection
ReleaseMutex
DeleteCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
InitializeCriticalSection
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapSize
HeapDestroy

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
SetThreadLocale
GetThreadLocale

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VarUI4FromStr
SysAllocString
VariantClear
VariantInit

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegGetValueW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc
CoGetMalloc
CoCreateInstance
StringFromGUID2
PropVariantClear
CoTaskMemRealloc
CLSIDFromString

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal

api-ms-win-devices-config-l1-1-1

CM_Locate_DevNodeW
CM_Get_Device_Interface_ListW
CM_Get_Device_IDW
CM_Get_Device_Interface_List_SizeW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-file-l1-1-0

GetDriveTypeW
CreateFileW

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrIW
QISearch
StrCmpICW
StrCmpNICW

api-ms-win-shcore-comhelpers-l1-1-0

IUnknown_Set
IUnknown_GetSite
IUnknown_QueryService

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

cfgmgr32

CM_Get_Parent_Ex
CM_Get_DevNode_Registry_Property_ExW
CM_Get_DevNode_Custom_PropertyW

api-ms-win-appmodel-runtime-l1-1-0

GetApplicationUserModelId

api-ms-win-shlwapi-winrt-storage-l1-1-1

ord348
IUnknown_GetWindow

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

api-ms-win-dx-d3dkmt-l1-1-4

D3DKMTGetProcessList
D3DKMTGetProcessDeviceRemovalSupport

ntdll

NtQueryInformationProcess

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-shell-namespace-l1-1-0

SHGetIDListFromObject
SHCreateItemFromParsingName

api-ms-win-devices-query-l1-1-0

DevGetObjects
DevFreeObjects

api-ms-win-dx-d3dkmt-l1-1-0

D3DKMTOpenAdapterFromDeviceName
D3DKMTQueryAdapterInfo

api-ms-win-core-shlwapi-legacy-l1-1-0

PathGetDriveNumberW

setupapi

SetupDiCreateDeviceInfoList
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiGetDevicePropertyW
SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInfoW
SetupDiEnumDeviceInterfaces

shell32

ord100
SHCreateItemInKnownFolder
ShellExecuteExW

user32

UnregisterClassA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a20327a05fe05446f5d86ab1d25dcb5a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-shcore-comhelpers-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

cfgmgr32

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-shlwapi-winrt-storage-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-4

ntdll

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-shell-namespace-l1-1-0

api-ms-win-devices-query-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

setupapi

shell32

user32

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 63KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 7KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 64KB - Virtual size: 63KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB