TabSvc[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

TabSvc.dll
Size

268KB
MD5

0d62ed5a6c54268d08d924aba70b1d94
SHA1

e21080c6ab20dd8b1645f57226443c00f1672f54
SHA256

225ba338813adb8888c6b54cd36a0cd9f0e8335e15e75b417c89253bef2bdfb9
SHA512

5ac18ef93ef2fe5db4706d3f27c483dfde90acec7beb84d50ec75799551ab9b6451aca3fde4754cdfd94b83353aba55e1c5eb00bd49392f1402dd24b37d7ca40
SSDEEP

6144:2wi7W0f694k2UzrcwyFPN7RMfc8LRFuvhaqKVyW2M:75y694k2Uzrc/7RgfwxKVpj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TabSvc.dll

Files

TabSvc.dll
.dll windows:10 windows x64 arch:x64

590699ffd9c6415c6b0af057219eed04

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

TabSvc.pdb

Imports

msvcrt

calloc
_beginthreadex
_aligned_malloc
free
time
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
malloc
_callnewh
_purecall
__C_specific_handler
??1exception@@UEAA@XZ
memmove_s
__CxxFrameHandler4
memcpy_s
_XcptFilter
_amsg_exit
_initterm
_lock
srand
_unlock
__dllonexit
_onexit
_vsnwprintf
?terminate@@YAXXZ
_aligned_free
??1type_info@@UEAA@XZ
memset
memcpy
memcmp
_CxxThrowException
??0exception@@QEAA@XZ
wcscmp

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
NtCreateEvent
NtOpenDirectoryObject
NtClose
RtlInitUnicodeString
NtOpenEvent
NtOpenMutant
RtlVirtualUnwind
EtwEventUnregister
EtwLogTraceEvent
EtwEventWriteTransfer
EtwUnregisterTraceGuids
EtwEventSetInformation
EtwGetTraceEnableFlags
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwEventRegister

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoUninitialize
CoCreateInstance

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegQueryValueExW
RegNotifyChangeKeyValue
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegGetValueW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
CreateProcessAsUserW
CreateThread
GetCurrentProcessId
OpenProcessToken
GetCurrentThreadId
GetExitCodeProcess

api-ms-win-security-base-l1-1-0

GetLengthSid
GetSidLengthRequired
CopySid
InitializeAcl
InitializeSecurityDescriptor
GetTokenInformation
AddAce
AdjustTokenPrivileges
GetSidSubAuthority
SetTokenInformation
DuplicateTokenEx
SetSecurityDescriptorControl
IsValidSid
EqualSid
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetAclInformation
GetAce
InitializeSid

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
ChangeServiceConfigW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

user32

GetSystemMetrics
RegisterDeviceNotificationW
UnregisterDeviceNotification

hid

HidD_GetHidGuid

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken
WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
FreeLibrary

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
InitOnceBeginInitialize
SleepConditionVariableSRW
InitOnceComplete

api-ms-win-core-synch-l1-1-0

SetEvent
WaitForSingleObjectEx
ReleaseSRWLockExclusive
OpenSemaphoreW
CreateEventW
ReleaseMutex
WaitForSingleObject
WaitForMultipleObjectsEx
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSRWLockShared
OpenMutexW
DeleteCriticalSection
ResetEvent
ReleaseSemaphore
AcquireSRWLockShared
EnterCriticalSection
AcquireSRWLockExclusive
CreateSemaphoreExW
CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapAlloc
HeapFree
HeapSize
GetProcessHeap
HeapReAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait
RegisterWaitForSingleObject
WTSGetActiveConsoleSessionId

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InitializeSListHead
InterlockedPushEntrySList

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-rtcore-ntuser-window-l1-1-0

PostThreadMessageW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 188KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

590699ffd9c6415c6b0af057219eed04

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-security-sddl-l1-1-0

user32

hid

wtsapi32

userenv

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-processthreads-l1-1-1

Exports

Exports

Sections

.text Size: 188KB - Virtual size: 184KB

.rdata Size: 52KB - Virtual size: 49KB

.data Size: 4KB - Virtual size: 4KB

.pdata Size: 8KB - Virtual size: 6KB

.didat Size: 4KB - Virtual size: 16B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 616B

.text
Size: 188KB - Virtual size: 184KB

.rdata
Size: 52KB - Virtual size: 49KB

.data
Size: 4KB - Virtual size: 4KB

.pdata
Size: 8KB - Virtual size: 6KB

.didat
Size: 4KB - Virtual size: 16B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 616B