AuxiliaryDisplayClassInstaller.pdb
Static task
static1
Behavioral task
behavioral1
Sample
AuxiliaryDisplayClassInstaller.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
AuxiliaryDisplayClassInstaller.dll
Resource
win10v2004-20240508-en
General
-
Target
AuxiliaryDisplayClassInstaller.dll
-
Size
128KB
-
MD5
29fea7a6277e775a870682f2f7435f9f
-
SHA1
70bb57e9e94364c411bfa98086fe423c85c16cf8
-
SHA256
6af5fda66470e73a1208dd5777db1c0dd3d75f9926ed27b2d4af4e5dcea5586f
-
SHA512
1dc80b0c9884021005715fdae1c6be252b3db9859a7be8dc77f5f9e3bbade6de288c814b77c805e446dbc76aa65f0d75268bb974e85022e13f63e7545031e660
-
SSDEEP
3072:+IkVPJB+ULm22bqZKnxvDybvVT4OotsmKhOh99:+IY3jK22e0xvDybO7hQ0T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AuxiliaryDisplayClassInstaller.dll
Files
-
AuxiliaryDisplayClassInstaller.dll.dll windows:6 windows x86 arch:x86
e7600fbd64e7cb1de5a8e6483111bfe5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
??_U@YAPAXI@Z
memset
??_V@YAXPAX@Z
tolower
memmove_s
_ftol2
wcscpy_s
memcpy_s
malloc
free
calloc
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
_amsg_exit
_initterm
_XcptFilter
??3@YAXPAX@Z
advapi32
RegQueryValueExW
RegGetValueW
RegLoadMUIStringW
RegQueryInfoKeyW
RegEnumValueW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
EventUnregister
EventRegister
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
TraceEvent
EventWrite
RegEnumKeyExW
RegDeleteTreeW
RegCopyTreeW
kernel32
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
DisableThreadLibraryCalls
GetLastError
GetSystemTimeAsFileTime
RaiseException
CompareStringW
LoadLibraryW
GetProcAddress
GetModuleHandleW
SetLastError
LocalFree
LocalAlloc
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
lstrlenW
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
setupapi
SetupDiEnumDeviceInfo
SetupDiOpenDevRegKey
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiCreateDeviceInfoList
SetupDiCreateDeviceInfoListExW
SetupDiGetClassDevsExW
SetupDiGetDeviceInfoListDetailW
SetupDiOpenDeviceInfoW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceDetailW
CM_Get_DevNode_Registry_Property_ExW
CM_Get_Device_ID_ExW
CM_Get_Parent_Ex
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW
SetupDiCreateDevRegKeyW
ole32
CoCreateInstance
CoInitializeSecurity
CoTaskMemFree
CLSIDFromString
CoInitializeEx
CoUninitialize
oleaut32
SysFreeString
SysStringLen
VariantClear
VariantInit
SysAllocString
user32
wvsprintfW
wdscore
ConstructPartialMsgVW
WdsSetupLogMessageW
CurrentIP
ntdll
WinSqmAddToStream
WinSqmSetString
rpcrt4
UuidToStringW
slc
SLGetWindowsInformationDWORD
Exports
Exports
WindowsSideShowClassInstaller
WindowsSideShow_Sysprep_Generalize
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ