AccountsRt[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AccountsRt.dll
Size

362KB
MD5

3208766634824e85a021409740a52390
SHA1

1ed26bef6ab89045f04201b72dd4e0bb2dd4224f
SHA256

62cb01277b00c06677d7bcee73a8dcab0f09da22cf69d55a511a47128c903cc9
SHA512

b8ecb4b7111cc3f659cde185abbaef1663918fa11efb537a48b1d530fb50bbe297d72e0587065212cee7253c6c9845c7b827809a5a113543095d912f4ad6d821
SSDEEP

6144:HiUaOzhyOAUZOMIpquupsoQEpSkM5esoGvbf0HDNaNDsPI8JZ:H+OzhyOHOlpquupsESruGvbf0ZASDZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AccountsRt.dll

Files

AccountsRt.dll
.dll windows:10 windows x86 arch:x86

c1438f52480c4adf4dca172a09818b30

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AccountsRT.pdb

Imports

msvcrt

wcschr
_wcsicmp
memmove
wcstok_s
_vsnwprintf_s
wcstoul
memcmp
_lock
realloc
_errno
_initterm
_vsnwprintf
towlower
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler4_common
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
memmove_s
memset
_unlock
wcsncpy_s
malloc
free
_purecall
memcpy_s
__CxxFrameHandler3
memcpy

oleaut32

BSTR_UserSize
SysStringLen
BSTR_UserFree
BSTR_UserMarshal
VarUI4FromStr
BSTR_UserUnmarshal
SysFreeString

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
LoadResource
SizeofResource
GetProcAddress
FindResourceExW
LoadLibraryExW
GetModuleFileNameW
FreeLibrary
GetModuleHandleW

api-ms-win-core-synch-l1-2-0

CreateSemaphoreExW
EnterCriticalSection
ReleaseSRWLockExclusive
LeaveCriticalSection
InitOnceExecuteOnce
ReleaseSemaphore
Sleep
InitOnceBeginInitialize
InitOnceComplete
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
InitializeSRWLock
OpenSemaphoreW
AcquireSRWLockShared
CreateMutexExW
AcquireSRWLockExclusive
ReleaseMutex
WaitForSingleObjectEx
InitializeCriticalSectionEx
ReleaseSRWLockShared

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsConcatString
WindowsPreallocateStringBuffer
WindowsStringHasEmbeddedNull
WindowsGetStringLen
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsDeleteStringBuffer
WindowsDeleteString
WindowsPromoteStringBuffer
WindowsCreateString
WindowsCreateStringReference

api-ms-win-core-com-l1-1-1

CoUninitialize
CoInitializeEx
CoTaskMemRealloc
CoGetApartmentType
CoDecrementMTAUsage
CoIncrementMTAUsage
CoTaskMemAlloc
CoReleaseMarshalData
RoGetAgileReference
CoMarshalInterface
CreateStreamOnHGlobal
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemFree

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegSetValueExW
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventActivityIdControl
EventSetInformation
EventUnregister
EventWrite
EventWriteTransfer

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processthreads-l1-1-2

OpenProcessToken
GetCurrentThread
OpenThreadToken
SetThreadToken
OpenProcess
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-winrt-error-l1-1-1

RoTransformError
GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
RoOriginateErrorW
RoGetMatchingRestrictedErrorInfo
RoOriginateError

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
CloseThreadpoolWork
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
DisassociateCurrentThreadFromCallback

api-ms-win-security-base-l1-2-0

GetLengthSid
RevertToSelf
GetTokenInformation
CopySid

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance
RoUninitialize
RoInitialize

crypt32

CertGetCertificateChain
CertOpenStore
CertCompareCertificateName
CertGetNameStringW
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertFreeCertificateChainEngine
CertEnumCertificatesInStore
CertCloseStore
CryptDecodeObjectEx
CertFreeCertificateChain

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-file-l1-2-1

ReadFile
GetFileSize
CreateFileW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

ntdll

RtlCaptureContext
RtlGetDeviceFamilyInfoEnum
RtlReportException

rpcrt4

RpcBindingFromStringBindingW
RpcSsDestroyClientContext
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcExceptionFilter
NdrClientCall4

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

userdataplatformhelperutil

IsActiveDebugger

aphostclient

ApHostServerStatus_EnsureServerReady

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 326KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c1438f52480c4adf4dca172a09818b30

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-string-l2-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-winrt-l1-1-0

crypt32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

ntdll

rpcrt4

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-libraryloader-l1-2-2

userdataplatformhelperutil

aphostclient

Exports

Exports

Sections

.text Size: 326KB - Virtual size: 325KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 88B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 326KB - Virtual size: 325KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 88B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 22KB - Virtual size: 22KB