51fe429ea7dbda011a03000060554822[.]webplatstorageserver[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

51fe429ea7dbda011a03000060554822.webplatstorageserver.dll
Size

1.2MB
MD5

a0f70b9f5df58881c1a76e894cc1cee5
SHA1

9030616c44776e4a38305b8b6aae512ddf2677a8
SHA256

65cabeb128c619747461a190c1c342b583bcf267e0fec3d9421d0d1a77fbb336
SHA512

a5af8697451efe02334d66ed993f2fa7b3be9de7f34bec17410b5e39f63df75bca7b655b2daffa863c4d762732aedfaf04380cd73416249f0d538424eb9aba57
SSDEEP

12288:OmQeXJP4XYaWqnj5qcvwNMfDiUoCZl7kRxg3fO4lqPmbeMdAYP:hQeXJPixjbvw8DiUhZl7kRx+O4kMd9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51fe429ea7dbda011a03000060554822.webplatstorageserver.dll

Files

51fe429ea7dbda011a03000060554822.webplatstorageserver.dll
.dll regsvr32 windows:10 windows x64 arch:x64

a6776f5761e7baece77120c87ada2236

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

webplatstorageserver.pdb

Imports

msvcp_win

_Unlock_shared_ptr_spin_lock
_Lock_shared_ptr_spin_lock
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Random_device@std@@YAIXZ

api-ms-win-crt-string-l1-1-0

wcsncmp
memset

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_ceil
_o_floor
_o_free
_o_iswdigit
_o_malloc
_o_memcpy_s
_o_terminate
_o_toupper
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoul
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
SizeofResource
GetModuleFileNameA
LoadResource
GetModuleHandleW
LoadLibraryExW
FindResourceExW
GetProcAddress
FreeLibrary
GetModuleFileNameW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
SwitchToThread
OpenProcessToken
CreateThread
GetCurrentThread
OpenThreadToken
TerminateProcess
GetCurrentProcess
SetThreadPriority

api-ms-win-core-localization-l1-2-0

FormatMessageW

oleaut32

VariantInit
SysAllocStringLen
SystemTimeToVariantTime
SysStringLen
SafeArrayCopy
SafeArrayGetVartype
SafeArrayCreate
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
VariantCopyInd
SafeArrayUnlock
SafeArrayDestroy
VariantClear
LPSAFEARRAY_UserSize64
VarUI4FromStr
LPSAFEARRAY_UserMarshal
SysFreeString
LPSAFEARRAY_UserUnmarshal64
LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreExW
WaitForSingleObjectEx
CreateMutexExW
OpenSemaphoreW
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
InitializeSRWLock
WaitForMultipleObjectsEx
ReleaseSemaphore
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateEventW
InitializeCriticalSectionEx
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared

api-ms-win-core-com-l1-1-0

CreateStreamOnHGlobal
CoTaskMemFree
CoRevertToSelf
CoImpersonateClient
CoTaskMemRealloc
CoGetApartmentType
CoCreateGuid
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteValueW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeByAddressAll
WaitOnAddress
WakeConditionVariable
WakeAllConditionVariable
InitializeConditionVariable
Sleep
InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableCS

api-ms-win-security-base-l1-1-0

CopySid
GetTokenInformation
CreateWellKnownSid
EqualSid
GetLengthSid
GetSidSubAuthority
GetSidSubAuthorityCount
AddAccessAllowedAce
ImpersonateLoggedOnUser
RevertToSelf
InitializeAcl
ImpersonateSelf

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalFree
GlobalAlloc
LocalFree

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventProviderEnabled
EventActivityIdControl
EventSetInformation
EventUnregister
EventRegister

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessageVa

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
TrySubmitThreadpoolCallback

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetSystemTimeAsFileTime
GetSystemTime
GetTickCount

api-ms-win-core-file-l1-1-0

FindClose
SetFileAttributesW
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
CreateFileW
FindFirstFileW
GetDiskFreeSpaceExW
DeleteFileW
RemoveDirectoryW
FindFirstFileExW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-path-l1-1-0

PathCchAddBackslash
PathCchRemoveFileSpec
PathAllocCombine

api-ms-win-core-processthreads-l1-1-3

SetThreadDescription

api-ms-win-security-sddl-ansi-l1-1-0

ConvertSidToStringSidA

api-ms-win-core-shlwapi-legacy-l1-1-0

PathMatchSpecW
PathFindFileNameW
PathFindExtensionW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize
GlobalReAlloc
GlobalUnlock
GlobalLock

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpICW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

ntdll

EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
NtQueryInformationToken
ZwQueryWnfStateData
RtlQueryPackageClaims
RtlFreeSid
RtlNtStatusToDosError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 854KB - Virtual size: 854KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wpp_sf
Size: 1024B - Virtual size: 711B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6776f5761e7baece77120c87ada2236

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

oleaut32

api-ms-win-core-debug-l1-1-0

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-processthreads-l1-1-3

api-ms-win-security-sddl-ansi-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-apiquery-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 854KB - Virtual size: 854KB

.wpp_sf Size: 1024B - Virtual size: 711B

.rdata Size: 288KB - Virtual size: 287KB

.data Size: 6KB - Virtual size: 12KB

.pdata Size: 45KB - Virtual size: 44KB

.didat Size: 1024B - Virtual size: 904B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 854KB - Virtual size: 854KB

.wpp_sf
Size: 1024B - Virtual size: 711B

.rdata
Size: 288KB - Virtual size: 287KB

.data
Size: 6KB - Virtual size: 12KB

.pdata
Size: 45KB - Virtual size: 44KB

.didat
Size: 1024B - Virtual size: 904B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB