MSFLACDecoder.pdb
Static task
static1
Behavioral task
behavioral1
Sample
MSFlacDecoder.dll
Resource
win10v2004-20240508-en
General
-
Target
MSFlacDecoder.dll
-
Size
329KB
-
MD5
c7422d6fca97b05e560c311ce79d9425
-
SHA1
2b128ce5c7c2c86ef28ac65e936ccfcd883da117
-
SHA256
bc63c53932b79e66510226a9231e24e0c3b6fd1a9548e39507c88f8607ee1ed4
-
SHA512
63dd7be8adce98aaaf22424f5de5f7c646deba9136d407f2dbf08e65fb3056a06868f347c10277f6ad77db65cec8c21e8abfdb537fa2afc9e4d9acb33c67bbf8
-
SSDEEP
6144:10Pyjc6H/RxLJ6DVO6XhgYCp9g2mtoyjP/283+:ypi/RLhdGtoyjPvO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MSFlacDecoder.dll
Files
-
MSFlacDecoder.dll.dll regsvr32 windows:10 windows x86 arch:x86
a41e26cedb1c34a268bff0ac90f9e174
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_vsnprintf
strcat_s
memset
swscanf_s
_wutime64
_wcsicmp
wcstok_s
??0exception@@QAE@ABV0@@Z
_wchmod
_vsnprintf_s
free
_CxxThrowException
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler3
_errno
memcpy
??0exception@@QAE@ABQBD@Z
memchr
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
_XcptFilter
_strnicmp
_amsg_exit
_strdup
_except_handler4_common
_onexit
__dllonexit
__iob_func
wcsncmp
_strcmpi
_unlock
_lock
realloc
??1type_info@@UAE@XZ
fclose
calloc
_callnewh
?terminate@@YAXXZ
_purecall
memmove
_vsnwprintf
wcscat_s
wcscpy_s
memcpy_s
malloc
wcsncpy_s
_initterm
_CIlog
_CIsqrt
_ftol2
ceil
memcmp
oleaut32
SysAllocString
VarUI4FromStr
VariantChangeType
VariantClear
VariantInit
api-ms-win-core-synch-l1-2-0
WaitForSingleObject
WaitForMultipleObjectsEx
CreateMutexExW
ResetEvent
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
DeleteCriticalSection
Sleep
SetEvent
OpenSemaphoreW
CreateEventW
api-ms-win-core-libraryloader-l1-2-0
LoadResource
SizeofResource
FindResourceExW
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleFileNameW
api-ms-win-core-com-l1-1-1
PropVariantCopy
CoGetMalloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
IIDFromString
PropVariantClear
CoTaskMemAlloc
CreateStreamOnHGlobal
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-errorhandling-l1-1-1
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
EventWrite
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-1
RoOriginateErrorW
api-ms-win-core-processthreads-l1-1-2
GetCurrentThreadId
TlsSetValue
GetCurrentProcess
CreateThread
TerminateProcess
TlsGetValue
GetCurrentProcessId
api-ms-win-core-shlwapi-obsolete-l1-2-0
QISearch
api-ms-win-core-localization-l1-2-1
FormatMessageW
api-ms-win-core-debug-l1-1-1
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
DebugBreak
api-ms-win-core-heap-l1-2-0
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
DelayLoadFailureHook
api-ms-win-core-sysinfo-l1-2-1
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
propsys
PSStringFromPropertyKey
PSPropertyKeyFromString
InitPropVariantFromCLSID
InitPropVariantFromStringVector
PropVariantToStringVector
PSCreateMemoryPropertyStore
StgSerializePropVariant
StgDeserializePropVariant
PropVariantChangeType
InitPropVariantFromDoubleVector
avrt
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsW
Exports
Exports
??0Application@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0Application@Metadata@FLAC@@QAE@ABV012@@Z
??0Application@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0Application@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0Chain@Metadata@FLAC@@QAE@ABV012@@Z
??0CueSheet@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0CueSheet@Metadata@FLAC@@QAE@ABV012@@Z
??0CueSheet@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0CueSheet@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0Iterator@Metadata@FLAC@@QAE@ABV012@@Z
??0Padding@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0Padding@Metadata@FLAC@@QAE@ABV012@@Z
??0Padding@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0Padding@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0Picture@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0Picture@Metadata@FLAC@@QAE@ABV012@@Z
??0Picture@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0Picture@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0SeekTable@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0SeekTable@Metadata@FLAC@@QAE@ABV012@@Z
??0SeekTable@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0SeekTable@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0SimpleIterator@Metadata@FLAC@@QAE@ABV012@@Z
??0State@Stream@Decoder@FLAC@@QAE@W4FLAC__StreamDecoderState@@@Z
??0Status@Chain@Metadata@FLAC@@QAE@W4FLAC__Metadata_ChainStatus@@@Z
??0Status@SimpleIterator@Metadata@FLAC@@QAE@W4FLAC__Metadata_SimpleIteratorStatus@@@Z
??0StreamInfo@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0StreamInfo@Metadata@FLAC@@QAE@ABV012@@Z
??0StreamInfo@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0StreamInfo@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0Unknown@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0Unknown@Metadata@FLAC@@QAE@ABV012@@Z
??0Unknown@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0Unknown@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0VorbisComment@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0VorbisComment@Metadata@FLAC@@QAE@ABV012@@Z
??0VorbisComment@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0VorbisComment@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??4Application@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4Application@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Application@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4Chain@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4CueSheet@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4CueSheet@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4CueSheet@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4Iterator@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Padding@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4Padding@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Padding@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4Picture@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4Picture@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Picture@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4SeekTable@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4SeekTable@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4SeekTable@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4SimpleIterator@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4State@Stream@Decoder@FLAC@@QAEAAV0123@$$QAV0123@@Z
??4State@Stream@Decoder@FLAC@@QAEAAV0123@ABV0123@@Z
??4Status@Chain@Metadata@FLAC@@QAEAAV0123@$$QAV0123@@Z
??4Status@Chain@Metadata@FLAC@@QAEAAV0123@ABV0123@@Z
??4Status@SimpleIterator@Metadata@FLAC@@QAEAAV0123@$$QAV0123@@Z
??4Status@SimpleIterator@Metadata@FLAC@@QAEAAV0123@ABV0123@@Z
??4StreamInfo@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4StreamInfo@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4StreamInfo@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4Unknown@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4Unknown@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Unknown@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4VorbisComment@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4VorbisComment@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4VorbisComment@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??8Application@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Application@Metadata@FLAC@@QBE_NABV012@@Z
??8Application@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8CueSheet@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8CueSheet@Metadata@FLAC@@QBE_NABV012@@Z
??8CueSheet@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8Padding@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Padding@Metadata@FLAC@@QBE_NABV012@@Z
??8Padding@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8Picture@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Picture@Metadata@FLAC@@QBE_NABV012@@Z
??8Picture@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8Prototype@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Prototype@Metadata@FLAC@@QBE_NABV012@@Z
??8Prototype@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8SeekTable@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8SeekTable@Metadata@FLAC@@QBE_NABV012@@Z
??8SeekTable@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8StreamInfo@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8StreamInfo@Metadata@FLAC@@QBE_NABV012@@Z
??8StreamInfo@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8Unknown@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Unknown@Metadata@FLAC@@QBE_NABV012@@Z
??8Unknown@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8VorbisComment@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8VorbisComment@Metadata@FLAC@@QBE_NABV012@@Z
??8VorbisComment@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Application@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Application@Metadata@FLAC@@QBE_NABV012@@Z
??9Application@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9CueSheet@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9CueSheet@Metadata@FLAC@@QBE_NABV012@@Z
??9CueSheet@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Padding@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Padding@Metadata@FLAC@@QBE_NABV012@@Z
??9Padding@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Picture@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Picture@Metadata@FLAC@@QBE_NABV012@@Z
??9Picture@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Prototype@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Prototype@Metadata@FLAC@@QBE_NABV012@@Z
??9Prototype@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9SeekTable@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9SeekTable@Metadata@FLAC@@QBE_NABV012@@Z
??9SeekTable@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9StreamInfo@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9StreamInfo@Metadata@FLAC@@QBE_NABV012@@Z
??9StreamInfo@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Unknown@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Unknown@Metadata@FLAC@@QBE_NABV012@@Z
??9Unknown@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9VorbisComment@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9VorbisComment@Metadata@FLAC@@QBE_NABV012@@Z
??9VorbisComment@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??BPrototype@Metadata@FLAC@@QBEPBUFLAC__StreamMetadata@@XZ
??BState@Stream@Decoder@FLAC@@QBE?AW4FLAC__StreamDecoderState@@XZ
??BStatus@Chain@Metadata@FLAC@@QBE?AW4FLAC__Metadata_ChainStatus@@XZ
??BStatus@SimpleIterator@Metadata@FLAC@@QBE?AW4FLAC__Metadata_SimpleIteratorStatus@@XZ
??BStream@Decoder@FLAC@@QBE_NXZ
??_7Application@Metadata@FLAC@@6B@
??_7Chain@Metadata@FLAC@@6B@
??_7CueSheet@Metadata@FLAC@@6B@
??_7Iterator@Metadata@FLAC@@6B@
??_7Padding@Metadata@FLAC@@6B@
??_7Picture@Metadata@FLAC@@6B@
??_7SeekTable@Metadata@FLAC@@6B@
??_7SimpleIterator@Metadata@FLAC@@6B@
??_7StreamInfo@Metadata@FLAC@@6B@
??_7Unknown@Metadata@FLAC@@6B@
??_7VorbisComment@Metadata@FLAC@@6B@
?as_cstring@State@Stream@Decoder@FLAC@@QBEPBDXZ
?as_cstring@Status@Chain@Metadata@FLAC@@QBEPBDXZ
?as_cstring@Status@SimpleIterator@Metadata@FLAC@@QBEPBDXZ
?assign@Application@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@CueSheet@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@Padding@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@Picture@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@SeekTable@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@StreamInfo@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@Unknown@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@VorbisComment@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?get_isrc@Track@CueSheet@Metadata@FLAC@@QBEPBDXZ
?get_num_indices@Track@CueSheet@Metadata@FLAC@@QBEEXZ
?get_number@Track@CueSheet@Metadata@FLAC@@QBEEXZ
?get_offset@Track@CueSheet@Metadata@FLAC@@QBE_KXZ
?get_pre_emphasis@Track@CueSheet@Metadata@FLAC@@QBE_NXZ
?get_track@Track@CueSheet@Metadata@FLAC@@QBEPBUFLAC__StreamMetadata_CueSheet_Track@@XZ
?get_type@Track@CueSheet@Metadata@FLAC@@QBEIXZ
?is_valid@Prototype@Metadata@FLAC@@QBE_NXZ
?resolved_as_cstring@State@Stream@Decoder@FLAC@@QBEPBDABV234@@Z
?set_number@Track@CueSheet@Metadata@FLAC@@QAEXE@Z
?set_offset@Track@CueSheet@Metadata@FLAC@@QAEX_K@Z
?set_pre_emphasis@Track@CueSheet@Metadata@FLAC@@QAEX_N@Z
?set_reference@Prototype@Metadata@FLAC@@AAEX_N@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 297KB - Virtual size: 296KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ