AboveLockAppHost[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

AboveLockAppHost.dll
Size

232KB
MD5

d7b62803bc6dc815187e2f93e3e539ee
SHA1

af518fb438e42c259987f49e6954af48d7227516
SHA256

b3aafa9e44f1ebeee4b41bb2ff38e966608c1374298e6fd9ece89f4d5f0f9bb7
SHA512

d33240f7bc7c01ed20ece3511b41d820574a2b69e5624fcc679d7c7e3afe4e30884deca3af3961a1b16e66b9e9fddc8bbc96ab3afc6a9af9c235a8db9c1840d9
SSDEEP

3072:Gw9lxQDepPhKSNrdGP/AmVdnp5+lZr4jWk/M/2A6wMpR9u31KdR6ynvgqsA0QB/C:Gw9lOKfGXRdnmlZDUdxrsApB4K7A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AboveLockAppHost.dll

Files

AboveLockAppHost.dll
.dll windows:10 windows x86 arch:x86

5407da0cc67515f8c9161525f8e6fa9e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AboveLockAppHost.pdb

Imports

msvcrt

_callnewh
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
_CxxThrowException
_vsnprintf_s
??1type_info@@UAE@XZ
_ftol2_sse
memcmp
??0exception@@QAE@XZ
memcpy
??0exception@@QAE@ABV0@@Z
memcpy_s
_vsnwprintf
??1exception@@UAE@XZ
_purecall
memmove
wcsrchr
wcscspn
realloc
__CxxFrameHandler3
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
??3@YAXPAX@Z
malloc
free
_amsg_exit
_XcptFilter
memmove_s
memset

shcore

SHGetThreadRef
SHSetThreadRef
IUnknown_QueryService
SHCreateThreadRef

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

rpcrt4

NdrStubCall2
IUnknown_Release_Proxy
CStdStubBuffer_Invoke
NdrStubForwardingFunction
IUnknown_AddRef_Proxy
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
NdrOleFree
CStdStubBuffer_Connect
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_IsIIDSupported
NdrOleAllocate
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect

api-ms-win-core-winrt-string-l1-1-0

HSTRING_UserUnmarshal
HSTRING_UserFree
WindowsCreateStringReference
WindowsDeleteString
WindowsDuplicateString
WindowsGetStringRawBuffer
HSTRING_UserMarshal
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsSubstringWithSpecifiedLength
WindowsGetStringLen
HSTRING_UserSize

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError
RoOriginateErrorW

api-ms-win-core-synch-l1-2-0

CreateEventExW
InitializeSRWLock
DeleteCriticalSection
InitializeCriticalSectionEx
WaitForSingleObjectEx
ReleaseMutex
LeaveCriticalSection
ReleaseSemaphore
Sleep
ReleaseSRWLockExclusive
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockShared
CreateSemaphoreExW
OpenSemaphoreW
InitOnceComplete
AcquireSRWLockShared
InitOnceBeginInitialize
SetEvent
CreateMutexExW
CreateEventW
EnterCriticalSection

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
LoadLibraryExW
FreeLibraryAndExitThread

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentThread
GetCurrentProcess
TerminateProcess
OpenProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
OpenThreadToken
GetProcessId
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
CreateThread

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException
GetLastError

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
TrySubmitThreadpoolCallback
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CallbackMayRunLong
FreeLibraryWhenCallbackReturns

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-1

CoTaskMemRealloc
CoTaskMemAlloc
CoGetStdMarshalEx
CoTaskMemFree
CoGetCallContext
CoCreateInstance
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoGetApartmentType
CoInitializeEx
RoGetAgileReference
CoMarshalInterThreadInterfaceInStream
CoWaitForMultipleHandles
CoWaitForMultipleObjects
CoGetMalloc
CoCreateFreeThreadedMarshaler
CoUninitialize

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegGetValueW
RegCloseKey

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventActivityIdControl
EventWriteTransfer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient13
ObjectStublessClient5
ObjectStublessClient15
ObjectStublessClient3
ObjectStublessClient20
ObjectStublessClient11
CStdStubBuffer2_Disconnect
ObjectStublessClient14
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
ObjectStublessClient6
CStdStubBuffer2_CountRefs
NdrProxyForwardingFunction4
ObjectStublessClient8
ObjectStublessClient18
NdrProxyForwardingFunction5
ObjectStublessClient4
ObjectStublessClient12
ObjectStublessClient10
ObjectStublessClient17
ObjectStublessClient16
ObjectStublessClient7
ObjectStublessClient9
ObjectStublessClient21
CStdStubBuffer2_Connect
NdrProxyForwardingFunction3

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-security-base-l1-2-0

CreateWellKnownSid
CopySid
GetLengthSid
IsValidSid
GetTokenInformation
EqualSid

api-ms-win-core-kernel32-legacy-l1-1-1

RegisterWaitForSingleObject
UnregisterWait

combase

ord79
ord140

kernel32

GetSystemAppDataKey
OpenStateExplicit
CloseState

ntdll

RtlPublishWnfStateData

ole32

HWND_UserFree
HWND_UserSize
HWND_UserMarshal
HWND_UserUnmarshal

user32

MsgWaitForMultipleObjectsEx
GetSystemMetrics
SetForegroundWindow
GetWindowRect
IsZoomed
IsIconic
SetWindowLongW
PeekMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
GetWindowLongW
SetLayeredWindowAttributes
GetWindowThreadProcessId
SetPropW
GetWindowBand
SetRectEmpty

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 206KB - Virtual size: 205KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5407da0cc67515f8c9161525f8e6fa9e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shcore

api-ms-win-core-winrt-propertysetprivate-l1-1-1

rpcrt4

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

combase

kernel32

ntdll

ole32

user32

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 206KB - Virtual size: 205KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 206KB - Virtual size: 205KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 13KB