MsSpellCheckingFacility[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MsSpellCheckingFacility.dll
Size

716KB
MD5

b69fd7375f5a10c06fa82079c5dbc99d
SHA1

eb32c8fd16b8c7305df87878e266330e9bb9ca6a
SHA256

74bd1f3043615ef6829345d32d78fe52ada9f7581989c9c2d8afef030356a9a4
SHA512

7ee38ca6506c5e44d8a60bca80fafad4fdf47b45d332fa1394526c42b86af317215bc4f6e9fe4c8df01915a1825564d54f407c72c9e232293b43cef32edd8fe9
SSDEEP

12288:okHRFgntauVbi4nuIc0fodLgOseeibtvs7SEMGNjUekmQXUnfmEvuw39JAPjvSYu:tHRFGYuNBuAfo5se7tvs7ShGNjZkmnn/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MsSpellCheckingFacility.dll

Files

MsSpellCheckingFacility.dll
.dll .ps1 regsvr32 windows:10 windows x86 arch:x86 polyglot

64cd997ea99a69162785d3bc8aafa487

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msspellcheckingfacility.pdb

Imports

msvcrt

_amsg_exit
abort
_initterm
__crtLCMapStringW
iswupper
___mb_cur_max_func
_lock
_unlock
__dllonexit
_onexit
___lc_codepage_func
__pctype_func
??1type_info@@UAE@XZ
ftell
fread
_except_handler4_common
wcstombs_s
__crtCompareStringW
memcmp
___lc_collate_cp_func
___lc_handle_func
??3@YAXPAX@Z
_errno
memcpy
__CxxFrameHandler3
setlocale
_CxxThrowException
_callnewh
malloc
fseek
_isctype
?terminate@@YAXXZ
fclose
_wfopen_s
calloc
_resetstkoflw
memset
realloc
wcsnlen
_wcsicmp
strchr
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
memmove_s
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
memmove
memcpy_s
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_purecall
wcscat_s
free
wcsncpy_s
wcscpy_s
_vsnwprintf
??_V@YAXPAX@Z
_XcptFilter
_ftol2_sse

profapi

ord104

oleaut32

VariantCopy
VariantClear
SetErrorInfo
CreateErrorInfo
VariantInit
SysStringLen
SysFreeString
VarUI4FromStr

api-ms-win-core-synch-l1-2-0

InitializeCriticalSection
CreateEventW
WaitForSingleObject
DeleteCriticalSection
ReleaseMutex
CreateSemaphoreExW
ReleaseSemaphore
ReleaseSRWLockShared
InitOnceBeginInitialize
EnterCriticalSection
AcquireSRWLockShared
AcquireSRWLockExclusive
InitializeSRWLock
CreateMutexExW
Sleep
SleepEx
WaitForSingleObjectEx
InitOnceComplete
OpenSemaphoreW
ReleaseSRWLockExclusive
LeaveCriticalSection
CreateMutexW
InitOnceExecuteOnce
SetEvent
WaitForMultipleObjectsEx
CreateEventExW
InitializeCriticalSectionAndSpinCount

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-2

OpenThreadToken
OpenProcessToken
GetCurrentThread
InitializeProcThreadAttributeList
CreateThread
TlsAlloc
GetCurrentProcessId
CreateProcessW
DeleteProcThreadAttributeList
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
UpdateProcThreadAttribute
TerminateProcess
OpenProcess
TlsFree

api-ms-win-core-handle-l1-1-0

CloseHandle

userenv

DeriveAppContainerSidFromAppContainerName
CreateAppContainerProfile

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibraryAndExitThread
FreeLibrary
GetModuleFileNameA
DisableThreadLibraryCalls
GetProcAddress
GetModuleHandleW
SizeofResource
GetModuleFileNameW
LoadStringW
LoadResource
LoadLibraryExW
LockResource
FindResourceExW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-base-l1-2-0

GetTokenInformation
FreeSid
RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
CoEnableCallCancellation
CLSIDFromString
CoWaitForMultipleHandles
CoUninitialize
CoInitializeEx
CoImpersonateClient
CoCreateInstance
CoTaskMemFree
CoRevertToSelf
CoCancelCall
CoDisableCallCancellation
StringFromGUID2
CoTaskMemRealloc

api-ms-win-core-memory-l1-1-2

MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
CreateFileMappingW

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer
EventWrite

api-ms-win-core-winrt-error-l1-1-1

RoTransformError
RoOriginateErrorW
RoOriginateError

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsStringHasEmbeddedNull

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-string-l2-1-0

CharUpperW
CharNextW

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
RegEnumValueW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegGetValueW

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetLocaleInfoW
SetThreadLocale
GetThreadLocale
LocaleNameToLCID

api-ms-win-core-string-l1-1-0

GetStringTypeW
CompareStringOrdinal
CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-shcore-thread-l1-1-0

SHSetThreadRef
SHCreateThreadRef

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-rtcore-ntuser-window-l1-1-0

PostThreadMessageW
TranslateMessage
PeekMessageW
DispatchMessageW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
CallbackMayRunLong
CloseThreadpoolTimer
SetThreadpoolTimer
TrySubmitThreadpoolCallback

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-core-sysinfo-l1-2-1

GetVersionExW
GetSystemTimeAsFileTime
GetSystemTime
GetTickCount
GetSystemDirectoryW
GetSystemWindowsDirectoryW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-2-1

GetFileSize
FindNextFileW
GetFileAttributesW
FindFirstFileExW
CreateDirectoryW
GetFileSizeEx
GetFileTime
LockFile
ReadFile
WriteFile
CreateFileW
SetEndOfFile
UnlockFile
FindNextChangeNotification
FindClose
FindFirstChangeNotificationW
SetFileTime
GetDriveTypeW
FlushFileBuffers
SetFilePointer
SetFilePointerEx

api-ms-win-core-shlwapi-legacy-l1-1-0

PathAppendW
PathFileExistsW
PathStripPathW
PathGetDriveNumberW
PathIsUNCW
PathFindNextComponentW
PathCombineW
PathIsPrefixW

rpcrt4

UuidCreateSequential

api-ms-win-core-kernel32-legacy-l1-1-1

MoveFileW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
OutputDebugStringW

ntdll

wcschr
_vsnprintf_s
iswdigit
iswspace
wcsncmp
wcscspn
wcsstr
towlower
iswxdigit
swscanf_s
SbSelectProcedure
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
towupper
toupper
iswctype
tolower
wcsrchr

api-ms-win-core-libraryloader-l1-2-2

FindResourceW

bcp47langs

Bcp47GetDistance
GetUserLanguages

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-shlwapi-obsolete-l1-2-0

StrStrIW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-core-normalization-l1-1-0

NormalizeString

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllRegisterServer
DllUnregisterServer
SpellerCheck
SpellerCloseLex
SpellerGetOptions
SpellerInit
SpellerOpenLex
SpellerSetOptions
SpellerTerminate

Sections

.text
Size: 650KB - Virtual size: 650KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64cd997ea99a69162785d3bc8aafa487

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

profapi

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-handle-l1-1-0

userenv

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-heap-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-shlwapi-legacy-l1-1-0

rpcrt4

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-debug-l1-1-1

ntdll

api-ms-win-core-libraryloader-l1-2-2

bcp47langs

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-normalization-l1-1-0

Exports

Exports

Sections

.text Size: 650KB - Virtual size: 650KB

.data Size: 9KB - Virtual size: 11KB

.idata Size: 10KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 12B

.rsrc Size: 11KB - Virtual size: 11KB

.reloc Size: 33KB - Virtual size: 33KB

.text
Size: 650KB - Virtual size: 650KB

.data
Size: 9KB - Virtual size: 11KB

.idata
Size: 10KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 12B

.rsrc
Size: 11KB - Virtual size: 11KB

.reloc
Size: 33KB - Virtual size: 33KB