PortableDeviceApi[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

PortableDeviceApi.dll
Size

511KB
MD5

36cfff70549c43554314ae5bd7ed45a3
SHA1

1b2cf57ecbc5c302617f5e3348a74dbd71cc705b
SHA256

f27fcc01dd7b0494165a5ece4db9fd736259ce9a494d635253cf15f099fff887
SHA512

9eebe89d96724668d22f8ebdedc53b5e7b97aedd47db28d0937b3ead9ad58f83db817a2467e6a1664bd90528a4c9acffda7553deb4098e290d6906de2de5b781
SSDEEP

6144:pvzTtWbt5k6FP1FPP/+YQj/nMlcvhupqmpHJq8uTMzjRVp/ixx5eHb6nYfzqNAHn:4N1FPP/+Y4kgg5mfORVpOxg5fz2AwYv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PortableDeviceApi.dll

Files

PortableDeviceApi.dll
.dll regsvr32 windows:10 windows x86 arch:x86

695341d1e816cdf1ca40739e7e00ba6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

PortableDeviceApi.pdb

Imports

msvcrt

__CxxFrameHandler3
_except_handler4_common
realloc
_vsnwprintf
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memset
_callnewh
vswprintf_s
_vscwprintf
calloc
memmove_s
_wcsicmp
wcsnlen
_purecall
wcscat_s
wcscpy_s
wcsncpy_s
malloc
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
_errno
_CxxThrowException
_ftol2
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
GetModuleHandleW
SizeofResource
LoadResource
LockResource
FreeLibraryAndExitThread
FindResourceExW
GetModuleFileNameW
GetModuleFileNameA
LoadStringW
GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-synch-l1-2-0

ReleaseSemaphore
InitOnceComplete
Sleep
InitOnceBeginInitialize
CreateEventW
CreateSemaphoreExW
WaitForMultipleObjectsEx
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
WaitForSingleObject
ReleaseMutex

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapReAlloc
HeapSize
HeapAlloc
HeapDestroy
HeapFree

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TerminateProcess
ResumeThread
GetCurrentProcessId
CreateThread
GetCurrentProcess
OpenProcessToken
OpenThreadToken
GetCurrentThread

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
TraceMessage
GetTraceEnableLevel
TraceEvent

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWrite
EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-security-base-l1-2-0

GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation

api-ms-win-core-io-l1-1-1

GetOverlappedResult
DeviceIoControl
CancelIoEx

api-ms-win-core-file-l1-2-1

CreateFileW

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
FreeLibraryWhenCallbackReturns
TrySubmitThreadpoolCallback

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

kernel32

lstrcmpiW
GetCurrentPackageFamilyName

rpcrt4

CStdStubBuffer_Connect
NdrDllCanUnloadNow
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
NdrDllGetClassObject
NdrDllRegisterProxy
CStdStubBuffer_DebugServerRelease
NdrCStdStubBuffer_Release
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
NdrDllUnregisterProxy
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
NdrCStdStubBuffer2_Release
IUnknown_AddRef_Proxy
NdrClientCall2
NdrStubCall2
NdrStubForwardingFunction
CStdStubBuffer_Invoke
NdrOleAllocate
CStdStubBuffer_DebugServerQueryInterface

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 403KB - Virtual size: 403KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

695341d1e816cdf1ca40739e7e00ba6d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l2-1-0

kernel32

rpcrt4

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 403KB - Virtual size: 403KB

.data Size: 5KB - Virtual size: 6KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 296B

.rsrc Size: 63KB - Virtual size: 62KB

.reloc Size: 31KB - Virtual size: 31KB

.text
Size: 403KB - Virtual size: 403KB

.data
Size: 5KB - Virtual size: 6KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 296B

.rsrc
Size: 63KB - Virtual size: 62KB

.reloc
Size: 31KB - Virtual size: 31KB