RPCNDFP.pdb
Static task
static1
Behavioral task
behavioral1
Sample
RPCNDFP.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
RPCNDFP.dll
Resource
win10v2004-20240426-en
General
-
Target
RPCNDFP.dll
-
Size
43KB
-
MD5
fc2fb49a523c7aea46805d69c3df01d7
-
SHA1
124075e8c74303a86892e565169ee50708ad271d
-
SHA256
6d73921f6a19662a72239a01a9295f775d5d0e3802a33d2307864e75e2b36bbe
-
SHA512
fb9c48d8a028fa34a41e34a462188add702a3148f0456ff71c8b4b4a58b53569e9adf1be84cf08c0f97558b43cc8990b542facb2d2b6f8e769d1b955ad78010b
-
SSDEEP
768:HXMvqbgWJsMWZdLDC2Af2zQY6ikq+gvnU/R3YKATXaZ:H2/MrWLLDhAfEd6fzg/U/R3QTKZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RPCNDFP.dll
Files
-
RPCNDFP.dll.dll regsvr32 windows:6 windows x86 arch:x86
e4439a5cae311b9d9fd1a5c97a24279b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_errno
realloc
_except_handler4_common
??1type_info@@UAE@XZ
_amsg_exit
_unlock
_XcptFilter
??_V@YAXPAX@Z
malloc
free
wcsncmp
memcpy_s
??2@YAPAXI@Z
_purecall
memcpy
_wcsicmp
__dllonexit
_lock
_onexit
_initterm
_itow
memset
??_U@YAPAXI@Z
__CxxFrameHandler3
wcscat_s
wcsncpy_s
wcscpy_s
_CxxThrowException
??3@YAXPAX@Z
kernel32
InterlockedExchange
GetVersionExA
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
Sleep
OutputDebugStringA
SetUnhandledExceptionFilter
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
GetModuleFileNameW
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
SetThreadLocale
GetThreadLocale
EncodePointer
FormatMessageW
GetComputerNameExW
UnhandledExceptionFilter
user32
UnregisterClassA
CharNextW
LoadStringW
advapi32
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
GetLengthSid
IsValidSid
RegCloseKey
ole32
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
oleaut32
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysFreeString
ws2_32
WSAStartup
GetAddrInfoW
WSACleanup
FreeAddrInfoW
rpcrt4
I_RpcExceptionFilter
MesDecodeBufferHandleCreate
MesHandleFree
RpcErrorResetEnumeration
RpcErrorGetNumberOfRecords
RpcErrorLoadErrorInfo
RpcErrorEndEnumeration
NdrMesTypeDecode2
RpcErrorGetNextRecord
ntdll
RtlMultiByteToUnicodeN
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ