AuditNativeSnapIn.pdb
Static task
static1
Behavioral task
behavioral1
Sample
AuditNativeSnapIn.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
AuditNativeSnapIn.dll
Resource
win10v2004-20240508-en
General
-
Target
AuditNativeSnapIn.dll
-
Size
214KB
-
MD5
0f533461a46e72a88ac38b3b2558c741
-
SHA1
dfccc1c92e489824c8d7be679ee4530bdf4ba53b
-
SHA256
81a2157acb50c00a6f27ae1f0b411585f8306c51266f2eba5f66125070a10e46
-
SHA512
c7904ddea56a610ec44f60a7fcf06c7ccc58233eb537e68de0079266232834e3f816c80540b9ee41de72a609e796eb20f6cb31ea0b12057a422a9ef7ff2e1585
-
SSDEEP
3072:vGFjGDon9d7PxB3m10RgFz/4vB1Tn1m9d7PxB3m10RgFz/4vB1Tn1k:vGFj0JLATn1VLATn1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AuditNativeSnapIn.dll
Files
-
AuditNativeSnapIn.dll.dll windows:6 windows x86 arch:x86
e14503c341fec64dd9e6d3cd250393ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler4_common
_initterm
malloc
_amsg_exit
_XcptFilter
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
free
memset
kernel32
Sleep
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetLastError
GlobalFree
GlobalAlloc
FreeResource
lstrlenW
HeapAlloc
HeapFree
GetProcessHeap
ole32
CreateStreamOnHGlobal
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
user32
LoadStringW
LoadImageW
RegisterClipboardFormatW
LoadBitmapW
LoadIconW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 197KB - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ