Windows.Devices.Picker.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9c21da3ada79e73c650e5fb14c3f1fc0446f9920e03029be4488ab9b6e2999c9.dll
Resource
win10v2004-20240508-en
General
-
Target
9c21da3ada79e73c650e5fb14c3f1fc0446f9920e03029be4488ab9b6e2999c9
-
Size
473KB
-
MD5
7e99476ed897b1276740b0e33d548ad8
-
SHA1
c31fffcfbbd5f11fbca92e74c1201e4a12e29850
-
SHA256
9c21da3ada79e73c650e5fb14c3f1fc0446f9920e03029be4488ab9b6e2999c9
-
SHA512
38548ad079820e3dc23ebaf0f6584be46ad5be4f5c26dc627ddfd1d234a1f3e1a73e50d42904f14c912da6443390c9312e020a0f92761c8ae99d8ff461c3d95e
-
SSDEEP
12288:7BsMnCZRHcQpPEkQebXpXlySXzR5XYxueLqF:qR951gqF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9c21da3ada79e73c650e5fb14c3f1fc0446f9920e03029be4488ab9b6e2999c9
Files
-
9c21da3ada79e73c650e5fb14c3f1fc0446f9920e03029be4488ab9b6e2999c9.dll windows:10 windows x64 arch:x64
fe3165e2918dda550d308e7b090cd6ab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_get_errno
_set_errno
memmove_s
realloc
memcmp
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__C_specific_handler
_initterm
free
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
_purecall
?what@exception@@UEBAPEBDXZ
_vsnprintf_s
_vsnwprintf
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??_V@YAXPEAX@Z
??0exception@@QEAA@AEBQEBDH@Z
??3@YAXPEAX@Z
??1exception@@UEAA@XZ
memcpy_s
__CxxFrameHandler3
memset
combase
ord14
ord6
ord12
ord4
CStdStubBuffer_AddRef
ord5
ord7
CStdStubBuffer_DebugServerQueryInterface
ord8
ord90
ord10
ord157
CStdStubBuffer_Invoke
CStdStubBuffer_CountRefs
CStdStubBuffer2_Connect
ord11
ord20
ord16
ord34
ord33
ord18
ord66
ord68
ord67
ord69
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
ord140
CStdStubBuffer2_QueryInterface
CStdStubBuffer2_Disconnect
ord19
ord17
ord9
ord3
CStdStubBuffer_Connect
ord32
CStdStubBuffer_IsIIDSupported
ord13
CStdStubBuffer_Disconnect
ord15
CStdStubBuffer_DebugServerRelease
ord2
CStdStubBuffer_QueryInterface
CStdStubBuffer2_CountRefs
rpcrt4
NdrStubCall3
IUnknown_Release_Proxy
NdrDllGetClassObject
I_RpcBindingInqLocalClientPID
NdrDllCanUnloadNow
NdrOleFree
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrStubForwardingFunction
NdrOleAllocate
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetProcessId
CreateThread
TerminateProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-synch-l1-1-0
OpenSemaphoreW
WaitForSingleObject
ReleaseMutex
ReleaseSemaphore
WaitForMultipleObjectsEx
ResetEvent
ReleaseSRWLockShared
SetEvent
ReleaseSRWLockExclusive
WaitForSingleObjectEx
CreateEventExW
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
CreateSemaphoreExW
LeaveCriticalSection
CreateEventW
AcquireSRWLockShared
CreateMutexExW
AcquireSRWLockExclusive
InitializeSRWLock
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolTimer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-libraryloader-l1-2-0
LockResource
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
LoadResource
FindResourceExW
DisableThreadLibraryCalls
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
TraceMessage
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceComplete
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceExecuteOnce
Sleep
api-ms-win-service-core-l1-1-0
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
api-ms-win-security-base-l1-1-0
CopySid
GetLengthSid
MakeAbsoluteSD
GetTokenInformation
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
ntdll
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlPublishWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
api-ms-win-eventing-provider-l1-1-0
EventActivityIdControl
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCreateKeyExW
RegGetValueW
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExW
RegNotifyChangeKeyValue
RegEnumKeyExW
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-featurestaging-l1-1-0
RecordFeatureUsage
GetFeatureEnabledState
UnsubscribeFeatureStateChangeNotification
SubscribeFeatureStateChangeNotification
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-string-l2-1-0
CharUpperBuffW
api-ms-win-devices-query-l1-1-1
DevGetObjectPropertiesEx
api-ms-win-devices-query-l1-1-0
DevFreeObjectProperties
DevFindProperty
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-shcore-registry-l1-1-0
SHEnumValueW
shcore
ord241
Exports
Exports
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
ServiceMain
Sections
.text Size: 302KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 139KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ