ContactApis[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ContactApis.dll
Size

839KB
MD5

f58ff8b872712ec135af2b38d6073080
SHA1

4809fa15aee88ee735e3cd2f12e071c83ff67c55
SHA256

13a821d3c31061815d2fc84a87c7ce8f016fc99a86cf37dfcae6ca635cc6f43d
SHA512

659902d0883e2e0dca2a89e7525621ad788cc4175e5d5d9c45ae438e4448f97d42370bd9505ee2c7d07e5999e9d6a33905b11e5bf1a81fde13fdcbdf6d0e2a87
SSDEEP

12288:4k51ZMTF/psfdJE6HEbODGQoeY1Ac7y2MEJwEl4uMnGyIKjKvFY3GSOEB3ximoYi:P51eVkdew9Fx3e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ContactApis.dll

Files

ContactApis.dll
.dll windows:10 windows x86 arch:x86

7d42e13a61e2e96739c750af00302632

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ContactApis.pdb

Imports

msvcrt

_except_handler4_common
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
memcmp
_initterm
_amsg_exit
_XcptFilter
_callnewh
wcstoul
_errno
_vsnwprintf_s
wcsstr
realloc
memcpy
memmove_s
memmove
malloc
free
_purecall
memcpy_s
_vsnwprintf
_lock
memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
LoadLibraryExW
GetProcAddress

api-ms-win-core-synch-l1-2-0

CreateMutexExW
AcquireSRWLockShared
WaitForSingleObject
InitOnceBeginInitialize
InitializeSRWLock
InitOnceExecuteOnce
DeleteCriticalSection
InitializeCriticalSectionEx
InitOnceComplete
SetEvent
OpenSemaphoreW
CreateEventExW
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObjectEx
ReleaseSemaphore
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
CreateEventW
CreateSemaphoreExW
Sleep
ReleaseSRWLockShared

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventWrite
EventActivityIdControl
EventRegister
EventUnregister
EventSetInformation

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
OpenProcess
GetCurrentProcessId
OpenThreadToken
OpenProcessToken
SetThreadToken
GetCurrentThread

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWait
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
FreeLibraryWhenCallbackReturns
SetThreadpoolWait

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

ntdll

RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-service-management-l1-1-0

OpenServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-service-winsvc-l1-2-0

QueryServiceStatus

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

GenerateUserModeServiceName
GetUserTokenFromContext
IsActiveDebugger
IsCommsSystemService
GetUserContextFromHandle
StartAndWaitForServiceForUser

contactactivation

AwaitContactPickerResults
ShowContactPickerAsync
ContactToVCardString

userdatalanguageutil

IsMatchingEAPrefix
DetermineStringEALangIdNLS
IsEAChar

systemeventsbrokerclient

SebCreateContactNotificationEvent
SebDeleteEvent

phoneutil

ValidPhoneNumberInplaceStripInvalidCharacters

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
SetLocalRpcConnection

Sections

.text
Size: 768KB - Virtual size: 767KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7d42e13a61e2e96739c750af00302632

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

ntdll

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-2-0

api-ms-win-core-winrt-propertysetprivate-l1-1-1

api-ms-win-core-profile-l1-1-0

userdataplatformhelperutil

contactactivation

userdatalanguageutil

systemeventsbrokerclient

phoneutil

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-registry-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 768KB - Virtual size: 767KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 248B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 61KB - Virtual size: 61KB

.text
Size: 768KB - Virtual size: 767KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 248B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 61KB - Virtual size: 61KB