SymbolServerGetIndexString
SymbolServerSetOptions
Static task
static1
1 signatures
General
-
Target
symsrv.dll
-
Size
3.3MB
-
MD5
b9c33ea351d60a95d9340465f7526fd9
-
SHA1
0a9fac8dd091d1b6a62837d32222797dbff31c7b
-
SHA256
6acb93a4ed22b04e3a967c7bb7d0aff03241d9465695b8c9d34adc7a47afddcd
-
SHA512
6a8c582b09f48043fa497199d36aabf920be6de54463a7cd3fd5238f90cf85943a6fb50c7d106cfa30f1bb8a2f5845c4bfa72a9dda41da811ec2d8ab28845333
-
SSDEEP
24576:7odRQ3D2vwpTueXGs/9ByXCbQw4kiT1jAXiy9bIRWhmvDXy3O+abJ1ra+I7uosIg:7oTQoIaSGshdKlA2
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource symsrv.dll
Files
-
symsrv.dll.dll windows:6 windows x64
96b129fd0be13d07bbb9c9fea164078b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
RemoveVectoredExceptionHandler
RtlLookupFunctionEntry
AddVectoredExceptionHandler
GetCurrentThread
GetModuleHandleA
ExpandEnvironmentStringsA
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetModuleHandleExA
GetLastError
GetEnvironmentVariableW
ExitProcess
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
IsDebuggerPresent
GetCurrentProcessId
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
RtlCaptureContext
advapi32
CryptDecrypt
CryptCreateHash
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextW
CryptDeriveKey
CryptHashData
dnsapi
DnsQuery_A
vcruntime140
__std_type_info_destroy_list
__C_specific_handler
wcsstr
memset
memcpy
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-string-l1-1-0
_stricmp
_strdup
api-ms-win-crt-runtime-l1-1-0
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_errno
_invalid_parameter_noinfo
Exports
Exports
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 732B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 290KB - Virtual size: 290KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ