diagnostic.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ad539a1fc5a2e106c954f3c79041ec562cc523addb0c6ba4288b6e6878ee517c.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ad539a1fc5a2e106c954f3c79041ec562cc523addb0c6ba4288b6e6878ee517c.dll
Resource
win10v2004-20240508-en
General
-
Target
ad539a1fc5a2e106c954f3c79041ec562cc523addb0c6ba4288b6e6878ee517c
-
Size
155KB
-
MD5
d5e798b042cb5c018e8b54a4a12de0f7
-
SHA1
0fd40cc5e824a76949c29d74d6ac5d418b55b6fe
-
SHA256
ad539a1fc5a2e106c954f3c79041ec562cc523addb0c6ba4288b6e6878ee517c
-
SHA512
438effd7c35b9abfda581e92b618b6ac4854c6c50ab34600d0c374b86dbbe38e0b70f0dbd35c9a6ae2aa2a6f4c683e6cd261e19cd081a0632306529818e47119
-
SSDEEP
3072:u1DfcG66NQuDmKFCCgM64qN/T53D5VeCdfomotYkMTsk8M:uBcG62RDpECv6lNrjV7dCYXv8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad539a1fc5a2e106c954f3c79041ec562cc523addb0c6ba4288b6e6878ee517c
Files
-
ad539a1fc5a2e106c954f3c79041ec562cc523addb0c6ba4288b6e6878ee517c.dll windows:6 windows x64 arch:x64
042ebf8e599e3b6684dd8761af75a105
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_wfopen
_vsnprintf
_vsnwprintf
_wcsicmp
wcstok
wcsrchr
_purecall
wcschr
calloc
free
??3@YAXPEAX@Z
_wcslwr
memset
__C_specific_handler
malloc
_XcptFilter
_initterm
_amsg_exit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_unlock
__dllonexit
_lock
_onexit
realloc
memcpy
memmove
_CxxThrowException
mbtowc
__mb_cur_max
isleadbyte
_iob
_snprintf
_itoa
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
_isatty
wcsstr
_wtoi64
wcsncmp
_wtol
fclose
__CxxFrameHandler
_errno
_wcsnicmp
_wtoi
??2@YAPEAX_K@Z
??_V@YAXPEAX@Z
_vscwprintf
fgetws
??_U@YAPEAX_K@Z
wdsutil
?IsUpgrade@CUpgradeUserSetting@@SAHXZ
diager
DiagERTerminate
DiagERAddBucketingParameters
DiagERInitialize
DiagERSubmit
DiagERAddFiles
DiagERSetHeader
ntdll
RtlAllocateHeap
RtlFreeHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
kernel32
LoadLibraryA
GetTempPathW
LocalAlloc
DeviceIoControl
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcessId
QueryPerformanceCounter
OutputDebugStringA
LocalFree
CompareStringW
lstrlenW
HeapSize
VirtualProtect
ExpandEnvironmentStringsW
CreateThread
SetFileAttributesW
DebugBreak
GetPrivateProfileSectionW
DeleteFileW
GetWindowsDirectoryW
CloseHandle
GetDiskFreeSpaceExW
GetVersionExA
DuplicateHandle
GetCurrentThreadId
GetShortPathNameW
DeleteCriticalSection
OpenEventW
FindNextFileW
WaitForMultipleObjects
HeapWalk
RemoveDirectoryW
CreateEventW
CreateFileMappingW
GetFileType
GetLocalTime
ResetEvent
FindClose
GetDiskFreeSpaceW
GlobalFree
EnterCriticalSection
MoveFileW
VirtualAlloc
SetLastError
RaiseException
GlobalUnlock
WritePrivateProfileStringW
GetOverlappedResult
CreateFileW
ReadFile
TerminateProcess
CreateProcessA
HeapValidate
GetExitCodeProcess
HeapCreate
LeaveCriticalSection
HeapDestroy
CopyFileW
GetLastError
GlobalMemoryStatusEx
GetSystemInfo
FreeLibrary
GetCurrentProcess
HeapFree
GetSystemDefaultLCID
GetProcessHeap
GetSystemDirectoryW
LoadLibraryW
GetVersionExW
GetProcAddress
GetFullPathNameW
GetFileAttributesW
GetModuleFileNameW
GetDriveTypeW
FindResourceExW
FindResourceW
LoadResource
HeapAlloc
GetVolumePathNameW
SizeofResource
GetTimeZoneInformation
LockResource
GetSystemTime
GetVolumeInformationW
GetEnvironmentVariableW
ExitProcess
GetCommandLineW
GetTempFileNameW
GetPrivateProfileSectionNamesW
HeapReAlloc
GetFileSize
GlobalMemoryStatus
HeapCompact
FindFirstFileW
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
SetErrorMode
CreateProcessW
SystemTimeToFileTime
MoveFileExW
GetLogicalDriveStringsW
GlobalSize
CreateDirectoryW
GlobalLock
WaitForSingleObject
GetComputerNameW
SetEvent
GetLogicalDrives
GetTickCount
VirtualFree
GetSystemTimeAsFileTime
GetPrivateProfileStringW
SetFileTime
WriteFile
InitializeCriticalSection
OpenProcess
GlobalAlloc
GetLocaleInfoW
Sleep
advapi32
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetKeySecurity
ConvertStringSecurityDescriptorToSecurityDescriptorW
oleaut32
SysAllocString
SysStringLen
SysAllocStringByteLen
VariantChangeType
SysFreeString
ole32
CoSetProxyBlanket
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoCreateGuid
CoCreateInstance
shlwapi
PathAppendW
PathFileExistsW
PathCombineW
shell32
ExtractIconExW
ShellExecuteExW
user32
UnregisterClassA
CharLowerW
CharUpperW
CharNextW
GetSystemMetrics
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
setupapi
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
wdscore
WdsSetupLogMessageW
ConstructPartialMsgVW
CurrentIP
WdsSetupLogDestroy
WdsSetupLogInit
EndMinorTask
WdsEnumFirstBlackboardItem
WdsInitializeCallbackArray
StartMinorTask
WdsSubscribeEx
EndMajorTask
WdsSetNextExecutionGroup
WdsEnumNextBlackboardItem
WdsGetBlackboardValue
WdsAbortBlackboardItemEnum
WdsAddModule
WdsPublishImmediateAsync
WdsPublishImmediateEx
WdsPublish
StartMajorTask
WdsValidBlackboard
WdsInitializeDataStringW
WdsInitializeDataBinary
WdsDestroyBlackboard
WdsCreateBlackboard
WdsFreeData
WdsInitializeDataUInt32
WdsSetBlackboardValue
WdsInitializeDataUInt64
unattend
UnattendGetFlag
Exports
Exports
??0CAccessWMI@@IEAA@PEBG@Z
??0CAccessWMI@@QEAA@AEBV0@@Z
??0CCountArray@@QEAA@XZ
??0CExistingOS@@QEAA@XZ
??0CHardwareID@@QEAA@XZ
??0CInstallSource@@QEAA@PEAU_BLACKBOARD@@@Z
??0CMoboAndProcInfo@@QEAA@AEBV0@@Z
??0CMoboAndProcInfo@@QEAA@XZ
??0CNewOS@@QEAA@PEAU_BLACKBOARD@@@Z
??0CSqmDiagConsumer@@QEAA@AEBV0@@Z
??0CSqmDiagConsumer@@QEAA@XZ
??0IDiagConsumer@@QEAA@AEBV0@@Z
??0IDiagConsumer@@QEAA@XZ
??0InstallData@@QEAA@AEBV0@@Z
??0InstallData@@QEAA@PEAU_BLACKBOARD@@@Z
??0MachineHardWare@@QEAA@AEBV0@@Z
??0MachineHardWare@@QEAA@XZ
??0NewSystem@@QEAA@AEBV0@@Z
??0NewSystem@@QEAA@PEAU_BLACKBOARD@@@Z
??0OldSystem@@QEAA@AEBV0@@Z
??0OldSystem@@QEAA@XZ
??1CAccessWMI@@MEAA@XZ
??1CCountArray@@QEAA@XZ
??1CExistingOS@@QEAA@XZ
??1CHardwareID@@QEAA@XZ
??1CInstallSource@@QEAA@XZ
??1CMoboAndProcInfo@@UEAA@XZ
??1CNewOS@@QEAA@XZ
??1CSqmDiagConsumer@@UEAA@XZ
??1IDiagConsumer@@UEAA@XZ
??1InstallData@@QEAA@XZ
??1MachineHardWare@@QEAA@XZ
??1NewSystem@@QEAA@XZ
??1OldSystem@@QEAA@XZ
??4CAccessWMI@@QEAAAEAV0@AEBV0@@Z
??4CCountArray@@QEAAAEAV0@AEBV0@@Z
??4CDiagConsumerAdaptorFactory@@QEAAAEAV0@AEBV0@@Z
??4CExistingOS@@QEAAAEAV0@AEBV0@@Z
??4CHardwareID@@QEAAAEAV0@AEBV0@@Z
??4CInstallSource@@QEAAAEAV0@AEBV0@@Z
??4CMoboAndProcInfo@@QEAAAEAV0@AEBV0@@Z
??4CNewOS@@QEAAAEAV0@AEBV0@@Z
??4CSqmDiagConsumer@@QEAAAEAV0@AEBV0@@Z
??4IDiagConsumer@@QEAAAEAV0@AEBV0@@Z
??4InstallData@@QEAAAEAV0@AEBV0@@Z
??4MachineHardWare@@QEAAAEAV0@AEBV0@@Z
??4NewSystem@@QEAAAEAV0@AEBV0@@Z
??4OldSystem@@QEAAAEAV0@AEBV0@@Z
??_7CAccessWMI@@6B@
??_7CMoboAndProcInfo@@6B@
??_7CSqmDiagConsumer@@6B@
??_7IDiagConsumer@@6B@
??_7InstallData@@6B@
??_7MachineHardWare@@6B@
??_7NewSystem@@6B@
??_7OldSystem@@6B@
?AddToStream@CSqmDiagConsumer@@UEAAKKKK@Z
?AddToStream@CSqmDiagConsumer@@UEAAKKKPEAG@Z
?ConnectWMI@CAccessWMI@@IEAA_NXZ
?CreateInstance@CDiagConsumerAdaptorFactory@@SAKPEAPEAVIDiagConsumer@@@Z
?DeleteInstance@CDiagConsumerAdaptorFactory@@SAXPEAVIDiagConsumer@@@Z
?DestroyArray@CHardwareID@@AEAAXPEAV?$CAtlArray@PEBGV?$CElementTraits@PEBG@ATL@@@ATL@@@Z
?DetectBranch@CExistingOS@@AEAAXXZ
?DetermineInstallImageType@CInstallSource@@SAKPEAU_BLACKBOARD@@@Z
?DetermineInstallMedia@CInstallSource@@SAKPEAU_BLACKBOARD@@@Z
?DetermineInstallMediaHashLabel@CInstallSource@@SAKPEAU_BLACKBOARD@@@Z
?DetermineInstallType@CInstallSource@@SAKPEAU_BLACKBOARD@@@Z
?DisconnectWMI@CAccessWMI@@IEAAXXZ
?DoneReporting@CSqmDiagConsumer@@UEAAKPEAG@Z
?EnumDevices@CHardwareID@@AEAAXXZ
?ExecQuery@CAccessWMI@@IEAA_NXZ
?FetchInfo@CAccessWMI@@IEAA_NPEBGAEAK@Z
?FetchInfo@CAccessWMI@@IEAA_NPEBGAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
?FetchInfo@CAccessWMI@@IEAA_NPEBGAEA_J@Z
?FetchInfo@CAccessWMI@@IEAA_NPEBGPEAG_K@Z
?FillWithBranchDetails@CNewOS@@AEAAXPEAG@Z
?FillWithBuildDate@CNewOS@@AEAAXPEAG@Z
?FillWithVersionAndBuildProperties@CNewOS@@AEAAXPEAG@Z
?FindFilePathInAppDir@CNewOS@@AEAA_NPEAGIPEBG@Z
?GetAvailPhysRAM@CMoboAndProcInfo@@QEAAKXZ
?GetCompatibleIds@CHardwareID@@QEAAPEAPEBGXZ
?GetDeviceDword@CExistingOS@@QEAAKW4eDeviceDword@1@@Z
?GetDeviceDword@CInstallSource@@QEAAKW4eDeviceDword@1@@Z
?GetDeviceDword@CNewOS@@QEAAKW4eDeviceDword@1@@Z
?GetDeviceString@CExistingOS@@QEAAPEBGW4eDeviceString@1@@Z
?GetDeviceString@CNewOS@@QEAAPEBGW4eDeviceString@1@@Z
?GetEdition@CNewOS@@SAPEBGPEAU_BLACKBOARD@@@Z
?GetFailedInstallCount@CExistingOS@@QEAAKXZ
?GetHardwareIds@CHardwareID@@QEAAPEAPEBGXZ
?GetInfo@CCountArray@@QEAAHIAEAK000AEAPEAG@Z
?GetLanguage@CNewOS@@SAPEBGPEAU_BLACKBOARD@@@Z
?GetNewOSDetails@CNewOS@@AEAAXXZ
?GetNewOSVersionInformation@CNewOS@@QEAAXPEAG@Z
?GetNumberOfCompatableIDs@CHardwareID@@QEAAKXZ
?GetNumberOfHardwareIds@CHardwareID@@QEAAKXZ
?GetNumberOfProcessors@CMoboAndProcInfo@@QEAAKXZ
?GetProcAddressWidth@CMoboAndProcInfo@@QEAAKXZ
?GetProcArchitecture@CMoboAndProcInfo@@QEAAKXZ
?GetProcFamily@CMoboAndProcInfo@@QEAAKXZ
?GetProcStepping@CMoboAndProcInfo@@QEAAKXZ
?GetProcessorInfo@CMoboAndProcInfo@@AEAAXXZ
?GetProcessorSpeedInMHz@CMoboAndProcInfo@@QEAAKXZ
?GetProperties@CHardwareID@@AEAAXKPEAXPEAU_SP_DEVINFO_DATA@@PEAV?$CAtlArray@PEBGV?$CElementTraits@PEBG@ATL@@@ATL@@@Z
?GetSkuInfo@CExistingOS@@AEAAKPEAK@Z
?GetSystemVersionDetails@CExistingOS@@AEAAXXZ
?GetTotalPhysRAM@CMoboAndProcInfo@@QEAAKXZ
?GetWinImageArch@CNewOS@@SAKPEAU_BLACKBOARD@@@Z
?InLHPlus@CSqmDiagConsumer@@CAHXZ
?IncrementCount@CCountArray@@QEAAHKKKPEBG@Z
?Initialize@CSqmDiagConsumer@@QEAAKKPEAU_GUID@@PEAG1HK@Z
?Initialize@CSqmDiagConsumer@@UEAAKKPEAU_GUID@@@Z
?IsAlreadyProcessed@InstallData@@UEAAHPEAU_BLACKBOARD@@@Z
?IsAlreadyProcessed@MachineHardWare@@UEAAHPEAU_BLACKBOARD@@@Z
?IsAlreadyProcessed@NewSystem@@UEAAHPEAU_BLACKBOARD@@@Z
?IsAlreadyProcessed@OldSystem@@UEAAHPEAU_BLACKBOARD@@@Z
?IsInternal@CInstallSource@@AEAAHXZ
?IsSubmitSuccessful@CSqmDiagConsumer@@UEAAHPEAG@Z
?LogErrorMessage@CAccessWMI@@IEAAXPEBGKW4tagLOG_SETUPLOG_SEVERITY@@@Z
?LogErrorMessage@CHardwareID@@AEAAXPEBGK@Z
?LogErrorMessageGLE@CHardwareID@@AEAAXPEBGK@Z
?LogFetchInfoError@CAccessWMI@@AEAAXPEBGI@Z
?LogToBB@InstallData@@UEAAXPEAU_BLACKBOARD@@@Z
?LogToBB@MachineHardWare@@UEAAXPEAU_BLACKBOARD@@@Z
?LogToBB@NewSystem@@UEAAXPEAU_BLACKBOARD@@@Z
?LogToBB@OldSystem@@UEAAXPEAU_BLACKBOARD@@@Z
?LogToFile@InstallData@@UEAAXXZ
?LogToFile@MachineHardWare@@UEAAXXZ
?LogToFile@NewSystem@@UEAAXXZ
?LogToFile@OldSystem@@UEAAXXZ
?MAX_CHAR_SIZE@CExistingOS@@0HB
?MAX_CHAR_SIZE@CNewOS@@0HB
?NewElement@CCountArray@@AEAAHKKKPEBG@Z
?NumElements@CCountArray@@QEAAIXZ
?ProcessFailedUpload@CSqmDiagConsumer@@CAKPEAG@Z
?ResetWmiClassName@CAccessWMI@@IEAAXPEBG@Z
?Set@CSqmDiagConsumer@@UEAAKKK@Z
?Set@CSqmDiagConsumer@@UEAAKKPEAG@Z
?Shutdown@CSqmDiagConsumer@@UEAAKXZ
?SqmUploadCallBack@CSqmDiagConsumer@@CAHJPEBGK@Z
?Submit@CSqmDiagConsumer@@UEAAKPEAGH@Z
?m_szEdition@CNewOS@@0PAGA
?m_szLanguage@CNewOS@@0PAGA
CallBack_DiagnosticDataGeneration
CallBack_DiagnosticDataSend
CallBack_EditionID
CallBack_RestartSetup
Callback_Diagnostic_SendStartBeacon
Callback_Diagnostic_Unattend
CollectAndSendDiagDataToSQM
CollectAndSendDiagDataToWatson
DiagnosticDataSendWorker
DoWatsonReporting
Module_Init_Diagnostic
ObtainBucketingParamsFromBlackBoard
ObtainBucketingParamsFromLogFile
ObtainFilesToAttach
ProcessDiagnosticDetails
RestoreIniValues
SetFromBlackBoard
SetFromFile
StartNetworking
g_DiagERApi
g_Kernel32
g_Shell32
g_Sqm
g_Wdscore
Sections
.text Size: 145KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ