C:\win10_2055891911\_work\1\s\dist\node_modules\@paulcbetts\spellchecker\build\Release\spellchecker.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a78f2d4e77f40474fb42edbdb806c7041ad91a04e5039d15fcbf7f38dda49aa8.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a78f2d4e77f40474fb42edbdb806c7041ad91a04e5039d15fcbf7f38dda49aa8.dll
Resource
win10v2004-20240419-en
General
-
Target
a78f2d4e77f40474fb42edbdb806c7041ad91a04e5039d15fcbf7f38dda49aa8
-
Size
391KB
-
MD5
df7002d520c42e0d3682b7ce52621261
-
SHA1
fce1f5112c6a844bc93e4b75eeb1d10552e4c878
-
SHA256
a78f2d4e77f40474fb42edbdb806c7041ad91a04e5039d15fcbf7f38dda49aa8
-
SHA512
081ad700bce7a3d57fc61f2bf766a3826ab5ad82f7809261613ae93e82e13b535e5c7d2de07dfdad7f3943edbf83d2248fe40a6063c33c5873e5e98339266941
-
SSDEEP
12288:qz2zs4zNwAuBNh9eI1HZKPpCgyh0Fxu6FAPsByypqSFxnV:qIuBNhQA5KPpvFxu6F3ByKqSX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a78f2d4e77f40474fb42edbdb806c7041ad91a04e5039d15fcbf7f38dda49aa8
Files
-
a78f2d4e77f40474fb42edbdb806c7041ad91a04e5039d15fcbf7f38dda49aa8.dll windows:6 windows x86 arch:x86
ed8eeff88e5fde2fc17fdbdb71b7bc26
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
SetFilePointerEx
HeapSize
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
LCMapStringW
CompareStringW
HeapReAlloc
GetACP
GetStringTypeW
CreateThread
OutputDebugStringW
WriteFile
HeapAlloc
HeapFree
ExitProcess
QueryPerformanceFrequency
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
GetModuleFileNameA
GetFileType
GetStdHandle
SetLastError
RtlUnwind
InterlockedFlushSList
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
GetLastError
DecodePointer
ole32
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
node
?Length@Buffer@node@@YAIV?$Local@VValue@v8@@@v8@@@Z
?Data@Buffer@node@@YAPADV?$Local@VValue@v8@@@v8@@@Z
?HasInstance@Buffer@node@@YA_NV?$Local@VValue@v8@@@v8@@@Z
node_module_register
?New@ObjectTemplate@v8@@SA?AV?$Local@VObjectTemplate@v8@@@2@PAVIsolate@2@V?$Local@VFunctionTemplate@v8@@@2@@Z
?NewInstance@ObjectTemplate@v8@@QAE?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?SetInternalFieldCount@ObjectTemplate@v8@@QAEXH@Z
?Set@Object@v8@@QAE_NIV?$Local@VValue@v8@@@2@@Z
?Set@Object@v8@@QAE_NV?$Local@VValue@v8@@@2@0@Z
?InternalFieldCount@Object@v8@@QAEHXZ
?SetInternalField@Object@v8@@QAEXHV?$Local@VValue@v8@@@2@@Z
?SetAlignedPointerInInternalField@Object@v8@@QAEXHPAX@Z
?New@Object@v8@@SA?AV?$Local@VObject@v8@@@2@PAVIsolate@2@@Z
?SlowGetInternalField@Object@v8@@AAE?AV?$Local@VValue@v8@@@2@H@Z
?SlowGetAlignedPointerFromInternalField@Object@v8@@AAEPAXH@Z
?Length@String@v8@@QBEHXZ
?Write@String@v8@@QBEHPAGHHH@Z
?NewFromUtf8@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PAVIsolate@2@PBDW4NewStringType@2@H@Z
??0Utf8Value@String@v8@@QAE@V?$Local@VValue@v8@@@2@@Z
??1Utf8Value@String@v8@@QAE@XZ
??0EscapableHandleScope@v8@@QAE@PAVIsolate@1@@Z
?Escape@EscapableHandleScope@v8@@AAEPAPAVObject@internal@2@PAPAV342@@Z
?ToInteger@Value@v8@@QBE?AV?$MaybeLocal@VInteger@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?GlobalizeReference@V8@v8@@CAPAPAVObject@internal@2@PAVIsolate@42@PAPAV342@@Z
?DisposeGlobal@V8@v8@@CAXPAPAVObject@internal@2@@Z
?MakeWeak@V8@v8@@CAXPAPAVObject@internal@2@PAXP6AXABV?$WeakCallbackInfo@X@2@@ZW4WeakCallbackType@2@@Z
?ClearWeak@V8@v8@@CAPAXPAPAVObject@internal@2@@Z
?ToLocalEmpty@V8@v8@@CAXXZ
?New@FunctionTemplate@v8@@SA?AV?$Local@VFunctionTemplate@v8@@@2@PAVIsolate@2@P6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@V?$Local@VSignature@v8@@@2@HW4ConstructorBehavior@2@@Z
?GetFunction@FunctionTemplate@v8@@QAE?AV?$Local@VFunction@v8@@@2@XZ
?InstanceTemplate@FunctionTemplate@v8@@QAE?AV?$Local@VObjectTemplate@v8@@@2@XZ
?SetClassName@FunctionTemplate@v8@@QAEXV?$Local@VString@v8@@@2@@Z
?New@Array@v8@@SA?AV?$Local@VArray@v8@@@2@PAVIsolate@2@H@Z
?Error@Exception@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z
?Set@Template@v8@@QAEXV?$Local@VName@v8@@@2@V?$Local@VData@v8@@@2@W4PropertyAttribute@2@@Z
??0HandleScope@v8@@QAE@PAVIsolate@1@@Z
??1HandleScope@v8@@QAE@XZ
?CreateHandle@HandleScope@v8@@CAPAPAVObject@internal@2@PAVHeapObject@42@PAV342@@Z
?CreateHandle@HandleScope@v8@@KAPAPAVObject@internal@2@PAVIsolate@42@PAV342@@Z
?GetCurrent@Isolate@v8@@SAPAV12@XZ
?GetCurrentContext@Isolate@v8@@QAE?AV?$Local@VContext@v8@@@2@XZ
?ThrowException@Isolate@v8@@QAE?AV?$Local@VValue@v8@@@2@V32@@Z
?NewFromUnsigned@Integer@v8@@SA?AV?$Local@VInteger@v8@@@2@PAVIsolate@2@I@Z
?New@External@v8@@SA?AV?$Local@VExternal@v8@@@2@PAVIsolate@2@PAX@Z
?Value@External@v8@@QBEPAXXZ
Exports
Exports
_register_spellchecker_
Sections
.text Size: 216KB - Virtual size: 216KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 131KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ