Windows[.]Storage[.]Search[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
Windows.Storage.Search.dll
Size 1.3MB
Sample260812-mlv3ca11hs
SHA256 414b4837f01501392e38ac78bacb32485d20d48c5b2f84041e1807e51d5406a9
MD5 375ba48ac69e3787dc9e16f36ddd4822
SHA1 f46477d5d8f2f699343c9a02670a6c327708e114
SHA512 2a132183ab9093fcb87623759cca7162a2a7675f3ae223da191a65abeba499c69c757ba530cf253d2b68ec57fd8d3eda3880a5604489833e93037f128b99d00d
SSDEEP 24576:QoThBOBUANr67SRbHrUNShXyvk5mhZwZMIlIVvylFd:QoTmBXrJ1LUNShX95SZwOIlIVY
TLSH
T190556B5E16EC01E5D7BAE27CC5470A1EF6B17422232256CB0269817D9F3BFE45A3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows.Storage.Search.dll

File Explorer

Windows.Storage.Search.dll

.dll 1.3MB

Windows.Storage.Search.dll

IMPHASH 95fd899b6f1f5ee8a6c2814c72754f6b
SHA256 414b4837f01501392e38ac78bacb32485d20d48c5b2f84041e1807e51d5406a9
MD5 375ba48ac69e3787dc9e16f36ddd4822
SHA1 f46477d5d8f2f699343c9a02670a6c327708e114
SHA512 2a132183ab9093fcb87623759cca7162a2a7675f3ae223da191a65abeba499c69c757ba530cf253d2b68ec57fd8d3eda3880a5604489833e93037f128b99d00d
SSDEEP 24576:QoThBOBUANr67SRbHrUNShXyvk5mhZwZMIlIVvylFd:QoTmBXrJ1LUNShX95SZwOIlIVY
TLSH
T190556B5E16EC01E5D7BAE27CC5470A1EF6B17422232256CB0269817D9F3BFE45A3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

430896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Windows.Storage.Search.pdb

msvcp_win

?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency _Query_perf_counter ?_Xout_of_range@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e

api-ms-win-crt-private-l1-1-0

_o__purecall _o__register_onexit_function _o__resetstkoflw _o__seh_filter_dll _o__set_errno _o__wcsicmp _o__wcsnicmp _o__wtof _o_abort memmove _o_ceilf _o_iswalnum _o_iswcntrl _o_iswprint _o_iswspace _o_pow _o_strtoul _o_terminate _o_wcstok_s _o_wcstol __CxxFrameHandler3 __current_exception __current_exception_context _o__invalid_parameter_noinfo_noreturn _o__invalid_parameter_noinfo _o__initialize_onexit_table _o__initialize_narrow_environment _o__get_errno _o__execute_onexit_table _o__errno _o__crt_atexit _o__configure_narrow_argv _o__cexit _o___stdio_common_vswprintf _o___stdio_common_vsprintf_s _o___stdio_common_vsprintf _o___std_type_info_destroy_list _o___std_exception_destroy _o___std_exception_copy wcsstr __C_specific_handler __std_terminate __CxxFrameHandler4 _CxxThrowException memcmp memcpy

api-ms-win-crt-string-l1-1-0

strncmp strcmp wcscmp memset

shcore

ord192 ord130 SHStrDupW SHUnicodeToAnsi ord142 IUnknown_QueryService ord141 IUnknown_Set IStream_Reset SHCreateMemStream IStream_Read IStream_Write IStream_ReadStr IStream_WriteStr ord144 SHCreateStreamOnFileEx ord190 SHRegGetValueW ord200 ord123 SHTaskPoolQueueTask ord143 ord145 ord193 IStream_Size ord212 IUnknown_SetSite SHCreateThreadWithHandle ord188 ord213 ord172 ord170 SHCreateThread ord120

windows.storage

ILFindChild ord850 ord846 ord27 SHGetPathFromIDListEx ord824 ShellExecuteExW ord90 ord789 ILFindLastID ILFree SHParseDisplayName SHGetIDListFromObject SHCreateShellItemArrayFromShellItem SHCreateItemInKnownFolder ord147 SHCreateItemFromIDList SHCreateShellItemArrayFromIDLists ord880 ord2007 ord910 SHGetFolderPathEx SHSetLocalizedName ord100 SHBindToParent ILCloneFirst SHCreateItemWithParent SHCreateDataObject ord74 ILCombine ILGetNext ILClone SHCreateItemFromParsingName SHBindToObject SHGetKnownFolderPath ILRemoveLastID ILGetSize ord823 ord851 SHBindToFolderIDListParent SHBindToFolderIDListParentEx SHGetKnownFolderIDList SHGetSpecialFolderLocation SHChangeNotify SHGetItemFromObject ord68 ord788 AssocCreateForClasses SHCreateDefaultExtractIcon ord740 ord264 ord866 ord791 AssocGetDetailsOfPropKey ILIsParent ord914 ord911 ord928 ord781 ord873 CShellItemArrayAsCollection_CreateInstance SHGetStockIconInfo ILIsEqual ord95 ord644 ord645 ord2 ord4 SHGetDesktopFolder

api-ms-win-core-libraryloader-l1-2-0

LockResource LoadResource FindResourceExW LoadLibraryExW SizeofResource GetModuleFileNameW FreeLibrary GetProcAddress GetModuleFileNameA DisableThreadLibraryCalls GetModuleHandleExW LoadStringW GetModuleHandleW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize Sleep InitOnceExecuteOnce InitOnceComplete

api-ms-win-core-string-l1-1-0

CompareStringW MultiByteToWideChar GetStringTypeW CompareStringOrdinal WideCharToMultiByte

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx OpenSemaphoreW InitializeSRWLock CreateMutexExW CreateEventExW EnterCriticalSection AcquireSRWLockShared ResetEvent LeaveCriticalSection ReleaseSRWLockShared SetEvent AcquireSRWLockExclusive InitializeCriticalSectionEx WaitForMultipleObjectsEx CreateSemaphoreExW InitializeCriticalSectionAndSpinCount InitializeCriticalSection ReleaseSRWLockExclusive CreateEventW WaitForSingleObject DeleteCriticalSection ReleaseSemaphore ReleaseMutex TryAcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapFree GetProcessHeap HeapReAlloc HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter SetErrorMode UnhandledExceptionFilter RaiseException SetLastError

api-ms-win-core-com-l1-1-0

CoEnableCallCancellation CoGetMalloc PropVariantClear CoInitializeEx CoCreateInstance CoTaskMemAlloc GetHGlobalFromStream CreateStreamOnHGlobal CoTaskMemFree CoUninitialize CoCreateFreeThreadedMarshaler PropVariantCopy StringFromCLSID CoCreateGuid CoTaskMemRealloc StringFromGUID2 CoWaitForMultipleHandles CoGetApartmentType CLSIDFromString CoCancelCall CoDisableCallCancellation

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer CreateThreadpoolTimer CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess TerminateProcess SetThreadToken OpenThreadToken TlsFree TlsSetValue OpenProcessToken TlsGetValue GetCurrentThreadId GetCurrentThread GetCurrentProcessId TlsAlloc GetProcessId

api-ms-win-core-localization-l1-2-0

ResolveLocaleName GetSystemPreferredUILanguages LocaleNameToLCID GetSystemDefaultLCID FormatMessageW GetLocaleInfoEx GetUserDefaultLCID IsValidLocaleName FindNLSString LCMapStringW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-sysinfo-l1-1-0

GlobalMemoryStatusEx GetTickCount64 GetSystemDirectoryW GetLocalTime GetTickCount GetSystemTimeAsFileTime

api-ms-win-core-heap-l2-1-0

GlobalAlloc GlobalFree LocalFree LocalAlloc LocalReAlloc

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-string-l2-1-0

CharLowerBuffW CharLowerW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformationForYear FileTimeToSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime

api-ms-win-core-file-l1-1-0

GetDriveTypeW GetDiskFreeSpaceExW CompareFileTime GetVolumePathNameW CreateFileW

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW RegCloseKey RegQueryValueExW RegOpenKeyExW RegGetValueW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec PathIsUNCEx

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-file-l1-2-3

GetTempPath2W

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-sysinfo-l1-2-1

GetPhysicallyInstalledSystemMemory

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW SetEnvironmentVariableW ExpandEnvironmentStringsW

api-ms-win-service-management-l1-1-0

CloseServiceHandle StartServiceW OpenSCManagerW OpenServiceW

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx ChangeServiceConfigW

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile

rpcrt4

UuidCreate

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference WindowsGetStringRawBuffer WindowsDeleteString

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer EventUnregister EventActivityIdControl

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-com-private-l1-1-0

CoRegisterInitializeSpy CoRevokeInitializeSpy

api-ms-win-core-url-l1-1-0

UrlUnescapeW PathCreateFromUrlAlloc UrlIsW ParseURLW PathIsURLW

api-ms-win-core-kernel32-private-l1-1-0

CompareCalendarDates

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx

api-ms-win-core-normalization-l1-1-0

GetStringScripts

api-ms-win-core-shlwapi-legacy-l1-1-0

PathGetDriveNumberW PathParseIconLocationW PathIsUNCW PathFindFileNameW PathMatchSpecExW PathRemoveFileSpecW PathAppendW SHExpandEnvironmentStringsW PathRemoveBackslashW PathRemoveExtensionW

api-ms-win-core-calendar-l1-1-0

UpdateCalendarDayOfWeek ConvertCalDateTimeToSystemTime ConvertSystemTimeToCalDateTime AdjustCalendarDate GetCalendarSupportedDateRange

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer CreateTimerQueueTimer

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch StrToIntW StrChrW StrPBrkW StrCmpW StrCmpICW StrCmpNICW StrStrIW StrDupW StrCSpnW StrCmpLogicalW StrStrW StrCmpNW StrCmpCW StrTrimW StrToIntExW StrCmpIW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA lstrcmpW lstrlenW lstrcmpA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock GlobalSize

api-ms-win-shell-shellcom-l1-1-0

SHCoCreateInstance

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

RegisterClipboardFormatW

api-ms-win-shlwapi-ie-l1-1-0

ord24 ConnectToConnectionPoint

api-ms-win-shlwapi-winrt-storage-l1-1-1

SHGetViewStatePropertyBag ord544 ord193 AssocCreate ord317 IUnknown_GetWindow PathCompactPathExW ShellMessageBoxW

ntdll

EtwEventEnabled EtwEventWrite RtlIsCloudFilesPlaceholder EtwEventRegister EtwEventUnregister EtwEventWriteTransfer EtwEventSetInformation EtwEventActivityIdControl

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

icu

u_charType

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

996KB

Virtual Size

993KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

204KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

56KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Windows.Storage.Search.dll

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

shcore

windows.storage

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-file-l1-2-3

api-ms-win-core-synch-l1-2-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-memory-l1-1-0

rpcrt4

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-kernel32-private-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-normalization-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-calendar-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-shell-shellcom-l1-1-0

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

api-ms-win-shlwapi-ie-l1-1-0

api-ms-win-shlwapi-winrt-storage-l1-1-1

ntdll

api-ms-win-stateseparation-helpers-l1-1-0

icu

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic