DeviceMetadataParsers.pdb
Static task
static1
Behavioral task
behavioral1
Sample
DeviceMetadataParsers.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
DeviceMetadataParsers.dll
Resource
win10v2004-20240508-en
General
-
Target
DeviceMetadataParsers.dll
-
Size
24KB
-
MD5
3abb6de28866e1329e06a04efd7b1f47
-
SHA1
fd99e4cf1d2e3df351ea6f68852a6d764bafa353
-
SHA256
5da754698780627cce607047b485e9ccc04a5632ed1cbbcb6212f65351d65fb9
-
SHA512
5c2b03bfa935d76c6ff7812c8a6a2215321bdc80e400d860d6b3d4d798b1df75092132526b1e301d530f2367d4f114502494aa95c00f32f6d1b2654c8a481248
-
SSDEEP
384:7qD9SPVKLGi0mvcZ7BHmm06fcj7ejK2AWYfVo7c93xVRWyqAWu3:XAQVHb06kfeEeU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DeviceMetadataParsers.dll
Files
-
DeviceMetadataParsers.dll.dll windows:6 windows x86 arch:x86
9d95881dd5d90a599aea8b761f84fca1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
malloc
memset
_callnewh
_except_handler4_common
free
_amsg_exit
_initterm
_XcptFilter
ntdll
NtQuerySystemInformation
kernel32
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
DisableThreadLibraryCalls
GetLastError
ReadFile
WriteFile
SetFilePointerEx
GetFileSizeEx
CloseHandle
DuplicateHandle
GetCurrentProcess
CreateFileW
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
advapi32
EventUnregister
EventRegister
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
EventWrite
ole32
PropVariantClear
IIDFromString
CoTaskMemAlloc
propsys
PSCreateMemoryPropertyStore
wintrust
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrustEx
CryptCATAdminCalcHashFromFileHandle
crypt32
CertVerifyCertificateChainPolicy
xmllite
CreateXmlReader
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ