BootMenuUX[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

BootMenuUX.dll
Size

146KB
MD5

149a2b52d94430a515be6d2b5f83a4a5
SHA1

3f021cc1f00d3896005b40ea05bfd59f534d5340
SHA256

14a4ae3d6c5888569facf80379157573b660fd2d3bee732445401472d58b5357
SHA512

ad5c95ff7c0a0ef898442c9236772fa7c59d493659f9ecbc632a4313d93cce12864b2243bec32a98573d27204b9c6effd39e4013d561bff8c95f6db6f1bc1428
SSDEEP

3072:b2KS9pu0e+wEqDfar+xUkALXEEshx3Nn90/KbrZ:CKS9pu7FLDCr8xeEEe3NO/K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BootMenuUX.dll

Files

BootMenuUX.dll
.dll windows:6 windows x64 arch:x64

4c8b55f44b79b18fa2466e16de6b0432

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

BootMenuUX.pdb

Imports

msvcrt

wcsrchr
wcsstr
strncmp
wcsnlen
_wcsupr
_wcslwr
_snwscanf_s
wcschr
memmove
swprintf_s
_ultow_s
wcscpy_s
wcscat_s
memcmp
memcpy
__CxxFrameHandler3
_onexit
__dllonexit
wcstoul
_wcsnicmp
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
qsort_s
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
_vsnwprintf
_wcsicmp
memset

api-ms-win-core-com-l1-1-1

PropVariantClear
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegGetValueW
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegUnLoadKeyW
RegLoadKeyW
RegCreateKeyExW
RegSetValueExW

api-ms-win-core-string-l1-1-0

CompareStringEx

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
SetEvent
WaitForSingleObject

api-ms-win-core-localization-l1-2-1

SetThreadPreferredUILanguages
LocaleNameToLCID

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-firmware-l1-1-0

GetFirmwareEnvironmentVariableW
SetFirmwareEnvironmentVariableW

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateThread

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-2-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-registry-l2-1-0

RegSetKeyValueW
RegEnumKeyW

bootux

ord6
ord4
ord2
ord8
ord7

ntdll

RtlFreeSid
RtlSetDaclSecurityDescriptor
ZwDeleteValueKey
ZwSetValueKey
ZwQueryValueKey
RtlLengthSecurityDescriptor
ZwSetSecurityObject
RtlAddAccessAllowedAceEx
ZwLoadKey
RtlAllocateAndInitializeSid
ZwDeleteKey
ZwEnumerateKey
RtlLengthSid
RtlCreateSecurityDescriptor
ZwQueryKey
ZwOpenKey
RtlSetOwnerSecurityDescriptor
ZwAllocateUuids
RtlInitAnsiString
LdrGetProcedureAddress
LdrGetDllHandle
NtOpenProcessTokenEx
NtSetInformationThread
RtlImpersonateSelf
NtOpenThreadTokenEx
NtClose
NtAdjustPrivilegesToken
ZwCreateEvent
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwDeviceIoControlFile
ZwResetEvent
NtQuerySystemInformation
NtOpenKey
NtDeviceIoControlFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtWaitForSingleObject
NtCreateEvent
NtQueryValueKey
NtOpenFile
NtResetEvent
NtQueryBootEntryOrder
NtTranslateFilePath
NtEnumerateBootEntries
RtlNtStatusToDosError
RtlCopyUnicodeString
RtlpNtQueryValueKey
RtlUnicodeStringToAnsiString
NtShutdownSystem
RtlpSetPreferredUILanguages
ZwCreateKey
ZwUnloadKey
RtlAppendUnicodeToString
ZwQueryAttributesFile
ZwOpenFile
RtlAllocateHeap
ZwClose
ZwWaitForSingleObject
ZwReleaseMutant
ZwOpenMutant
RtlGUIDFromString
RtlFreeUnicodeString
ZwQuerySystemInformation
RtlInitUnicodeString
RtlFreeHeap
RtlStringFromGUID
RtlAcquirePrivilege
RtlReleasePrivilege
RtlAdjustPrivilege
RtlCreateAcl

reagent

WinReGetConfig
WinReRestoreLogFiles
WinReGetCustomization
WinReSetRecoveryAction

user32

SetSysColors
LoadKeyboardLayoutW
GetKeyboardLayoutNameW
GetKeyboardLayout
SystemParametersInfoW

uxtheme

ord95

kernel32

GetProcAddress
GetThreadPreferredUILanguages
EnumUILanguagesW
FreeLibrary
CreateFileW
LoadLibraryW
LCIDToLocaleName
GetLocaleInfoEx
SetLastError
GetFileAttributesW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

cryptsp

SystemFunction031
SystemFunction027
SystemFunction007

Exports

Exports

CreateAdvancedOptionsButton
CreateAdvancedRecoveryToolsButtonCollection
CreateAdvancedStartupButton
CreateAdvancedStartupLaunchPage
CreateBasicResetFinalChecksPage
CreateBasicResetLandingPage
CreateBasicSystemResetButton
CreateBasicSystemResetLaunchPage
CreateBitlockerLandingPage
CreateBlackWallpaperButton
CreateBootableDeviceButtonCollection
CreateBootableOSButtonCollection
CreateCSRTFinalPage
CreateClearWallpaperPage
CreateDefaultOSButton
CreateDefaultOSButtonCollection
CreateDefaultOSListButton
CreateDeviceListButton
CreateFactoryResetFinalChecksPage
CreateFactoryResetLandingPage
CreateFactorySystemResetButton
CreateFactorySystemResetLaunchPage
CreateFirmwareSettingsButton
CreateFiveMinuteTimeoutAction
CreateFiveSecondTimeoutAction
CreateKeyboardLayoutButtonCollection
CreateLanguageButtonCollection
CreateOSListButton
CreateOneMinuteTimeoutAction
CreatePBRCancelButton
CreatePBRFinalPage
CreatePBRStartPage
CreatePBRfactoryResetAllVolumesButton
CreatePBRfactoryResetBareMetalDisabled
CreatePBRfactoryResetBareMetalEnabled
CreatePBRfactoryResetCancelOperationButton
CreatePBRfactoryResetContinueChecksButton
CreatePBRfactoryResetDataEraseDisabled
CreatePBRfactoryResetDataEraseEnabled
CreatePBRfactoryResetOsOnlyButton
CreatePasswordButton
CreatePasswordPage
CreateRecoveryToolsListButton
CreateRestartButton
CreateSelectOSPage
CreateSetWallpaperPage
CreateShutdownButton
CreateSkippableSelectOSPage
CreateTenSecondTimeoutAction
CreateThirtySecondTimeoutAction
CreateTopLevelRecoveryToolsButtonCollection
CreateTopLevelRecoveryToolsPage
CreateUserNameButtonCollection
CreateUserSelectionPage
CreateWinReTargetOSButtonCollection
CreateWinReTargetOSPage
CreateZeroSecondTimeoutAction
InitializePasswordDatabase
InitializeSRTSyncInterface
InitializeSyncInterface
UtilBcdCloseSystemStore
UtilGetCurrentKeyboardLayout

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c8b55f44b79b18fa2466e16de6b0432

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-com-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-firmware-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-registry-l2-1-0

bootux

ntdll

reagent

user32

uxtheme

kernel32

version

api-ms-win-security-sddl-l1-1-0

cryptsp

Exports

Exports

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1KB - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 4KB

.idata Size: 8KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 512B - Virtual size: 504B

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1KB - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 4KB

.idata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 512B - Virtual size: 504B