OneDriveSettingSyncProvider[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

OneDriveSettingSyncProvider.dll
Size

416KB
MD5

ad1d74f25d93aabeda5480d1668736a9
SHA1

2435274afe95ad1618ef983613f1da55141ce891
SHA256

5808c184107e93806ea28f10a5901d7140798606ae1bdd8c2cbf2f8c28ff5332
SHA512

293cf7b1dbf0a28dc9ec68d0a252f3e1eb168ae96ad825cd94bd542adbfeb1db2543d63694a0febe6e3bbfec1f433d42c59656ce3649dfa6e88c478841acd8a9
SSDEEP

12288:vXR1TCZYVdQLg6j8RmVe4ILT+BS4FxBKj6bg2u:Z1TCZadZ6j8kjUT+A6xBKj6bgx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OneDriveSettingSyncProvider.dll

Files

OneDriveSettingSyncProvider.dll
.dll windows:10 windows x86 arch:x86

48b69ea839153ca0708f3457fab17a78

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

OneDriveSettingSyncProvider.pdb

Imports

msvcrt

wcstok_s
_wcsnicmp
swscanf_s
_wcstoui64
__CxxFrameHandler3
_ftol2
wcschr
iswalnum
wcsncpy_s
wcsstr
realloc
memmove_s
_get_errno
_set_errno
memmove
strncmp
rand
_wcsicmp
time
srand
_CxxThrowException
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
_initterm
_amsg_exit
??0exception@@QAE@ABQBD@Z
_callnewh
_vsnwprintf
_XcptFilter
_purecall
malloc
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
memcpy_s
memcpy
memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameW

api-ms-win-core-synch-l1-2-0

SetEvent
CreateEventExW
LeaveCriticalSection
WaitForSingleObject
ReleaseSemaphore
InitializeSRWLock
ReleaseMutex
ReleaseSRWLockExclusive
InitOnceBeginInitialize
WaitForSingleObjectEx
OpenSemaphoreW
InitOnceExecuteOnce
CreateSemaphoreExW
EnterCriticalSection
CreateMutexExW
InitOnceComplete
DeleteCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockShared
AcquireSRWLockShared
Sleep
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
RaiseException
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
OpenThreadToken
GetCurrentProcess
TerminateProcess

api-ms-win-core-localization-l1-2-1

LCMapStringEx
GetGeoInfoW
GetUserGeoID
FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegDeleteTreeW
RegEnumKeyExW
RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
TraceMessage

api-ms-win-core-winrt-error-l1-1-1

RoTransformError
RoGetMatchingRestrictedErrorInfo
SetRestrictedErrorInfo
RoOriginateError

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetVersionExW
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar

ntdll

RtlGetSuiteMask
vDbgPrintEx
ZwClose
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
TpWaitForAlpcCompletion
ZwAlpcConnectPort
RtlWaitOnAddress
RtlInitUnicodeString
ZwAlpcQueryInformation
TpReleaseAlpcCompletion
ZwAlpcSendWaitReceivePort
ZwAlpcDisconnectPort
TpAllocAlpcCompletion
RtlWakeAddressAll
ZwAlpcCancelMessage
RtlFreeHeap
RtlAllocateHeap
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
RtlNtStatusToDosError
EtwEventWrite
NtPowerInformation

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
LocalReAlloc

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-shcore-stream-l1-1-0

IStream_Size
SHCreateMemStream
IStream_Write
IStream_Reset
IStream_Copy
IStream_Read
SHOpenRegStream2W

api-ms-win-core-path-l1-1-0

PathAllocCombine

api-ms-win-security-base-l1-2-0

GetTokenInformation
CreateWellKnownSid

api-ms-win-core-file-l1-2-1

SetFileAttributesW
FindClose
CompareFileTime
FindNextFileW
FindFirstFileW
RemoveDirectoryW
DeleteFileW
GetFileAttributesW

api-ms-win-core-shlwapi-obsolete-l1-2-0

StrStrIW
StrRChrW
StrToIntExW

api-ms-win-shcore-registry-l1-1-1

SHRegGetValueW
SHRegSetPathW
SHRegGetPathW
SHSetValueW
SHDeleteValueW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathStripPathW
PathGetCharTypeW

api-ms-win-core-url-l1-1-0

UrlEscapeW
UrlUnescapeW

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-string-l2-1-0

CharLowerBuffW

bcrypt

BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash

api-ms-win-appmodel-state-l1-2-0

OpenStateExplicit
CloseState
GetSystemAppDataKey

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 384KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48b69ea839153ca0708f3457fab17a78

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l1-1-0

ntdll

api-ms-win-core-heap-l2-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-shlwapi-obsolete-l1-2-0

api-ms-win-shcore-registry-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-string-l2-1-0

bcrypt

api-ms-win-appmodel-state-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-version-l1-1-0

Exports

Exports

Sections

.text Size: 384KB - Virtual size: 384KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 208B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 19KB - Virtual size: 19KB

.text
Size: 384KB - Virtual size: 384KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 208B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 19KB - Virtual size: 19KB