enterpriseresourcemanager.pdb
Static task
static1
Behavioral task
behavioral1
Sample
enterpriseresourcemanager.dll
Resource
win10v2004-20240426-en
General
-
Target
enterpriseresourcemanager.dll
-
Size
83KB
-
MD5
8fc77f53d9bc6cbbf1234ae680a1b31d
-
SHA1
91cb0afb5483a4996752575097a05113c7d82637
-
SHA256
7e10398905caf94288d9225b088dbc009c868c9331bc1dc9392509ced4a24abb
-
SHA512
8251fc12b4dda5210f2e67f5b099f29f0cb8803fa35a834d7eea10bfdd210be3c4b7b53a2aac2fd87713089e1eefd1c155d88ee731c0afa7fee96834d779370d
-
SSDEEP
1536:F+GTUP8Ssx+ZXCzEcPXi6o3dLm2YJPjBL9J99lXO15B5C7lc:FT08SK+wBPXi6o3dABLN9leh5yW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource enterpriseresourcemanager.dll
Files
-
enterpriseresourcemanager.dll.dll windows:10 windows x86 arch:x86
32f5d8477baa3b4d99c0c8759fba5185
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcp110_win
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?_Xbad_alloc@std@@YAXXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Add_vtordisp1@?$basic_istream@GU?$char_traits@G@std@@@std@@UAEXXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?_Add_vtordisp2@?$basic_ostream@GU?$char_traits@G@std@@@std@@UAEXXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?_BADOFF@std@@3_JB
?_Syserror_map@std@@YAPBDH@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
msvcrt
memmove
memcpy
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
free
_amsg_exit
_XcptFilter
_callnewh
malloc
memmove_s
wcschr
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
memset
sprintf_s
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
wcscat_s
_wcsicmp
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
__CxxFrameHandler3
_CxxThrowException
memcmp
ntdll
RtlIsStateSeparationEnabled
oleaut32
SysFreeString
SysStringLen
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameA
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegGetValueW
RegSetValueExW
RegEnumKeyExW
RegDeleteTreeW
RegDeleteKeyExW
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
rpcrt4
UuidFromStringW
UuidCreate
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
AcquireSRWLockShared
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
DeleteCriticalSection
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
api-ms-win-core-com-l1-1-0
CoCreateInstance
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-2-0
SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrStrIW
dmcmnutils
UnicodeToMB
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Exports
Exports
EnterpriseResourceManagerStore_DeleteResource
EnterpriseResourceManagerStore_DeleteTrackedResourcesForEnrollment
EnterpriseResourceManagerStore_GenerateWmiResourcePath
EnterpriseResourceManagerStore_IsResourceProvisioned
EnterpriseResourceManagerStore_NormalizeURI
EnterpriseResourceManagerStore_RemoveAllIgnoredUri
EnterpriseResourceManagerStore_ReplaceResourceNodePath
EnterpriseResourceManagerStore_SaveIgnoredURI
EnterpriseResourceManagerStore_WriteResourceNodePath
EnterpriseResourceManager_ScopeData_IsValid
Sections
.text Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ