ShareHost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ShareHost.dll
Resource
win10v2004-20240426-en
General
-
Target
ShareHost.dll
-
Size
553KB
-
MD5
645dfdae0f91de695029976b509597be
-
SHA1
ed819ef6002d2962513461ef2bc9c46107b12d51
-
SHA256
869097ce0b1adb4ea795c46df11cff474cacaf39d6f2aea2a4ed3880fe20ed34
-
SHA512
e432f98e9cd7ed61379e4a5fed3b6f3b90a6f16c4432b4d1c6bf1064f3d3d8f2cb780da45d302b724416283be45f72ecec6906e3237f3c9796a82bed31be2b07
-
SSDEEP
12288:1DWHqmUTzteF2SOlGsJPYDV0UbKqaagu:1ZHm2SOlGsJPG0UbGagu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ShareHost.dll
Files
-
ShareHost.dll.dll windows:10 windows x86 arch:x86
f053298de653c6ed97ea83fc5c41a325
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcscpy_s
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
memmove_s
__ExceptionPtrAssign
__ExceptionPtrCreate
__ExceptionPtrCopy
__ExceptionPtrToBool
__ExceptionPtrDestroy
__ExceptionPtrCurrentException
__ExceptionPtrRethrow
_wcsicmp
_wcsnicmp
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@PBD@Z
??0bad_cast@@QAE@ABV0@@Z
wcscspn
wcsrchr
wcschr
wcsspn
_wcstoui64
tolower
_callnewh
__CxxFrameHandler3
_onexit
memmove
__dllonexit
??_V@YAXPAX@Z
_vsnwprintf
_unlock
_lock
_initterm
_amsg_exit
??1type_info@@UAE@XZ
_except_handler4_common
_XcptFilter
malloc
memcpy
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
memcmp
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
_CxxThrowException
memcpy_s
realloc
memset
twinapi.appcore
ord10
windows.storage
SHCreateItemFromParsingName
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandle
STORAGE_CStorageItem_GetValidatedStorageItemObject
CStorageItem_GetValidatedStorageItemObject
api-ms-win-shlwapi-ie-l1-1-0
IUnknown_QueryService
api-ms-win-core-libraryloader-l1-2-0
LockResource
DisableThreadLibraryCalls
FindResourceExW
LoadResource
GetModuleHandleExW
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
FreeLibraryAndExitThread
GetModuleFileNameW
api-ms-win-core-synch-l1-2-0
DeleteCriticalSection
AcquireSRWLockExclusive
LeaveCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
InitOnceComplete
ReleaseSemaphore
CreateMutexExW
InitializeSRWLock
SetEvent
InitOnceExecuteOnce
ReleaseSRWLockExclusive
CreateEventW
CreateSemaphoreExW
WaitForSingleObject
InitOnceBeginInitialize
OpenSemaphoreW
ReleaseMutex
WaitForSingleObjectEx
CreateEventExW
Sleep
ReleaseSRWLockShared
AcquireSRWLockShared
api-ms-win-core-heap-l1-2-0
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-1
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-winrt-string-l1-1-0
WindowsConcatString
WindowsDuplicateString
HSTRING_UserUnmarshal
WindowsStringHasEmbeddedNull
HSTRING_UserMarshal
WindowsCreateString
WindowsGetStringRawBuffer
HSTRING_UserFree
WindowsIsStringEmpty
HSTRING_UserSize
WindowsSubstringWithSpecifiedLength
WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringLen
WindowsCompareStringOrdinal
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
EventWrite
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-2
GetCurrentThreadId
TlsAlloc
GetProcessId
GetExitCodeThread
TlsSetValue
TlsFree
GetCurrentProcess
GetThreadId
TlsGetValue
OpenProcessToken
OpenProcess
CreateThread
TerminateProcess
GetCurrentProcessId
api-ms-win-core-winrt-error-l1-1-1
GetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoOriginateError
RoTransformError
SetRestrictedErrorInfo
RoReportFailedDelegate
RoOriginateErrorW
api-ms-win-core-localization-l1-2-1
FormatMessageW
api-ms-win-core-debug-l1-1-1
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-1
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-shlwapi-obsolete-l1-2-0
StrCmpLogicalW
StrCmpIW
api-ms-win-core-com-l1-1-1
CoTaskMemRealloc
RoGetAgileReference
StringFromGUID2
CoUnmarshalInterface
CoGetMalloc
CreateStreamOnHGlobal
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
IIDFromString
CoGetInterfaceAndReleaseStream
CoMarshalInterface
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoInitializeEx
CoUninitialize
PropVariantClear
CoGetCallContext
CoGetApartmentType
CoWaitForMultipleHandles
CoTaskMemAlloc
api-ms-win-shcore-thread-l1-1-0
SHSetThreadRef
SHCreateThreadRef
SHGetThreadRef
api-ms-win-shcore-stream-winrt-l1-1-0
CreateRandomAccessStreamOnFile
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindExtensionW
PathFindFileNameW
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-threadpool-l1-2-0
FreeLibraryWhenCallbackReturns
CallbackMayRunLong
SetThreadpoolTimer
TrySubmitThreadpoolCallback
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
SetThreadpoolWait
api-ms-win-rtcore-ntuser-synch-l1-1-0
MsgWaitForMultipleObjectsEx
api-ms-win-core-path-l1-1-0
PathCchFindExtension
api-ms-win-core-synch-l1-2-1
CreateSemaphoreW
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW
api-ms-win-shcore-stream-l1-1-0
IStream_Reset
IStream_Write
IStream_Size
IStream_Read
SHCreateMemStream
rpcrt4
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
CStdStubBuffer_Connect
I_RpcBindingInqLocalClientPID
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
ntdll
RtlFreeHeap
NtQueryInformationToken
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlGetAppContainerSidType
RtlGetDeviceFamilyInfoEnum
RtlInitUnicodeString
RtlQueryPackageIdentity
api-ms-win-core-errorhandling-l1-1-3
RaiseFailFastException
api-ms-win-core-biptcltapi-l1-1-1
BiPtActivateInBackground
BiPtCancelWorkItem
api-ms-win-core-string-l1-1-0
CompareStringW
CompareStringOrdinal
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
oleaut32
SysFreeString
SysAllocString
SysStringLen
SysAllocStringLen
api-ms-win-core-url-l1-1-0
UrlEscapeW
PathCreateFromUrlW
PathIsURLW
PathCreateFromUrlAlloc
api-ms-win-appmodel-runtime-l1-1-1
GetPackageFullName
ParseApplicationUserModelId
GetPackagesByPackageFamily
GetPackageFamilyName
api-ms-win-security-base-l1-2-0
GetTokenInformation
api-ms-win-appmodel-runtime-l1-1-2
GetApplicationUserModelIdFromToken
GetPackageFullNameFromToken
GetPackageFamilyNameFromToken
api-ms-win-core-winrt-propertysetprivate-l1-1-1
RoCreatePropertySetSerializer
api-ms-win-core-processenvironment-l1-2-0
ExpandEnvironmentStringsW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
wpportinglibrary
ProductInfoFromPackageFullName
coremessaging
MsgStringCreateShared
MsgBufferShare
MsgRelease
CoreUICreate
coreuicomponents
CoreUIFactoryCreate
msvcp110_win
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
?_Winerror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?swap@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z
?swap@?$basic_iostream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?uncaught_exception@std@@YA_NXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?_Add_vtordisp1@?$basic_istream@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Add_vtordisp2@?$basic_ostream@GU?$char_traits@G@std@@@std@@UAEXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?exceptions@ios_base@std@@QAEXH@Z
?good@ios_base@std@@QBE_NXZ
??0id@locale@std@@QAE@I@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xbad_function_call@std@@YAXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
?setf@ios_base@std@@QAEHHH@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
??Bios_base@std@@QBEPAXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$ctype@G@std@@QBEGD@Z
??Bid@locale@std@@QAEIXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
api-ms-win-appmodel-runtime-internal-l1-1-3
PackageFamilyNameFromProductId
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient3
api-ms-win-core-delayload-l1-1-1
DelayLoadFailureHook
ResolveDelayLoadedAPI
Exports
Exports
ConvertDataPackageToShareFields
ConvertShareFieldsToDataPackage
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetDssTokenFromStorageFile
GetStorageFilesFromDssTokens
ResolveConnectedSharePlatformToken
SerializePropertyBag
Sections
.text Size: 497KB - Virtual size: 496KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ