P:\Target\x86\ship\mscdm\x-none\mscdm.pdb
Static task
static1
Behavioral task
behavioral1
Sample
44e658b6341426ec19c715ae68ec3a9ea148fbae823eb167acc786dec8da08db.dll
Resource
win7-20240220-en
General
-
Target
44e658b6341426ec19c715ae68ec3a9ea148fbae823eb167acc786dec8da08db
-
Size
572KB
-
MD5
e45d4a03daed25dab7b2d028e8dd2827
-
SHA1
1492678a5e51c415427df949c392ad81785ee4ea
-
SHA256
44e658b6341426ec19c715ae68ec3a9ea148fbae823eb167acc786dec8da08db
-
SHA512
648211fe4f3628112ed012fb59363e77c09345e10f276f08b090630f371e7710c611239fb6f8e94a186f56b708647013c2eff2bd57d0a1cd30602efe8e75a2d5
-
SSDEEP
12288:IXItqgyK+6K9EN0k1xErOBBm4HRUl64aZgkZFt4Ya3:J5yNz9E3ZBNxUfaqkh0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44e658b6341426ec19c715ae68ec3a9ea148fbae823eb167acc786dec8da08db
Files
-
44e658b6341426ec19c715ae68ec3a9ea148fbae823eb167acc786dec8da08db.dll regsvr32 windows:6 windows x86 arch:x86
ede47f715d14052027725b8aebadbe1b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcr100
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
vswprintf_s
calloc
_vsnwprintf_s
_wtol
??_V@YAXPAX@Z
??2@YAPAXI@Z
memcpy_s
wcscat_s
wcscpy_s
wcsncpy_s
wcsstr
free
malloc
_recalloc
??_U@YAPAXI@Z
__CxxFrameHandler3
memset
iswspace
memcpy
realloc
memcmp
memmove
wcschr
wcscspn
??3@YAXPAX@Z
kernel32
GetCurrentProcessId
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
HeapFree
HeapAlloc
WerRegisterMemoryBlock
VirtualProtect
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryA
HeapSetInformation
GetProcessHeap
QueryPerformanceCounter
GetModuleFileNameA
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
lstrcmpiW
lstrlenW
FindResourceW
MultiByteToWideChar
WaitForSingleObject
GetCurrentThreadId
GetSystemDefaultLCID
SetEvent
WaitForMultipleObjects
Sleep
CompareStringW
WideCharToMultiByte
GetUserDefaultLCID
InitializeCriticalSection
ole32
CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc
StringFromCLSID
CoGetMalloc
CoCreateInstance
CoTaskMemAlloc
StringFromGUID2
oleaut32
VariantClear
VariantCopy
VariantInit
VarCmp
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VarSu
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetElement
VarBstrCmp
SetErrorInfo
GetErrorInfo
CreateErrorInfo
VariantChangeTypeEx
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
SysFreeString
VarAdd
advapi32
RegOpenKeyExA
RegCreateKeyExW
RegDeleteKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
mfc100u
ord3413
ord2068
ord2062
ord2064
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 281KB - Virtual size: 280KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 275KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ