api-ms-win-downlevel-shell32-l1-1-0.pdb
Static task
static1
Behavioral task
behavioral1
Sample
api-ms-win-downlevel-shell32-l1-1-0.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
api-ms-win-downlevel-shell32-l1-1-0.dll
Resource
win10v2004-20240426-en
General
-
Target
api-ms-win-downlevel-shell32-l1-1-0.dll
-
Size
3KB
-
MD5
60f4aefa103d421ea4a40e31409b4756
-
SHA1
fd36b5caefaa850127ad1eca2e6d1d781a29be0d
-
SHA256
037a8605ca504a4ff43e9d4de9017cea1e26d3556c975872c747e24d8b0835ef
-
SHA512
c7f74e5656873a4c9b879a44db41e845a6d3ee7b07719e664f88288d1103196f30b2ad58e1f73ab0e7c7934265bc33185dc2d710db95a89df9280ee854c4fdb0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource api-ms-win-downlevel-shell32-l1-1-0.dll
Files
-
api-ms-win-downlevel-shell32-l1-1-0.dll.dll windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Exports
Exports
CommandLineToArgvW
GetCurrentProcessExplicitAppUserModelID
SetCurrentProcessExplicitAppUserModelID
Sections
.text Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 26B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ