d:\dbs\el\dec\target\x86\ship\oneaddins\x-none\ONBttnIE.pdb
Static task
static1
Behavioral task
behavioral1
Sample
240beb7f8cc7df9e2653362e839fd7ab71d11f3546921dd20a6cd84352cae5a9.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
240beb7f8cc7df9e2653362e839fd7ab71d11f3546921dd20a6cd84352cae5a9.dll
Resource
win10v2004-20240319-en
General
-
Target
240beb7f8cc7df9e2653362e839fd7ab71d11f3546921dd20a6cd84352cae5a9
-
Size
432KB
-
MD5
48925b469a437337df8ae1cc64197627
-
SHA1
856f7cdb1412be8db1eb87597bf29a6c3adf6611
-
SHA256
240beb7f8cc7df9e2653362e839fd7ab71d11f3546921dd20a6cd84352cae5a9
-
SHA512
6a180fd120ae0e0f45b61683a57e24af81dd4aaa97e0912cb163a30cb20dd8d25e5aa88b8bfda3fdad7b98230e5df2f59c0822dd1228076860a5aeb9a4230da0
-
SSDEEP
12288:AV9bK7sp02sSN3SQRb4BuA4qarK/Lbygl8vA/JJaXQKeX/y:EbKIpIEIV8Knyo/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 240beb7f8cc7df9e2653362e839fd7ab71d11f3546921dd20a6cd84352cae5a9
Files
-
240beb7f8cc7df9e2653362e839fd7ab71d11f3546921dd20a6cd84352cae5a9.dll regsvr32 windows:6 windows x86 arch:x86
d612a105c9296ceb894c3e7894e2f0d8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
TryEnterCriticalSection
EnterCriticalSection
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSectionEx
FormatMessageW
GetLastError
RaiseException
DecodePointer
LocalFree
DeleteCriticalSection
GetCurrentProcessId
SizeofResource
EncodePointer
MultiByteToWideChar
LoadResource
FindResourceW
GetProcAddress
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
TlsFree
FlsFree
TlsAlloc
TlsGetValue
FlsGetValue
TlsSetValue
FlsSetValue
CompareStringEx
GetLocaleInfoEx
SetLastError
CloseHandle
GetCurrentThreadId
WaitForSingleObjectEx
ResetEvent
SetEvent
OutputDebugStringW
GetShortPathNameA
GetModuleFileNameA
IsWow64Process
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
CreateEventW
VerSetConditionMask
VerifyVersionInfoW
GetSystemDirectoryW
GetUserDefaultLCID
LocaleNameToLCID
FileTimeToSystemTime
LCIDToLocaleName
GetUserDefaultLocaleName
HeapFree
OutputDebugStringA
GetModuleHandleA
LoadLibraryW
HeapAlloc
IsDebuggerPresent
GetProcessHeap
EnumSystemLocalesEx
GetSystemDefaultLocaleName
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
ole32
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
CoInitialize
CoUninitialize
vcruntime140
wcschr
__std_type_info_destroy_list
memcpy
__CxxFrameHandler3
_except_handler4_common
wcsrchr
_purecall
__std_terminate
wcsstr
__std_exception_destroy
__std_exception_copy
memmove
memset
_CxxThrowException
msvcp140
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
??Bid@locale@std@@QAEIXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@F@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Thrd_id
?_Xlength_error@std@@YAXPBD@Z
_Xtime_get_ticks
_Thrd_sleep
?_Xbad_alloc@std@@YAXXZ
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?_XGetLastError@std@@YAXXZ
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z
api-ms-win-crt-heap-l1-1-0
free
_recalloc
malloc
realloc
api-ms-win-crt-string-l1-1-0
wcscpy_s
wcscat_s
wcsncat_s
_wcsicmp
wcscmp
wcstok_s
wcsnlen
isdigit
wcsncpy_s
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_errno
_invalid_parameter_noinfo
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
terminate
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_s
api-ms-win-crt-math-l1-1-0
_except1
api-ms-win-crt-convert-l1-1-0
_wtoi
api-ms-win-crt-locale-l1-1-0
__initialize_lconv_for_unsigned_char
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 241KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ