bitsperf.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bitsperf.dll
Resource
win10v2004-20240508-en
General
-
Target
bitsperf.dll
-
Size
26KB
-
MD5
82ca769f90474d5193abd865d12be7ed
-
SHA1
41928814db8f3b5eaa437816fafff69b5f2ea6cb
-
SHA256
937a83a1d023ad6cae7c3d9677c7c33cf8f5f7afa3b263c17e1bb6409e06a5d2
-
SHA512
4948bd414a8c6fa4aabbb9ff93fc3de97fab7801f0728e1209d2a9d2d5f3618f14842caea82e93d68eeb989abd8c7a6f20fc6e78644eff86af1d3180d0e8d49f
-
SSDEEP
768:VrfH5teup/XrZOA2jlX3YGB9X7/EKm4fTx/LzUmrI:VrSuBrZMjlX30ITxUmrI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bitsperf.dll
Files
-
bitsperf.dll.dll windows:10 windows x86 arch:x86
ecadf0428408ba7cd17471037a52cf50
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o___std_type_info_destroy_list
_o___stdio_common_vswprintf
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
memcpy
_o__seh_filter_dll
_o__wcsicmp
_except_handler4_common
__CxxFrameHandler3
api-ms-win-crt-string-l1-1-0
memset
ntdll
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage
EtwGetTraceLoggerHandle
RtlGetPersistedStateLocation
RtlNtStatusToDosError
EtwGetTraceEnableLevel
rpcrt4
UuidToStringW
RpcStringFreeW
UuidCreate
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
api-ms-win-core-com-l1-1-0
CoCreateInstance
api-ms-win-core-memory-l1-1-0
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
Exports
Exports
??0CPerfMon@@QAE@PAGPAU_PERF_ITEM@0@@Z
??1CPerfMon@@QAE@XZ
??4CPerfMon@@QAEAAV0@ABV0@@Z
?CalcBytesForPerfObject@CPerfMon@@ABEKPAU__OBJECT_ORD@1@@Z
?CalcPerfMetrics@CPerfMon@@ABEXPAU__OBJECT_ORD@1@PAU__INSTANCE_ID@1@PAU_PERF_METRICS@1@PAPAU_PERF_ITEM@1@@Z
?Collect@CPerfMon@@QAEKPAGPAPAEPAK2@Z
?CollectAllObjects@CPerfMon@@ABEKPAGPAPAEPAK2@Z
?CollectAnObject@CPerfMon@@ABEKPAU__OBJECT_ORD@1@PAPAE@Z
?ConvertInstIdToInUseInstId@CPerfMon@@ABEHPAU__OBJECT_ORD@1@PAU__INSTANCE_ID@1@@Z
?CounterIdToObjectOrd@CPerfMon@@ABEPAU__OBJECT_ORD@1@PAU__COUNTER_ID@1@PAH@Z
?CounterIdToPerfItem@CPerfMon@@ABEPAU_PERF_ITEM@1@PAU__COUNTER_ID@1@@Z
?CounterIdToPerfItemIndex@CPerfMon@@ABEHPAU__COUNTER_ID@1@PAH@Z
?CounterOrdToPerfItem@CPerfMon@@ABEPAU_PERF_ITEM@1@PAU__OBJECT_ORD@1@PAU__COUNTER_ORD@1@@Z
?DetermineObjectsToCollect@CPerfMon@@ABEXPAU__OBJECT_ORD@1@@Z
?GetCounter32@CPerfMon@@QAEPAJPAU__COUNTER_ID@1@PAU__INSTANCE_ID@1@@Z
?GetCounter64@CPerfMon@@QAEPA_JPAU__COUNTER_ID@1@PAU__INSTANCE_ID@1@@Z
?GetCounter@CPerfMon@@AAEPAEPAU__COUNTER_ID@1@PAU__INSTANCE_ID@1@@Z
?HowManyInstancesAreInUse@CPerfMon@@ABEHPAU__OBJECT_ORD@1@@Z
?IdToPerfItemIndex@CPerfMon@@ABEHHK@Z
?Initialize@CPerfMon@@QAEKH@Z
?InitializePerfMon@CPerfMon@@AAEKH@Z
?IsValidInstId@CPerfMon@@ABEHPAU__OBJECT_ORD@1@PAU__INSTANCE_ID@1@@Z
?IsValidObjOrd@CPerfMon@@ABEHPAU__OBJECT_ORD@1@@Z
?ObjectIdToObjectOrd@CPerfMon@@ABEPAU__OBJECT_ORD@1@PAU__OBJECT_ID@1@@Z
?ObjectIdToPerfItem@CPerfMon@@ABEPAU_PERF_ITEM@1@PAU__OBJECT_ID@1@@Z
?ObjectIdToPerfItemIndex@CPerfMon@@ABEHPAU__OBJECT_ID@1@@Z
?ObjectOrdToPerfItem@CPerfMon@@ABEPAU_PERF_ITEM@1@PAU__OBJECT_ORD@1@@Z
?ObjectOrdToPerfItemIndex@CPerfMon@@ABEHPAU__OBJECT_ORD@1@@Z
?VerifyPerfItemTable@CPerfMon@@AAEKXZ
PerfMon_Close
PerfMon_Collect
PerfMon_Open
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ