TSWorkspace.pdb
Static task
static1
Behavioral task
behavioral1
Sample
TSWorkspace.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
TSWorkspace.dll
Resource
win10v2004-20240508-en
General
-
Target
TSWorkspace.dll
-
Size
583KB
-
MD5
bd2978e85ef0007a89f7bb1367c007dd
-
SHA1
90378331544091ce823234572eb0d9ea6a077eb1
-
SHA256
4d0c1eaac5f9c0e6ca1f24c1b570dd2f5fc352dbee73e015e0a32b105e641a5d
-
SHA512
a201e54d25e206919d3ce4f38248c58c9a58ea5360bd11dfa9cda0bdc765a797343891fc787026c42719162152ff4849e5c6d904a1fa56fa61ae7c06ec69dd91
-
SSDEEP
12288:ED7Tl3z7SVukiudU7yyzZlJS4E9DXIB7GjFqaMt:Efd7SUJ+yzZlJS4Yim4J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource TSWorkspace.dll
Files
-
TSWorkspace.dll.dll regsvr32 windows:6 windows x86 arch:x86
e8f20c509fb84056a617a36c9122ee50
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
__CxxFrameHandler3
wcstombs
wcscspn
_wcsnicmp
wcsncmp
_wcsicmp
??0exception@@QAE@ABQBD@Z
__RTDynamicCast
iswspace
_vsnwprintf
memcpy
_onexit
_lock
__dllonexit
_unlock
_errno
realloc
_except_handler4_common
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_amsg_exit
_initterm
_XcptFilter
_callnewh
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
calloc
memmove_s
memset
wcscat_s
wcsncpy_s
wcscpy_s
_CxxThrowException
memcpy_s
free
malloc
_ftol2_sse
kernel32
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
GetModuleFileNameW
LockResource
FindResourceExW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CreateMutexW
ReleaseMutex
SystemTimeToFileTime
GetSystemTime
CreateDirectoryExW
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
ExpandEnvironmentStringsW
GetTimeFormatW
GetDateFormatW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetShortPathNameW
TerminateThread
SuspendThread
ResumeThread
DeleteFileW
WriteFile
LCMapStringW
SetLastError
GetAtomNameW
HeapDestroy
HeapReAlloc
HeapSize
DisableThreadLibraryCalls
InitOnceInitialize
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetVersionExA
InterlockedExchange
CompareStringOrdinal
FreeLibraryAndExitThread
RaiseException
GetProcessHeap
HeapAlloc
HeapFree
TlsFree
CreateFileW
GetSystemInfo
OpenThread
SwitchToThread
TlsGetValue
TlsSetValue
GetModuleHandleExW
CompareStringW
lstrlenA
Sleep
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
CreateThread
ReleaseSemaphore
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringA
CloseHandle
LocalAlloc
LocalFree
TryEnterCriticalSection
CreateEventW
SetEvent
ResetEvent
WaitForSingleObject
WaitForMultipleObjects
CreateSemaphoreW
lstrlenW
TlsAlloc
advapi32
EventUnregister
CredFree
EventWrite
GetSecurityDescriptorControl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
CopySid
GetLengthSid
IsValidSid
GetTokenInformation
OpenProcessToken
AddAce
InitializeAcl
RegEnumKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
CredUnmarshalCredentialW
EventRegister
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
GetAclInformation
MakeAbsoluteSD
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
GetUserNameW
ConvertSecurityDescriptorToStringSecurityDescriptorW
RegGetValueW
RegDeleteKeyW
RegCreateKeyTransactedW
RegNotifyChangeKeyValue
ole32
CoUninitialize
CreateStreamOnHGlobal
CoInitialize
CoAllowSetForegroundWindow
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
IIDFromString
oleaut32
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetVartype
SafeArrayUnlock
SafeArrayLock
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VariantClear
VariantInit
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
SysStringLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
user32
LoadStringW
RemovePropW
SetPropW
GetWindowTextW
SetDlgItemTextW
SetWindowLongW
SendDlgItemMessageW
GetFocus
LoadCursorW
SetCursor
EnableWindow
ShowWindow
SetDlgItemInt
SetWindowPos
GetWindowRect
PostQuitMessage
TranslateMessage
GetMessageW
LoadIconW
GetWindowLongW
GetMonitorInfoW
SetFocus
DestroyIcon
LoadImageW
CharNextW
UnregisterClassA
CreateWindowExW
UnregisterClassW
GetClassInfoExW
RegisterClassExW
DefWindowProcW
DestroyWindow
PostMessageW
PostThreadMessageW
KillTimer
SetTimer
PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjectsEx
GetParent
SendMessageW
GetDlgItem
MonitorFromWindow
GetPropW
rpcrt4
NdrOleAllocate
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrStubCall2
NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
propsys
InitVariantFromBuffer
ntdll
EtwLogTraceEvent
WinSqmAddToStream
RtlInitString
shlwapi
ord637
ord496
ord493
ord278
ord156
SHStrDupW
ord174
ord204
ord176
UrlCreateFromPathW
PathCanonicalizeW
PathQuoteSpacesW
ord219
ord172
ord199
ord158
ord256
ord514
ord24
ord494
ord618
shell32
SHFileOperationW
SHCreateDirectoryExW
SHGetKnownFolderPath
SHCreateItemFromParsingName
SHGetIDListFromObject
ord152
SHParseDisplayName
ord155
ord18
ord25
ShellExecuteExW
SHBindToObject
Shell_NotifyIconW
gdi32
DeleteObject
gdiplus
GdiplusShutdown
GdiplusStartup
GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipDisposeImage
GdipAlloc
GdipFree
dui70
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
??0ClassInfoBase@DirectUI@@QAE@XZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
??1CritSecLock@DirectUI@@QAE@XZ
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
?Destroy@Element@DirectUI@@QAEJ_N@Z
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
StrToID
?GetUnset@Value@DirectUI@@SGPAV12@XZ
?GetID@Element@DirectUI@@QAEGXZ
?SetActive@Element@DirectUI@@QAEJH@Z
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?Release@Value@DirectUI@@QAEXXZ
?SetValue@Element@DirectUI@@QAEJPBUPropertyInfo@2@HPAVValue@2@@Z
?CreateString@Value@DirectUI@@SGPAV12@PBGPAUHINSTANCE__@@@Z
?GetParent@Element@DirectUI@@QAEPAV12@XZ
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?Register@Element@DirectUI@@SGJXZ
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
??1Element@DirectUI@@UAE@XZ
??0Element@DirectUI@@QAE@XZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?GetAtom@Value@DirectUI@@QAEGXZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
?Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z
InitProcessPriv
UnInitProcessPriv
InitThread
UnInitThread
?GetString@Value@DirectUI@@QAEPBGXZ
?QueryInterface@XProvider@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?Initialize@XProvider@DirectUI@@QAEJPAVElement@2@PAVIXProviderCP@2@@Z
?Create@XResourceProvider@DirectUI@@SGJPAUHINSTANCE__@@PBG11PAPAV12@@Z
?SetHandleEnterKey@XProvider@DirectUI@@IAEX_N@Z
?CreateDUI@XProvider@DirectUI@@UAGJPAVIXElementCP@2@PAPAUHWND__@@@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
??1XProvider@DirectUI@@UAE@XZ
?SetParameter@XProvider@DirectUI@@UAGJABU_GUID@@PAX@Z
?GetDesiredSize@XProvider@DirectUI@@UAGJHHPAUtagSIZE@@@Z
?IsDescendent@XProvider@DirectUI@@UAGJPAVElement@2@PA_N@Z
?SetFocus@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?Navigate@XProvider@DirectUI@@UAGJHPA_N@Z
?GetAtomZero@Value@DirectUI@@SGPAV12@XZ
?GetStringNull@Value@DirectUI@@SGPAV12@XZ
?CanSetFocus@XProvider@DirectUI@@UAGJPA_N@Z
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UAGHGH@Z
?GetHostedElementID@XProvider@DirectUI@@UAGJPAG@Z
?ForceThemeChange@XProvider@DirectUI@@UAGJIJ@Z
?SetDefaultButtonTracking@XProvider@DirectUI@@UAGJ_N@Z
?ClickDefaultButton@XProvider@DirectUI@@UAGHXZ
?SetRegisteredDefaultButton@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UAGJ_N@Z
?AddRef@XProvider@DirectUI@@UAGKXZ
?GetRoot@XProvider@DirectUI@@IAEPAVElement@2@XZ
?Add@Element@DirectUI@@QAEJPAV12@P6AHPBX1@Z@Z
?EndDefer@Element@DirectUI@@QAEXK@Z
?SetClass@Element@DirectUI@@QAEJPBG@Z
?DestroyAll@Element@DirectUI@@QAEJ_N@Z
?Click@Button@DirectUI@@SG?AVUID@@XZ
??0XProvider@DirectUI@@QAE@XZ
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?SetContentAlign@Element@DirectUI@@QAEJH@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?GetVisible@Element@DirectUI@@QAE_NXZ
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
wininet
InternetCanonicalizeUrlW
InternetCrackUrlW
winhttp
WinHttpQueryOption
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpSetTimeouts
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpConnect
WinHttpQueryAuthSchemes
WinHttpQueryDataAvailable
WinHttpSetCredentials
WinHttpCrackUrl
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpCloseHandle
credui
CredUIPromptForCredentialsW
secur32
GetUserNameExW
LsaLookupAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
crypt32
CryptUnprotectMemory
CryptProtectMemory
ktmw32
CreateTransaction
CommitTransaction
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TaskUpdateWorkspaces
TaskUpdateWorkspacesIfNeeded
WorkspaceSilentSetupW
WorkspaceStatusNotify
Sections
.text Size: 339KB - Virtual size: 338KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 51B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 204KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ