TapiMigPlugin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
TapiMigPlugin.dll
Resource
win10v2004-20240508-en
General
-
Target
TapiMigPlugin.dll
-
Size
45KB
-
MD5
bfcee96eb7a4a786ebed0c6e77ed45a3
-
SHA1
07a9de6d1f74106cf619768fc8263918ed65cc44
-
SHA256
f3bbd07f0d11514490dd167161e4119b49d108b76cb5fe5f61a5a9ad098166cf
-
SHA512
8c1fb87e3c2c4ca6af279587b50f2f30bf6b48ff78cf656f2c5597481f2bfcf601de1cee18be7f131de8f3773d1b66b5c372878f8ab98a73f00cb8ad4543c1c0
-
SSDEEP
768:e1c605fXqFVLB5UM5SNhBDITnGVeFvdFsxBN3f6A+UDsYL:EcdUj5SNhBD0GVeFvdyyAHsY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource TapiMigPlugin.dll
Files
-
TapiMigPlugin.dll.dll regsvr32 windows:10 windows x86 arch:x86
a6a268350a7213b80cefbd818dd269b3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
memset
_wcsnicmp
_vsnwprintf
wcsncpy_s
malloc
memmove_s
free
_purecall
wcscat_s
wcscpy_s
memcpy_s
memcmp
ole32
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
StringFromCLSID
CoTaskMemRealloc
oleaut32
VarUI4FromStr
SysAllocString
RegisterTypeLi
SysFreeString
LoadTypeLi
GetErrorInfo
SysStringLen
UnRegisterTypeLi
LoadRegTypeLi
user32
UnregisterClassA
CharNextW
kernel32
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
LocalFree
GetCurrentThreadId
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetPrivateProfileStringW
LoadLibraryExW
lstrcmpiW
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
FreeLibrary
WritePrivateProfileStringW
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
LoadResource
FindResourceExW
RaiseException
LockResource
GetLastError
MultiByteToWideChar
InitializeCriticalSection
LeaveCriticalSection
GetThreadLocale
GetModuleFileNameW
EnterCriticalSection
SetThreadLocale
SizeofResource
GetPrivateProfileIntW
advapi32
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
shell32
SHGetFileInfoW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ