agentactivationruntimewindows.pdb
Static task
static1
Behavioral task
behavioral1
Sample
agentactivationruntimewindows.dll
Resource
win10v2004-20240508-en
General
-
Target
agentactivationruntimewindows.dll
-
Size
631KB
-
MD5
1f0b38bc47d7139949fa264850223c57
-
SHA1
8fb509aa8a3b1376a47d17f79abea1c81ccea06e
-
SHA256
8a083fc02aa921da3fd0db353533bbe5947728107aff7c2fb68e80ac3bd552d9
-
SHA512
a991e0a981eceb29885ffcf85afc6b7b5cfad9df0bed4ede41facfbca39b84c9d5f9b15468a83c99e7f50572b34e1e39d90b51e3c9eef77a01f20cb54edafef3
-
SSDEEP
12288:QfcUwoMEgY8d94TCLsRV0pB9wC7wi5fsII7acIXQXBAqLNGNl56ZN:vwi5fsIfcIgXBAqJGAZN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource agentactivationruntimewindows.dll
Files
-
agentactivationruntimewindows.dll.dll windows:10 windows x86 arch:x86
79cd7fa2afbf54bcfa34c594bafd859e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcp_win
_Cnd_do_broadcast_at_thread_exit
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
_Cnd_timedwait
_Mtx_current_owns
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
_Cnd_wait
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
_Cnd_signal
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Thrd_join
_Thrd_id
?_Throw_Cpp_error@std@@YAXH@Z
?_Syserror_map@std@@YAPBDH@Z
_Xtime_get_ticks
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?uncaught_exception@std@@YA_NXZ
_Mtx_unlock
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Xinvalid_argument@std@@YAXPBD@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Xlength_error@std@@YAXPBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__beginthreadex
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__fseeki64
_o__get_stream_buffer_pointers
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__lock_file
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o___std_exception_destroy
memmove
_o__unlock_file
_o__wcsnicmp
_o__wdupenv_s
_o__wgetenv
_o__wrename
_o_ceil
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_floor
_o_fputc
_o_fputwc
_o_fread
_o_free
_o_fsetpos
_o_fwrite
_o_malloc
_o_realloc
_o_setvbuf
_o_terminate
_o_toupper
_o_ungetc
_o_ungetwc
_o_wcstol
_except_handler4_common
_CxxThrowException
_o___stdio_common_vswprintf
__std_terminate
__CxxFrameHandler3
_o___stdio_common_vsprintf_s
_o___std_exception_copy
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
__RTDynamicCast
memchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateMutexW
AcquireSRWLockShared
ReleaseSRWLockShared
ResetEvent
InitializeSRWLock
CreateEventExW
CreateMutexExW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
CreateEventW
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseSemaphore
SetEvent
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapSize
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcessId
TerminateProcess
GetExitCodeThread
SetThreadPriority
SetPriorityClass
OpenProcessToken
GetCurrentProcess
GetCurrentThreadId
TerminateThread
api-ms-win-core-localization-l1-2-0
LocaleNameToLCID
FormatMessageW
ResolveLocaleName
GetUserDefaultLCID
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
oleaut32
VariantClear
VariantChangeType
VariantInit
SysStringLen
SysFreeString
SysAllocString
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer
EventActivityIdControl
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-com-l1-1-0
IIDFromString
CoTaskMemAlloc
PropVariantClear
CoGetApartmentType
CoInitializeEx
CoUninitialize
CoWaitForMultipleHandles
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoInitializeSecurity
StringFromGUID2
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegCloseKey
RegNotifyChangeKeyValue
RegFlushKey
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteTreeW
api-ms-win-core-winrt-string-l1-1-0
WindowsDuplicateString
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoOriginateError
RoTransformError
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
RoUninitialize
RoInitialize
api-ms-win-core-synch-l1-2-0
InitOnceComplete
Sleep
InitOnceBeginInitialize
api-ms-win-security-base-l1-1-0
MakeAbsoluteSD
DestroyPrivateObjectSecurity
AllocateAndInitializeSid
FreeSid
AdjustTokenPrivileges
GetTokenInformation
api-ms-win-core-registry-l2-1-0
RegOpenKeyW
RegCreateKeyW
RegEnumKeyW
RegDeleteKeyW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
GetEnvironmentVariableW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
mmdevapi
ord27
ord21
ord17
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-shcore-stream-l1-1-0
SHCreateMemStream
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
api-ms-win-power-base-l1-1-0
PowerUnregisterSuspendResumeNotification
PowerRegisterSuspendResumeNotification
GetPwrCapabilities
api-ms-win-power-setting-l1-1-0
PowerReadDCValue
PowerSettingRegisterNotification
PowerGetActiveScheme
PowerSettingUnregisterNotification
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
GlobalAlloc
GlobalFree
powrprof
PowerReadACValueIndex
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
ntdll
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlGetDeviceFamilyInfoEnum
NtQueryWnfStateData
RtlPublishWnfStateData
RtlQueryWnfStateData
api-ms-win-core-sysinfo-l2-1-0
GetUserNameW
avrt
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsW
umpdc
PdcSignalClientRegister
Pdcv2ActivationClientDeactivate
PdcSignalClientPulse
Pdcv2ActivationClientRenewActivation
Pdcv2ActivationClientActivate
Pdcv2ActivationClientUnregister
PdcSignalClientUnregister
Pdcv2ActivationClientRegister
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
systemeventsbrokerclient
SebQueryEventPackage
SebSignalEvent
SebEnumerateEventsByType
rpcrt4
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
NdrClientCall2
RpcStringFreeW
RpcBindingFree
api-ms-win-core-file-l1-1-0
DeleteFileW
CreateDirectoryW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Exports
Exports
?GetAgentActivationRuntimePalComponentFactory@@YGPAVIAgentActivationRuntimePalComponentFactory@VoiceAgentServices@Microsoft@@XZ
Sections
.text Size: 537KB - Virtual size: 536KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ