wshtcpip.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f5ce72651066a2f339f5c30cc9f7ca8778ffccf2c671bec4a69919e073024c6e.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
f5ce72651066a2f339f5c30cc9f7ca8778ffccf2c671bec4a69919e073024c6e.dll
Resource
win10v2004-20240508-en
General
-
Target
f5ce72651066a2f339f5c30cc9f7ca8778ffccf2c671bec4a69919e073024c6e
-
Size
19KB
-
MD5
4577f9fdfaee1eca99253a9ed7964a2e
-
SHA1
13853c85500af030723cb2eb1e157cab1428b060
-
SHA256
f5ce72651066a2f339f5c30cc9f7ca8778ffccf2c671bec4a69919e073024c6e
-
SHA512
17ea09ff08ceb920e1a459d02faee74e98da73f01df649ee5f7dcd6cc2b86a84b0fe4c294a3eafb0bee34cf693eb3a1ccb1f5e1f219abdc94d8ccdb1c667ae59
-
SSDEEP
384:tlfsaG4rN9uegBSwRzslZvw9nOcl1M1CnuCWddPYqYEVJJWwDW:tlUadJ9UB1ReS9nplICnuC4dABe3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5ce72651066a2f339f5c30cc9f7ca8778ffccf2c671bec4a69919e073024c6e
Files
-
f5ce72651066a2f339f5c30cc9f7ca8778ffccf2c671bec4a69919e073024c6e.dll windows:5 windows x86 arch:x86
df8b1a6943bedd6236ca9af8e00a2921
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
ntdll
NtDelayExecution
RtlAppendUnicodeStringToString
RtlUnwind
NtQueryVirtualMemory
RtlIntegerToUnicodeString
RtlInitUnicodeString
NtCreateFile
NtDeviceIoControlFile
RtlAllocateHeap
NtClose
RtlIpv4StringToAddressExW
RtlIpv4AddressToStringExW
_wcsicmp
RtlFreeHeap
wcslen
wcscpy
memmove
ws2_32
ntohs
htonl
Exports
Exports
WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ