LocationApi[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

LocationApi.dll
Size

313KB
MD5

6cd24dac0c8a27f35995fdbb27339419
SHA1

2d8924fe4658610dff4e8766b5e1179ed5cd7e4b
SHA256

6fdd18fe31bcd86b13aa79c1dfa80918e0b1f1fa57d73e6aa9785af28e9e5ff7
SHA512

3abd422166848242fc3568b9c3be4358792db7bbddc16bc85ec0e43e6e863ac7d351cbfac7ae604e212904455c1b8e2cd83a7acc1d288549474ffb698d41c855
SSDEEP

3072:Wt23Zz5aoBT7amMT1hGpx9vCsNEi+vB5KvX1y0yUd645+I7a5A2EaOZw3/uEVX89:Wt29v7w+b+HKmUdK/uH2qXUJXXHcTN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LocationApi.dll

Files

LocationApi.dll
.dll regsvr32 windows:10 windows x86 arch:x86

4633e15f5d83ab1281d0972ab7715720

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

LocationApi.pdb

Imports

msvcp110_win

?_Xbad_alloc@std@@YAXXZ

msvcrt

__CxxFrameHandler3
memmove
_wcsicmp
_wmakepath_s
_wsplitpath_s
memcmp
_ftol2
_CxxThrowException
_CIsqrt
??3@YAXPAX@Z
_resetstkoflw
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
_callnewh
memset
wcsncpy_s
malloc
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
wcscat_s
wcscpy_s
memcpy_s
calloc
_vsnwprintf
??_V@YAXPAX@Z
memcpy

oleaut32

LPSAFEARRAY_UserSize
BSTR_UserMarshal
UnRegisterTypeLi
BSTR_UserFree
SysFreeString
LoadRegTypeLi
BSTR_UserSize
BSTR_UserUnmarshal
VariantInit
VariantClear
SystemTimeToVariantTime
VariantTimeToSystemTime
LoadTypeLi
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserMarshal
RegisterTypeLi
SysStringLen
SysAllocString
LPSAFEARRAY_UserUnmarshal

rpcrt4

NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrStubCall2
CStdStubBuffer_Connect
NdrDllCanUnloadNow
IUnknown_Release_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
NdrCStdStubBuffer2_Release
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrDllGetClassObject
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_Disconnect

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient12
CStdStubBuffer2_CountRefs
ObjectStublessClient14
ObjectStublessClient4
NdrProxyForwardingFunction5
ObjectStublessClient6
CStdStubBuffer2_Connect
NdrProxyForwardingFunction4
CStdStubBuffer2_QueryInterface
ObjectStublessClient3
ObjectStublessClient15
ObjectStublessClient8
NdrProxyForwardingFunction6
ObjectStublessClient5
CStdStubBuffer2_Disconnect
ObjectStublessClient9
ObjectStublessClient13
ObjectStublessClient10
ObjectStublessClient7
NdrProxyForwardingFunction3
ObjectStublessClient11

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
GetProcAddress
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleExW

api-ms-win-core-localization-l1-2-1

EnumSystemGeoID
GetGeoInfoW
GetThreadLocale
GetUserGeoID
SetThreadLocale
FormatMessageW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegGetKeySecurity
RegDeleteKeyExW
RegQueryValueExW
RegGetValueW
RegSetValueExW
RegCloseKey
RegSetKeySecurity
RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyExW

api-ms-win-core-synch-l1-2-0

WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexW
InitializeSRWLock
Sleep
WaitForSingleObject
AcquireSRWLockShared
InitializeCriticalSection
CreateMutexExW
ReleaseSRWLockShared
DeleteCriticalSection
LeaveCriticalSection
ReleaseSemaphore
ReleaseSRWLockExclusive
OpenEventW
CreateEventW
EnterCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
SetEvent
ReleaseMutex

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-1

GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-com-l1-1-1

CoCreateInstance
PropVariantClear
CoTaskMemFree
StringFromGUID2
PropVariantCopy
CLSIDFromString
CoTaskMemAlloc
CoSetProxyBlanket

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
CreateThread
GetCurrentProcessId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
IsThreadpoolTimerSet
SetThreadpoolTimer
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CloseThreadpool
SetThreadpoolWait
CreateThreadpool
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolThreadMaximum

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-sysinfo-l1-2-1

GetTickCount64
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-marshal-l1-1-0

HWND_UserUnmarshal
HWND_UserMarshal
HWND_UserSize
HWND_UserFree

user32

DefWindowProcW
GetWindowLongW
SetWindowLongW
UnregisterClassA
RegisterWindowMessageW
GetClassNameW
PostMessageW
EnumWindows
IsWindow
PostThreadMessageW
RegisterClassExW
CreateWindowExW
GetMessageW
DestroyWindow
TranslateMessage
DispatchMessageW
UnregisterClassW

ntdll

WinSqmAddToStreamEx
WinSqmAddToAverageDWORD
WinSqmAddToStream
WinSqmIsOptedIn
WinSqmIncrementDWORD

propsys

PropVariantToBSTR
InitPropVariantFromFileTime
InitPropVariantFromCLSID
PropVariantToDouble
PropVariantToString

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-security-base-l1-2-0

AddAce
InitializeSecurityDescriptor
GetAce
GetAclInformation
GetSecurityDescriptorDacl
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
SetSecurityDescriptorDacl
InitializeAcl
AddAccessAllowedAceEx
CopySid
GetLengthSid

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4633e15f5d83ab1281d0972ab7715720

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp110_win

msvcrt

oleaut32

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-string-l2-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-marshal-l1-1-0

user32

ntdll

propsys

api-ms-win-core-apiquery-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 229KB - Virtual size: 229KB

.data Size: 1024B - Virtual size: 5KB

.idata Size: 9KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 53KB - Virtual size: 53KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 229KB - Virtual size: 229KB

.data
Size: 1024B - Virtual size: 5KB

.idata
Size: 9KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 53KB - Virtual size: 53KB

.reloc
Size: 18KB - Virtual size: 18KB