MbaeApi[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

MbaeApi.dll
Size

496KB
MD5

fed5a22c4b3777c12c66957266c92e90
SHA1

b32e4c2900e3c3cccdd14e2c25885b91f9e6d28f
SHA256

d7b76ca05c9c83af946994adce1b4b29d9eae871f12ea1831a07159ba1a86405
SHA512

662b34408a789f8b295aea52fb40364d3ce0016ec5eb1b65c8b0567aaf6231cfbfeb698380c5c8b1c1d4ec3206e382f219271ccc1a34a8bc34f886b7bb6915d1
SSDEEP

12288:PF3u0cLhsiUr5F8fYsjnc943SHYG++eXhcz63e:PF3u0cLhfUr5F8fYsjnc943SHXeXhcme

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MbaeApi.dll

Files

MbaeApi.dll
.dll regsvr32 windows:10 windows x86 arch:x86

13f3b87b58ea75fd4d10b98b41175863

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MbaeApi.pdb

Imports

msvcrt

realloc
_errno
??1type_info@@UAE@XZ
_set_errno
__dllonexit
iswdigit
_unlock
_lock
_except_handler4_common
_get_errno
??3@YAXPAX@Z
_wtoi
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
calloc
memmove_s
memset
wcscat_s
wcscpy_s
_purecall
iswspace
_wcsnicmp
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
wcsncpy_s
malloc
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
isalpha
_swprintf_c_l
memmove
??1exception@@UAE@XZ
__CxxFrameHandler3
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
memcmp
_onexit
memcpy

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadLibraryExW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
GetModuleFileNameA
LockResource
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
OpenMutexW
Sleep
CreateSemaphoreExW
ReleaseSemaphore
InitOnceComplete
InitOnceBeginInitialize
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
DeleteCriticalSection
InitializeSRWLock
EnterCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetEvent
ResetEvent
CreateEventW
InitializeCriticalSection

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
OpenProcessToken

api-ms-win-core-localization-l1-2-1

FormatMessageW
SetThreadLocale
GetThreadLocale

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

UnRegisterTypeLi
RegisterTypeLi
SysStringLen
VarUI4FromStr
SysFreeString
VarBstrCat
SysAllocStringLen
BSTR_UserSize
VariantChangeType
SysAllocStringByteLen
VariantInit
SysAllocString
BSTR_UserFree
VARIANT_UserFree
VARIANT_UserUnmarshal
SafeArrayDestroy
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear
SysStringByteLen
VARIANT_UserSize
BSTR_UserUnmarshal
LoadTypeLi
VARIANT_UserMarshal
SysReAllocStringLen
BSTR_UserMarshal

rpcrt4

CStdStubBuffer_CountRefs
NdrDllUnregisterProxy
CStdStubBuffer_QueryInterface
NdrOleAllocate
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrDllRegisterProxy
NdrOleFree
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrDllGetClassObject

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
ObjectStublessClient4
ObjectStublessClient11
ObjectStublessClient5
ObjectStublessClient10
ObjectStublessClient6
ObjectStublessClient9
ObjectStublessClient8
ObjectStublessClient7

api-ms-win-core-com-l1-1-1

StringFromIID
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CoGetMalloc
StringFromGUID2
IIDFromString

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegDeleteTreeW
RegGetValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlQueryWnfStateData
NtQueryKey
RtlSubscribeWnfStateChangeNotification
RtlAllocateWnfSerializationGroup
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlGetVersion
WinSqmIncrementDWORD

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback
CallbackMayRunLong
FreeLibraryWhenCallbackReturns

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

crypt32

CryptProtectData
CryptUnprotectData

api-ms-win-core-file-l1-2-1

GetFullPathNameW

bcrypt

BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptGetProperty

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 407KB - Virtual size: 407KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13f3b87b58ea75fd4d10b98b41175863

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

oleaut32

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-profile-l1-1-0

ntdll

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-registry-l1-1-1

api-ms-win-security-base-l1-2-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

crypt32

api-ms-win-core-file-l1-2-1

bcrypt

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 407KB - Virtual size: 407KB

.data Size: 1KB - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 216B

.rsrc Size: 57KB - Virtual size: 57KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 407KB - Virtual size: 407KB

.data
Size: 1KB - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 216B

.rsrc
Size: 57KB - Virtual size: 57KB

.reloc
Size: 20KB - Virtual size: 20KB