ShareHost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ShareHost.dll
Resource
win10v2004-20240426-en
General
-
Target
ShareHost.dll
-
Size
827KB
-
MD5
d2f227f20afdd2f445a3fd3f17369563
-
SHA1
680afa162aab5fca82087e2e2c0f0c47a27b3661
-
SHA256
a3dfdff0c22de85b35694f5e648cceb49be0a57b48e71b05bc0c84ce1683d5fe
-
SHA512
bb54a50017dfbab964f65000a5de3a5b8d53a326d795befe3cb88f5db60252578ad9741c92b7d179ae236b1c82565c6f3c9253949595d10131b7280aaf57d7fc
-
SSDEEP
24576:kpxxJdKku9qOXWm5d/QrrvVztwc1tOgf9X5:kpxxJcBBWGQrvAgh5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ShareHost.dll
Files
-
ShareHost.dll.dll windows:10 windows x86 arch:x86
0031364063e6e650e0f1792dfb01f700
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
__ExceptionPtrCreate
strncpy_s
__ExceptionPtrCopy
__ExceptionPtrToBool
__ExceptionPtrDestroy
_purecall
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
__ExceptionPtrCurrentException
__ExceptionPtrRethrow
_set_errno
_errno
_get_errno
strtol
strchr
strrchr
memmove_s
sprintf_s
??_V@YAXPAX@Z
_wcsicmp
realloc
wcscpy_s
??0exception@@QAE@ABQBD@Z
_vsnprintf
wcscspn
wcsrchr
wcschr
_wtoi
wcsnlen
??0bad_cast@@QAE@PBD@Z
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
toupper
_callnewh
__ExceptionPtrAssign
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
memmove
_initterm
malloc
memcpy
memcmp
free
_amsg_exit
_XcptFilter
_vsnprintf_s
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
__CxxFrameHandler3
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
??1type_info@@UAE@XZ
memset
windows.storage
STORAGE_CreateStorageItemFromPath_FullTrustCaller
SHCreateItemFromParsingName
STORAGE_CStorageItem_GetValidatedStorageItemObject
SHGetKnownFolderPath
api-ms-win-appmodel-runtime-internal-l1-1-4
GetExtensionProperty
api-ms-win-appmodel-runtime-internal-l1-1-2
GetEffectivePackageStatusForUser
api-ms-win-shlwapi-ie-l1-1-0
SHRegGetValueFromHKCUHKLM
IUnknown_QueryService
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
FindResourceExW
GetProcAddress
GetModuleHandleExW
LockResource
DisableThreadLibraryCalls
GetModuleFileNameA
FreeLibrary
LoadResource
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
CreateEventExW
CreateSemaphoreExW
EnterCriticalSection
ReleaseSRWLockShared
LeaveCriticalSection
AcquireSRWLockExclusive
WaitForSingleObjectEx
DeleteCriticalSection
AcquireSRWLockShared
OpenSemaphoreW
CreateMutexExW
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
ReleaseMutex
WaitForSingleObject
SetEvent
InitializeSRWLock
CreateEventW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
HSTRING_UserUnmarshal
WindowsDuplicateString
WindowsCreateStringReference
WindowsSubstringWithSpecifiedLength
HSTRING_UserSize
WindowsGetStringLen
WindowsConcatString
HSTRING_UserFree
HSTRING_UserMarshal
WindowsDeleteString
WindowsCompareStringOrdinal
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsCreateString
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWriteTransfer
EventSetInformation
EventProviderEnabled
EventUnregister
EventActivityIdControl
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcess
GetExitCodeThread
TerminateProcess
OpenThreadToken
GetCurrentThread
GetCurrentProcessId
GetThreadId
SetThreadToken
OpenProcessToken
CreateThread
GetProcessId
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
RoOriginateErrorW
RoTransformError
RoOriginateError
GetRestrictedErrorInfo
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegGetValueW
RegQueryInfoKeyW
api-ms-win-core-com-l1-1-0
CoUnmarshalInterface
CoGetMalloc
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoTaskMemRealloc
CoTaskMemFree
CoMarshalInterface
CoCreateFreeThreadedMarshaler
CoGetStdMarshalEx
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoWaitForMultipleHandles
CreateStreamOnHGlobal
CoCreateGuid
StringFromGUID2
CoTaskMemAlloc
CoGetCallContext
api-ms-win-shcore-stream-l1-1-0
IStream_Read
IStream_Size
IStream_Reset
IStream_Write
SHCreateMemStream
rpcrt4
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_AddRef
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
UuidCreate
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
I_RpcBindingInqLocalClientPID
coremessaging
CoreUICreate
MsgBufferShare
MsgRelease
MsgStringCreateShared
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolTimer
CloseThreadpoolWait
api-ms-win-core-winrt-error-l1-1-1
RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-winrt-propertysetprivate-l1-1-1
RoCreatePropertySetSerializer
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-shcore-thread-l1-1-0
SHGetThreadRef
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindExtensionW
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
ntdll
RtlFreeHeap
NtQueryInformationToken
RtlInitUnicodeString
RtlAllocateHeap
EtwTraceMessage
RtlCompareUnicodeString
NtQueryWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlGetAppContainerSidType
RtlQueryPackageClaims
RtlNtStatusToDosErrorNoTeb
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpIW
StrCmpLogicalW
api-ms-win-appmodel-runtime-l1-1-0
GetPackagesByPackageFamily
GetPackageFamilyName
api-ms-win-appmodel-runtime-l1-1-1
GetPackageFamilyNameFromToken
GetApplicationUserModelIdFromToken
ParseApplicationUserModelId
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
oleaut32
SysFreeString
SysAllocString
api-ms-win-appmodel-unlock-l1-1-0
IsDeveloperModeEnabled
api-ms-win-shlwapi-winrt-storage-l1-1-1
AssocCreate
api-ms-win-storage-exports-external-l1-1-0
STORAGE_CStorageItem_GetValidatedStorageItem
api-ms-win-appmodel-state-l1-2-0
CloseState
GetSystemAppDataKey
OpenStateExplicit
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
combase
ord154
coreuicomponents
CoreUIFactoryCreate
msvcp110_win
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
?_Winerror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?_Add_vtordisp1@?$basic_istream@GU?$char_traits@G@std@@@std@@UAEXXZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Add_vtordisp2@?$basic_ostream@GU?$char_traits@G@std@@@std@@UAEXXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
??0id@locale@std@@QAE@I@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Add_vtordisp1@?$basic_ios@GU?$char_traits@G@std@@@std@@UAEXXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@GDH@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??1?$codecvt@GDH@std@@MAE@XZ
?_Getcat@?$codecvt@GDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$codecvt@GDH@std@@QAE@I@Z
?in@?$codecvt@GDH@std@@QBEHAAHPBD1AAPBDPAG3AAPAG@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
??1facet@locale@std@@MAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?exceptions@ios_base@std@@QAEXH@Z
??Bios_base@std@@QBEPAXXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Wcscoll
_Wcsxfrm
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@G@std@@2V0locale@2@A
?id@?$collate@G@std@@2V0locale@2@A
?c_str@?$_Yarn@D@std@@QBEPBDXZ
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?tolower@?$ctype@G@std@@QBEGG@Z
?is@?$ctype@G@std@@QBE_NFG@Z
??0facet@locale@std@@IAE@I@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient3
ObjectStublessClient4
ObjectStublessClient5
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
ResolveConnectedSharePlatformToken
SerializePropertyBag
Sections
.text Size: 753KB - Virtual size: 753KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ