E:\xml-data\build-dir\CODRU-CL23M-SOURCES\bin\Win32\Release\BdShellExt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
317631.png.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
317631.png.dll
Resource
win10v2004-20231215-en
General
-
Target
317631.png.dll
-
Size
476KB
-
MD5
f32839de7b3209090778a9a4c5e14cce
-
SHA1
ca33599617a5de46cb3e726d66eee9d48e5a78af
-
SHA256
aab9e3d3f923f7c17694df3bd395aea1112f87e63580c1762579c43056d3b2da
-
SHA512
0aff888a6433bbae83bf2f7694158d25ceb6e3c7083b447cfb9241e529df0971d70598eb5005e048f605237def92f1a89c6172095272fd13b5add85cdab20015
-
SSDEEP
12288:v+P9B4JFF6iIJoLjIE0LO5Q23eankS0HsQBw:vHJaKE5L4US0HJw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 317631.png.dll
Files
-
317631.png.dll.dll regsvr32 windows:6 windows x86 arch:x86
370ebde54530b2016d14ffc9556403dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FindClose
SizeofResource
LockResource
LoadResource
FindResourceExW
FindResourceW
GetLastError
LoadLibraryW
GetProcAddress
FormatMessageA
GetVersionExW
ExpandEnvironmentStringsW
lstrlenW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
FindNextFileW
RaiseException
DecodePointer
DeleteCriticalSection
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetModuleFileNameW
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
HeapSize
HeapDestroy
FreeLibrary
InitializeCriticalSectionEx
LoadLibraryExW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetFileSizeEx
GetFileType
GetStdHandle
IsDebuggerPresent
OutputDebugStringW
LocalFree
CreateFileW
FindFirstFileExW
SetEndOfFile
SetFilePointerEx
CloseHandle
DeviceIoControl
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObjectEx
GetCurrentThreadId
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
EncodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
WriteConsoleW
user32
GetMenuItemInfoW
CreateMenu
SetMenuInfo
GetSysColor
ReleaseDC
GetDC
GetDesktopWindow
GetSystemMetrics
DrawIconEx
GetMenuItemCount
DestroyMenu
SetMenuItemInfoW
InsertMenuW
gdi32
ExtTextOutW
SetBkColor
SelectObject
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
advapi32
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegDeleteValueW
shell32
SHGetInstanceExplorer
ole32
CoTaskMemFree
StringFromIID
shlwapi
SHDeleteKeyW
PathAppendW
PathAddBackslashW
PathRemoveFileSpecW
PathIsRelativeW
Exports
Exports
DllCanUnloadNow
DllInstall
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 197KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 195KB - Virtual size: 194KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ