MSFLACDecoder.pdb
Static task
static1
Behavioral task
behavioral1
Sample
MSFlacDecoder.dll
Resource
win10v2004-20240508-en
General
-
Target
MSFlacDecoder.dll
-
Size
364KB
-
MD5
5c64ead8a74ac939699788d9d4ff3465
-
SHA1
644018f9b5bb36952fef64cab7a9be07559ea019
-
SHA256
28c39730c724fa2c93f838d0713b43a6881fc8ea62d5806d0b595f2420ed7c8b
-
SHA512
7987e325c8aafe97bbc0937df8992db861b1ba90d55d1fcc34e2a97e52021ff68445337fdc384ca64024257ec851d56686d8083bce5b7aaa5b5d2fb02ceb4f58
-
SSDEEP
6144:uWSBKYnmag9itHWIOcvRJ/xqDxZhQiM+JIO3VFfEJT/lU2yjPk2Wr8sEJ:uqx0WCvPxqXlMlU2yjParjEJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MSFlacDecoder.dll
Files
-
MSFlacDecoder.dll.dll regsvr32 windows:10 windows x86 arch:x86
60ec78e0945e8385b3726ddef251dd5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
strncpy_s
strnlen
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_CxxThrowException
memcpy
memmove
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
_wcsicmp
wcstok_s
_XcptFilter
_wchmod
_wutime64
qsort
_amsg_exit
_initterm
_vsnprintf_s
_except_handler4_common
_errno
??1type_info@@UAE@XZ
memchr
_lock
_strnicmp
_strdup
_unlock
__dllonexit
_onexit
__iob_func
wcsncmp
_strcmpi
memcmp
_vsnprintf
realloc
__CxxFrameHandler3
fclose
calloc
_callnewh
?terminate@@YAXXZ
strcat_s
_purecall
_vsnwprintf
wcscat_s
wcscpy_s
memcpy_s
malloc
wcsncpy_s
free
swscanf_s
_CIlog
_CIsqrt
_ftol2
ceil
memset
oleaut32
VariantInit
VarUI4FromStr
VariantChangeType
VariantClear
SysAllocString
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
WaitForMultipleObjectsEx
ReleaseSemaphore
ReleaseMutex
CreateSemaphoreExW
CreateMutexExW
ResetEvent
WaitForSingleObjectEx
OpenSemaphoreW
CreateEventW
EnterCriticalSection
SetEvent
api-ms-win-core-libraryloader-l1-2-0
SizeofResource
LoadResource
GetModuleHandleExW
FreeLibrary
GetModuleFileNameA
FindResourceExW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
DisableThreadLibraryCalls
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemRealloc
CoGetMalloc
CoTaskMemFree
PropVariantClear
PropVariantCopy
IIDFromString
CreateStreamOnHGlobal
CoCreateInstance
StringFromGUID2
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
GetTraceEnableFlags
TraceMessage
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableLevel
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
TlsSetValue
CreateThread
GetCurrentProcess
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
OutputDebugStringA
api-ms-win-core-featurestaging-l1-1-0
UnsubscribeFeatureStateChangeNotification
SubscribeFeatureStateChangeNotification
RecordFeatureUsage
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
propsys
PSStringFromPropertyKey
PSPropertyKeyFromString
InitPropVariantFromCLSID
PropVariantChangeType
InitPropVariantFromStringVector
PropVariantToStringVector
PSCreateMemoryPropertyStore
StgSerializePropVariant
StgDeserializePropVariant
InitPropVariantFromDoubleVector
avrt
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsW
Exports
Exports
??0Application@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0Application@Metadata@FLAC@@QAE@ABV012@@Z
??0Application@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0Application@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0Chain@Metadata@FLAC@@QAE@ABV012@@Z
??0CueSheet@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0CueSheet@Metadata@FLAC@@QAE@ABV012@@Z
??0CueSheet@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0CueSheet@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0Iterator@Metadata@FLAC@@QAE@ABV012@@Z
??0Padding@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0Padding@Metadata@FLAC@@QAE@ABV012@@Z
??0Padding@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0Padding@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0Picture@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0Picture@Metadata@FLAC@@QAE@ABV012@@Z
??0Picture@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0Picture@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0SeekTable@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0SeekTable@Metadata@FLAC@@QAE@ABV012@@Z
??0SeekTable@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0SeekTable@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0SimpleIterator@Metadata@FLAC@@QAE@ABV012@@Z
??0State@Stream@Decoder@FLAC@@QAE@W4FLAC__StreamDecoderState@@@Z
??0Status@Chain@Metadata@FLAC@@QAE@W4FLAC__Metadata_ChainStatus@@@Z
??0Status@SimpleIterator@Metadata@FLAC@@QAE@W4FLAC__Metadata_SimpleIteratorStatus@@@Z
??0StreamInfo@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0StreamInfo@Metadata@FLAC@@QAE@ABV012@@Z
??0StreamInfo@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0StreamInfo@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0Unknown@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0Unknown@Metadata@FLAC@@QAE@ABV012@@Z
??0Unknown@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0Unknown@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0VorbisComment@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0VorbisComment@Metadata@FLAC@@QAE@ABV012@@Z
??0VorbisComment@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0VorbisComment@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??4Application@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4Application@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Application@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4Chain@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4CueSheet@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4CueSheet@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4CueSheet@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4Iterator@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Padding@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4Padding@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Padding@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4Picture@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4Picture@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Picture@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4SeekTable@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4SeekTable@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4SeekTable@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4SimpleIterator@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4State@Stream@Decoder@FLAC@@QAEAAV0123@$$QAV0123@@Z
??4State@Stream@Decoder@FLAC@@QAEAAV0123@ABV0123@@Z
??4Status@Chain@Metadata@FLAC@@QAEAAV0123@$$QAV0123@@Z
??4Status@Chain@Metadata@FLAC@@QAEAAV0123@ABV0123@@Z
??4Status@SimpleIterator@Metadata@FLAC@@QAEAAV0123@$$QAV0123@@Z
??4Status@SimpleIterator@Metadata@FLAC@@QAEAAV0123@ABV0123@@Z
??4StreamInfo@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4StreamInfo@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4StreamInfo@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4Unknown@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4Unknown@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Unknown@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4VorbisComment@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4VorbisComment@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4VorbisComment@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??8Application@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Application@Metadata@FLAC@@QBE_NABV012@@Z
??8Application@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8CueSheet@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8CueSheet@Metadata@FLAC@@QBE_NABV012@@Z
??8CueSheet@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8Padding@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Padding@Metadata@FLAC@@QBE_NABV012@@Z
??8Padding@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8Picture@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Picture@Metadata@FLAC@@QBE_NABV012@@Z
??8Picture@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8Prototype@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Prototype@Metadata@FLAC@@QBE_NABV012@@Z
??8Prototype@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8SeekTable@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8SeekTable@Metadata@FLAC@@QBE_NABV012@@Z
??8SeekTable@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8StreamInfo@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8StreamInfo@Metadata@FLAC@@QBE_NABV012@@Z
??8StreamInfo@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8Unknown@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Unknown@Metadata@FLAC@@QBE_NABV012@@Z
??8Unknown@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8VorbisComment@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8VorbisComment@Metadata@FLAC@@QBE_NABV012@@Z
??8VorbisComment@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Application@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Application@Metadata@FLAC@@QBE_NABV012@@Z
??9Application@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9CueSheet@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9CueSheet@Metadata@FLAC@@QBE_NABV012@@Z
??9CueSheet@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Padding@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Padding@Metadata@FLAC@@QBE_NABV012@@Z
??9Padding@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Picture@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Picture@Metadata@FLAC@@QBE_NABV012@@Z
??9Picture@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Prototype@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Prototype@Metadata@FLAC@@QBE_NABV012@@Z
??9Prototype@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9SeekTable@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9SeekTable@Metadata@FLAC@@QBE_NABV012@@Z
??9SeekTable@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9StreamInfo@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9StreamInfo@Metadata@FLAC@@QBE_NABV012@@Z
??9StreamInfo@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Unknown@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Unknown@Metadata@FLAC@@QBE_NABV012@@Z
??9Unknown@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9VorbisComment@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9VorbisComment@Metadata@FLAC@@QBE_NABV012@@Z
??9VorbisComment@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??BPrototype@Metadata@FLAC@@QBEPBUFLAC__StreamMetadata@@XZ
??BState@Stream@Decoder@FLAC@@QBE?AW4FLAC__StreamDecoderState@@XZ
??BStatus@Chain@Metadata@FLAC@@QBE?AW4FLAC__Metadata_ChainStatus@@XZ
??BStatus@SimpleIterator@Metadata@FLAC@@QBE?AW4FLAC__Metadata_SimpleIteratorStatus@@XZ
??BStream@Decoder@FLAC@@QBE_NXZ
??_7Application@Metadata@FLAC@@6B@
??_7Chain@Metadata@FLAC@@6B@
??_7CueSheet@Metadata@FLAC@@6B@
??_7Iterator@Metadata@FLAC@@6B@
??_7Padding@Metadata@FLAC@@6B@
??_7Picture@Metadata@FLAC@@6B@
??_7SeekTable@Metadata@FLAC@@6B@
??_7SimpleIterator@Metadata@FLAC@@6B@
??_7StreamInfo@Metadata@FLAC@@6B@
??_7Unknown@Metadata@FLAC@@6B@
??_7VorbisComment@Metadata@FLAC@@6B@
?as_cstring@State@Stream@Decoder@FLAC@@QBEPBDXZ
?as_cstring@Status@Chain@Metadata@FLAC@@QBEPBDXZ
?as_cstring@Status@SimpleIterator@Metadata@FLAC@@QBEPBDXZ
?assign@Application@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@CueSheet@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@Padding@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@Picture@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@SeekTable@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@StreamInfo@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@Unknown@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@VorbisComment@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?get_isrc@Track@CueSheet@Metadata@FLAC@@QBEPBDXZ
?get_num_indices@Track@CueSheet@Metadata@FLAC@@QBEEXZ
?get_number@Track@CueSheet@Metadata@FLAC@@QBEEXZ
?get_offset@Track@CueSheet@Metadata@FLAC@@QBE_KXZ
?get_pre_emphasis@Track@CueSheet@Metadata@FLAC@@QBE_NXZ
?get_track@Track@CueSheet@Metadata@FLAC@@QBEPBUFLAC__StreamMetadata_CueSheet_Track@@XZ
?get_type@Track@CueSheet@Metadata@FLAC@@QBEIXZ
?is_valid@Prototype@Metadata@FLAC@@QBE_NXZ
?resolved_as_cstring@State@Stream@Decoder@FLAC@@QBEPBDABV234@@Z
?set_number@Track@CueSheet@Metadata@FLAC@@QAEXE@Z
?set_offset@Track@CueSheet@Metadata@FLAC@@QAEX_K@Z
?set_pre_emphasis@Track@CueSheet@Metadata@FLAC@@QAEX_N@Z
?set_reference@Prototype@Metadata@FLAC@@AAEX_N@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 328KB - Virtual size: 327KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ