Accessibility.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6a3bdb8f4c1227a2c9245b0d2d3598a2a3dce5cf6d6dc4b1cf8ca0fd56faefeb.dll
Resource
win7-20240220-en
General
-
Target
6a3bdb8f4c1227a2c9245b0d2d3598a2a3dce5cf6d6dc4b1cf8ca0fd56faefeb
-
Size
776KB
-
MD5
1d01a9d6f555c0287f4f8ef08b7450ce
-
SHA1
66ed3d60d0758cc02ba9a58b4db9bb9558e16905
-
SHA256
6a3bdb8f4c1227a2c9245b0d2d3598a2a3dce5cf6d6dc4b1cf8ca0fd56faefeb
-
SHA512
18f249873e4a8427a64a80ec776b6a2d043a2ae6570fb9488418f49f42373da686adf7017e85fa06cd1d8e5eb0254dd2ee80bc59da41c58bcf1b2bdc84f330fa
-
SSDEEP
12288:FqE/hfDbpkC1Fy6lwwnsziJ04tF2+iOgpybK+6s19FjNWHKtJ/cxP0/ffflRDAhF:sE5fD1Fy6lwwn6OSRr+6s19D+qflx2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a3bdb8f4c1227a2c9245b0d2d3598a2a3dce5cf6d6dc4b1cf8ca0fd56faefeb
Files
-
6a3bdb8f4c1227a2c9245b0d2d3598a2a3dce5cf6d6dc4b1cf8ca0fd56faefeb.dll regsvr32 windows:5 windows x86 arch:x86
80bc9056a8cbddae26b1e99243dcbdb3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LoadLibraryExA
EnterCriticalSection
LeaveCriticalSection
IsDBCSLeadByte
GetModuleFileNameA
InterlockedIncrement
InterlockedDecrement
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryA
GetSystemDirectoryA
SetThreadLocale
GetThreadLocale
LockResource
FreeResource
OutputDebugStringA
lstrcpyA
GetTickCount
FindAtomW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
GetModuleFileNameW
SetLastError
LoadLibraryW
lstrcmpiA
lstrlenA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
user32
wsprintfA
GetWindowTextA
SetFocus
MoveWindow
GetPropW
IsWindow
SetPropW
SystemParametersInfoA
CharNextA
FindWindowA
OffsetRect
IsRectEmpty
GetWindowRect
CharNextW
GetFocus
NotifyWinEvent
GetWindowThreadProcessId
GetGUIThreadInfo
GetClassNameA
advapi32
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
ole32
StringFromGUID2
CoDisconnectObject
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
oleaut32
SysFreeString
VariantClear
SysStringLen
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
SysAllocString
SysStringByteLen
VariantInit
UnRegisterTypeLi
RegisterTypeLi
msvcp100
?max@?$numeric_limits@F@std@@SAFXZ
?max@?$numeric_limits@I@std@@SAIXZ
??0_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
??1_Container_base12@std@@QAE@XZ
??Bios_base@std@@QBEPAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_BADOFF@std@@3_JB
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?max@?$numeric_limits@J@std@@SAJXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0_Lockit@std@@QAE@H@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
msvcr100
fsetpos
_wtoi
strcat_s
wcsncpy_s
strcpy_s
_mbsnbcat_s
wcscmp
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_except_handler4_common
_vsnprintf_s
strncmp
isdigit
_time64
_localtime64
_gmtime64
atoi
isalpha
strchr
??3@YAXPAX@Z
memcmp
strlen
memcpy
memmove
memset
strstr
__CxxFrameHandler3
_CxxThrowException
strpbrk
strrchr
__RTDynamicCast
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
fgetc
fputc
ungetc
_lock_file
_unlock_file
fflush
setvbuf
memcpy_s
fwrite
fgetpos
_fseeki64
vsprintf_s
fclose
_purecall
tolower
strcmp
_set_invalid_parameter_handler
memchr
_mbsnbcpy_s
_mbsstr
malloc
free
??_V@YAXPAX@Z
_resetstkoflw
_recalloc
Exports
Exports
DllRegisterServer
DllUnregisterServer
PlugInMain
Sections
.text Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 337KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ