ActiveSyncCsp[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ActiveSyncCsp.dll
Size

124KB
MD5

86da013f02004a5e1d8a3859ec05a23e
SHA1

7ad5e0a8f289d73cb7d1a977a5e5894487222d9f
SHA256

3f297b259f972f0c4fad1f30aae414d472d5894ae39ab0ed9bdfabca6dc1aa34
SHA512

05ea2af8cf5035b7ed28546188557cc3db40420ea792fb2f0050a1a9c66eb137aedf8e1bd4301a08704d727138a25c6a8cd3f701759a90733f8e08cdadb8993e
SSDEEP

3072:R2DPTTpi7MOTUFL3zCOd1chojVzvfD9fssqs0:R2DPTTpiwCUFL3GOd1cL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ActiveSyncCsp.dll

Files

ActiveSyncCsp.dll
.dll windows:10 windows x64 arch:x64

b1c7cfa9b5a0aa128f7d26f6e14d830f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ActiveSyncCsp.pdb

Imports

msvcrt

wcscpy_s
_lock
_unlock
_XcptFilter
__C_specific_handler
_onexit
_callnewh
malloc
_amsg_exit
memcmp
free
__dllonexit
realloc
memcpy
_purecall
_initterm
_vscwprintf
_vsnwprintf_s
_strnicmp
_wtoi
_itow
memmove_s
__CxxFrameHandler4
_wcsicmp
__CxxFrameHandler3
memcpy_s
_vsnwprintf
memset
wcscmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlReportException

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
FreeLibrary
GetModuleFileNameA
GetModuleHandleExA
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
ReleaseSRWLockExclusive
CreateMutexExW
DeleteCriticalSection
ReleaseMutex
WaitForSingleObject
AcquireSRWLockExclusive
LeaveCriticalSection
WaitForSingleObjectEx
ReleaseSemaphore
InitializeCriticalSection
ReleaseSRWLockShared
EnterCriticalSection
SetEvent
CreateEventExW
CreateSemaphoreExW
AcquireSRWLockShared
InitializeSRWLock

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
StringFromGUID2
CoWaitForMultipleObjects
CoTaskMemFree
CLSIDFromString
CoCreateInstance
CoGetApartmentType

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VariantChangeType
SysAllocStringLen
SysAllocString
VariantInit
SysFreeString

api-ms-win-core-synch-l1-2-0

InitOnceComplete
Sleep
InitOnceBeginInitialize

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteTreeW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoTransformError

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b1c7cfa9b5a0aa128f7d26f6e14d830f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

Exports

Exports

Sections

.text Size: 76KB - Virtual size: 74KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 4KB - Virtual size: 3KB

.pdata Size: 8KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 76KB - Virtual size: 74KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 4KB - Virtual size: 3KB

.pdata
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 1KB