Search.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b0c2d197b6b7954fd7da6b22ab0e9c3b3d0c55651cc811e3296effd82003e532.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b0c2d197b6b7954fd7da6b22ab0e9c3b3d0c55651cc811e3296effd82003e532.dll
Resource
win10v2004-20231215-en
General
-
Target
b0c2d197b6b7954fd7da6b22ab0e9c3b3d0c55651cc811e3296effd82003e532
-
Size
714KB
-
MD5
c0d8fd1c78ed261b4da24ef6cf76ca89
-
SHA1
566465dd07024994084e2f302e414d14069f0f54
-
SHA256
b0c2d197b6b7954fd7da6b22ab0e9c3b3d0c55651cc811e3296effd82003e532
-
SHA512
54871ca3ac05173dcc4d5d5215d079a473815f25922daf07efccfed2041df57ae3af469ca8b1ddae4fa578a57538e920b2797283c07ff4023d56844ec33d93c2
-
SSDEEP
12288:Xaknn9gkE/2Zk7eIS49a4PUjzd/H6qXLoy6OKEcOuW5raT1I:Xak9u/2ZQJS4c6Ujp/Hf7Sq1Za5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b0c2d197b6b7954fd7da6b22ab0e9c3b3d0c55651cc811e3296effd82003e532
Files
-
b0c2d197b6b7954fd7da6b22ab0e9c3b3d0c55651cc811e3296effd82003e532.dll regsvr32 windows:6 windows x86 arch:x86
22a75c9e1fac5a671d5aa3fe1dd8b26e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegQueryInfoKeyA
CreateProcessAsUserW
OpenProcessToken
CreateRestrictedToken
kernel32
ResumeThread
GetTickCount
SetEvent
ResetEvent
OutputDebugStringA
DecodePointer
RaiseException
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryExA
LoadResource
SizeofResource
lstrcmpiA
LoadLibraryW
FindResourceA
MultiByteToWideChar
WideCharToMultiByte
IsDBCSLeadByte
VerSetConditionMask
VerifyVersionInfoW
FreeResource
LockResource
TerminateThread
lstrcpyA
lstrlenA
DisableThreadLibraryCalls
GetShortPathNameW
FindAtomW
CreateEventW
GetCurrentProcess
GetCurrentProcessId
CreateFileMappingW
MapViewOfFile
WaitForMultipleObjects
OutputDebugStringW
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
Sleep
CreateThread
SetThreadPriority
user32
SetPropW
CharNextA
CharNextW
DdeUnaccessData
DdeAccessData
DdeCmpStringHandles
DdeFreeStringHandle
DdeCreateStringHandleA
DdeNameService
DdeDisconnect
DdeUninitialize
DdeInitializeA
FindWindowA
GetPropW
GetFocus
SetFocus
MoveWindow
GetWindowRect
ole32
CoTaskMemRealloc
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
oleaut32
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantClear
VariantInit
SysStringLen
SysFreeString
msvcp120
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
??0id@locale@std@@QAE@I@Z
?_Winerror_map@std@@YAPBDH@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
msvcr120
strchr
strpbrk
strstr
atoi
strrchr
strcmp
wcsncpy_s
strcat_s
strcpy_s
isdigit
_gmtime64
_localtime64
_time64
tolower
_stricmp
strncmp
_utime64
swprintf_s
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except1
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_vsnprintf_s
?terminate@@YAXXZ
_except_handler4_common
_amsg_exit
_malloc_crt
_initterm
_initterm_e
__clean_type_info_names_internal
__CppXcptFilter
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
memset
strlen
memmove
_CxxThrowException
__CxxFrameHandler3
memcmp
_set_invalid_parameter_handler
_itoa_s
vsprintf_s
memcpy_s
??_V@YAXPAX@Z
wcslen
calloc
free
malloc
_recalloc
_resetstkoflw
_mbsnbcpy_s
_mbsstr
__RTDynamicCast
Exports
Exports
?myASUCSToLower@@YAGG@Z
?myASUCSToLowerBE@@YAGG@Z
?myASUCSlowercase@@YAPAGPAG@Z
DllRegisterServer
DllUnregisterServer
PlugInMain
_ixAbortIndexingSession@8
_ixCloseIndex@8
_ixConvertQuery@8
_ixCreateIndexCreationParams@4
_ixCreateIndexEx@12
_ixCreateIndexManager@12
_ixCreateStemmer@4
_ixDeleteIndexCreationParams@4
_ixDeleteIndexManager@8
_ixDeleteRecordNum@12
_ixDeleteResultVector@8
_ixDeleteStemmer@8
_ixEndIndexingSession@20
_ixEndRetrievalSession@8
_ixForceCloseOfTemporaryFiles@4
_ixGetTempDiskSpaceUsage@12
_ixIncrementRecord@12
_ixIndexNumber@20
_ixIndexWord@12
_ixIndexWordSpecial@20
_ixNumHits@20
_ixOpenIndex@12
_ixProcessQuery@16
_ixRetrieveMoreRecordData@24
_ixRetrieveRecordData@28
_ixSetBaseDistributedIndexDirectory@12
_ixSetFinalIndexDataFileNameAndPosition@16
_ixSetIndexCreationParams@12
_ixSetLocationForTemporaryFiles@4
_ixStartIndexingSession@8
_ixStartRetrievalSession@8
_ixStem8BitWord@28
_ixStoreMoreRecordData@16
_ixStoreRecordData@16
_ixVectorCurrentHit@24
_ixVectorNextHit@24
Sections
.text Size: 287KB - Virtual size: 287KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 315KB - Virtual size: 316KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ