apprepsync[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

apprepsync.dll
Size

166KB
MD5

da9936c771cd25a34977197f396aeca9
SHA1

97601bab81035e8d3ac1fbe223654d51a0cfdb8d
SHA256

95178dc487daeccc7be3a3258e57514d9c2e4488d478b3878fde45e8a251e9a3
SHA512

3c301da5dd27f3352b453ad8db5014e306bf150b1d5ca8091e7e18ce896c96fd93a3079b4897242b1a035572ec12a7584c78c810c49618252b4c2f62decccfde
SSDEEP

3072:MZYNoAyEZwiDA9r6du0RSqhSuYphmSYu0BOgPVlHZ1SvgfN3+lYlnHfg2yWnN4IQ:MYOmyilXT+lYlnHfg2Rn6Ih0L/J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
apprepsync.dll

Files

apprepsync.dll
.dll regsvr32 windows:6 windows x64 arch:x64

fb56e4ac82d2cf017916c95f14f2f1f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

AppRepSync.pdb

Imports

msvcrt

_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
memset
wcsstr
iswspace
_wcsdup
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
__CxxFrameHandler3
memcpy
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
malloc
??0exception@@QEAA@AEBQEBDH@Z
memmove_s
memcpy_s
free
_vscwprintf
vswprintf_s
_wcslwr_s
wcsrchr
rand
srand
wcsspn
wcscspn
time
_wtoi
_wtof
_create_locale
localeconv
_vsnwprintf_l
_wcsupr_s
_free_locale
_ultow_s
wprintf
wcscmp

ntdll

RtlAllocateHeap
RtlFreeHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
RaiseException
GetFileSizeEx
GetSystemTime
GetVersionExW
SystemTimeToFileTime
DebugBreak
ReleaseMutex
OpenMutexW
CreateMutexW
GetDriveTypeW
SetFilePointer
FindResourceExW
FreeLibrary
LoadResource
GetModuleHandleExW
WaitForSingleObject
SizeofResource
InitOnceExecuteOnce
FreeLibraryAndExitThread
GetLastError
DisableThreadLibraryCalls
LockResource
CloseHandle
ResumeThread
CreateThread
GetFileSize
FindFirstFileW
ReadFile
CreateFileW
MoveFileW
FindClose
FindNextFileW
GetFileTime
DeleteFileW
GetUserDefaultLocaleName

user32

UnregisterClassA

advapi32

RegSetValueExW
EventWrite
RegDeleteKeyExW
RegCreateKeyW
RegQueryValueExW
RegOpenKeyW
RegOpenKeyExW
GetTokenInformation
RegCloseKey

shell32

SHGetFolderPathW

api-ms-win-core-processthreads-l1-1-2

OpenProcessToken

apprepapi

AppRepComputeImageHash
AppRepParameterCleanup
AppRepInitializeAttributeLib
AppRepComputeSignatureInfo
RepGetFileInformation

bcrypt

BCryptHashData
BCryptDestroyHash
BCryptCreateHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider

crypt32

CryptFindOIDInfo

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

tbs

GetDeviceIDString

ole32

StringFromGUID2
CoCreateGuid
IIDFromString

wininet

InternetQueryDataAvailable
InternetCloseHandle
InternetOpenW
HttpEndRequestW
HttpOpenRequestW
InternetCrackUrlW
InternetReadFile
InternetSetOptionW
InternetConnectW
HttpSendRequestExW

webservices

WsGetErrorString
WsFreeReader
WsFreeWriter
WsCreateError
WsCreateWriter
WsSetInput
WsWriteEndAttribute
WsWriteStartElement
WsCreateReader
WsGetReaderNode
WsSetOutput
WsWriteType
WsWriteChars
WsWriteEndElement
WsGetErrorProperty
WsReadNode
WsWriteStartAttribute
WsGetWriterProperty
WsFreeError

netapi32

NetGetJoinInformation
NetApiBufferFree

shlwapi

PathStripToRootW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb56e4ac82d2cf017916c95f14f2f1f9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

user32

advapi32

shell32

api-ms-win-core-processthreads-l1-1-2

apprepapi

bcrypt

crypt32

wintrust

tbs

ole32

wininet

webservices

netapi32

shlwapi

Exports

Exports

Sections

.text Size: 152KB - Virtual size: 152KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 3KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 276B

.text
Size: 152KB - Virtual size: 152KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 3KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 276B