dtsh.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dtsh.dll
Resource
win10v2004-20240508-en
General
-
Target
dtsh.dll
-
Size
30KB
-
MD5
ffc3fc09346de3d686bdb8904d5e1958
-
SHA1
e79eeeab22a6f8b1681084b553aff3dc02867622
-
SHA256
06805ae97a538b052fbde0e8b7b8da69b59feb41e915c5001273cd958dfc0f01
-
SHA512
46e5c2a263e80aeca18225506c075cc24731a89ed40c30320afb7e1de7af9c680c32eafa6a21ff7f1ee8e2cc8da057c5908aa0e19641b8e04787df79383da0d0
-
SSDEEP
384:iuFGLPL5AILVJIDcs7oEOYJ3g+mcUPvA8aifia7r6LWNSWDjilSfbA47DEt6Dy:yLPmIL0Dcs33DevNpm2jmo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dtsh.dll
Files
-
dtsh.dll.dll windows:10 windows x86 arch:x86
24f67d6ec03aaaa7dece45d6b961561d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_purecall
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
memmove_s
calloc
_beginthreadex
free
memset
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ChangeServiceConfigW
StartServiceW
ControlService
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
OpenSCManagerW
kernel32
ActivateActCtx
LoadLibraryExW
CreateActCtxW
GetModuleHandleW
SetUnhandledExceptionFilter
GetProcAddress
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
DeactivateActCtx
GetModuleFileNameW
GetSystemTimeAsFileTime
GetTickCount
ReleaseActCtx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetLastError
DeleteCriticalSection
RaiseException
Sleep
CreateEventW
CloseHandle
SetEvent
WaitForSingleObject
OpenEventW
DisableThreadLibraryCalls
GetCurrentProcessId
QueryPerformanceCounter
UnhandledExceptionFilter
user32
SetProcessDPIAware
rpcrt4
IUnknown_Release_Proxy
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
oleaut32
SysAllocString
SysFreeString
firewallapi
FWChangeNotificationCreate
FWChangeNotificationDestroy
api-ms-win-core-com-l1-1-0
CoSetProxyBlanket
CoGetMalloc
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
api-ms-win-core-marshal-l1-1-0
HWND_UserMarshal
HWND_UserSize
HWND_UserFree
HWND_UserUnmarshal
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient4
ObjectStublessClient7
ObjectStublessClient6
ObjectStublessClient5
ObjectStublessClient3
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ