EhStorPwdMgr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
EhStorPwdMgr.dll
Resource
win10v2004-20240508-en
General
-
Target
EhStorPwdMgr.dll
-
Size
104KB
-
MD5
46244f090ef41bfc81adf57112b58265
-
SHA1
4c26ba63f61723a53692044db9fab143d0ade408
-
SHA256
96c443da927fd30d426b4a7d2b6ac38d744816116dfe78887bd044c8a86be3be
-
SHA512
80c037819bf552828be65e86af7f7c9ec19d5f71cd2cec5cfe9970df86d7e43f133bfa336fdb3962212ae57ee34167b5c5060db7f55bcc3abcdb2baf9a1a14c3
-
SSDEEP
1536:gqFX6xZj6wgq3lnEG08GQrweomgPHA5kG9mQ7N6wMkNaAYG5n8s+:+xZmwgRG08GSwxPxQZDFcZIZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EhStorPwdMgr.dll
Files
-
EhStorPwdMgr.dll.dll windows:10 windows x86 arch:x86
636a453bf83cfb2507981b7e76d3bfde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
__CxxFrameHandler3
_vsnwprintf
_except_handler4_common
_initterm
malloc
_amsg_exit
_XcptFilter
free
iswalpha
_wcsicmp
wcschr
memset
kernel32
CloseHandle
CreateEventW
GetLastError
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
DisableThreadLibraryCalls
CreateFileW
GetCommandLineW
LocalFree
WideCharToMultiByte
WaitForSingleObject
LocalAlloc
user32
FindWindowExW
GetWindowTextW
EnableWindow
SetFocus
GetParent
PostMessageW
KillTimer
SetTimer
ShowWindow
SendMessageW
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
SetWindowLongW
LoadStringW
GetWindowLongW
SetForegroundWindow
ole32
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
advapi32
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
comctl32
ord17
ord344
CreatePropertySheetPageW
PropertySheetW
oleaut32
SysFreeString
SysAllocString
shell32
CommandLineToArgvW
ntdll
WinSqmAddToStream
Exports
Exports
DllMain
EnhancedStoragePasswordConfig
EnhancedStoragePasswordInitDisk
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ