LocationFrameworkPS[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

LocationFrameworkPS.dll
Size

24KB
MD5

af50a16e529a05b1ca4ee652757e69a5
SHA1

f4baa7f87e66f7ff23064bc9b9384009e5a29272
SHA256

64200fbb3c17cb9defc46eb7ebc024adf47ae097f4df6804906c06a0d4bb6e18
SHA512

31cc4d9f12b8d98cc6bf991a48ed60e5ed500e4d6d03587cf648f0d3f791955efa1731f73ab957d3ce2e974c18c1a86cf1bb9f7feacfdf4734032e6f458bc9f9
SSDEEP

384:QKJAXEShXn8zkKWc/GmrldrUWpzWHa9mXjDBRJNMl1n47:g1RCanyfUXj1PN7

Score

1^/10

Malware Config

Signatures

Files

LocationFrameworkPS.dll
.dll regsvr32 windows:10 windows x86 arch:x86

e20de3b380917c8b823175ce46c9c7d0

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-07-2018 20:45

Not After

26-07-2019 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:d8:7b:d6:91:97:26:a6:15:ba:40:84:02:69:e2:dd:e8:02:23:dc:c3:1b:e6:ca:bd:2a:7b:7e:ad:84:1e:31
Signer

Actual PE Digest

3c:d8:7b:d6:91:97:26:a6:15:ba:40:84:02:69:e2:dd:e8:02:23:dc:c3:1b:e6:ca:bd:2a:7b:7e:ad:84:1e:31

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

LocationFrameworkPS.pdb

Imports

msvcrt

_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter

kernelbase

GetSystemTimeAsFileTime
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetCurrentThreadId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls

rpcrt4

NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient6
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient5
ObjectStublessClient10
ObjectStublessClient13
ObjectStublessClient7
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient3
ObjectStublessClient14
ObjectStublessClient12
ObjectStublessClient4
ObjectStublessClient11

oleaut32

BSTR_UserUnmarshal
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserFree

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e20de3b380917c8b823175ce46c9c7d0

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

3c:d8:7b:d6:91:97:26:a6:15:ba:40:84:02:69:e2:dd:e8:02:23:dc:c3:1b:e6:ca:bd:2a:7b:7e:ad:84:1e:31Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernelbase

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

oleaut32

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 864B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 1004B

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

3c:d8:7b:d6:91:97:26:a6:15:ba:40:84:02:69:e2:dd:e8:02:23:dc:c3:1b:e6:ca:bd:2a:7b:7e:ad:84:1e:31
Signer

.text
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 864B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 1004B