TaskSchdPS.pdb
Static task
static1
Behavioral task
behavioral1
Sample
TaskSchdPS.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
TaskSchdPS.dll
Resource
win10v2004-20240426-en
General
-
Target
TaskSchdPS.dll
-
Size
34KB
-
MD5
df13054276b85246142607a147b60f33
-
SHA1
dfd516f53568efcfc24df00ef20e812b428f25ea
-
SHA256
6f1f92d8acf2b52efacf8df7852e5267887f18a7e351a649399602d0d1dd0ee0
-
SHA512
733af6af7e39733a445d88382150491662aac41810c01c3655e224e37284daed254efbf6a344502804e8f0d92699fdb9b35fa88559fa7b5838086a208a2c0e5c
-
SSDEEP
768:xELeXVg8tAG6PvHJREnZUnDsJaJfxkSU2Rk7FuBX:l6PvHJGJaJfxkSU2a7MBX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource TaskSchdPS.dll
Files
-
TaskSchdPS.dll.dll regsvr32 windows:6 windows x86 arch:x86
5d458fcac4b1fdb7bf10ed7a8876e939
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
api-ms-win-core-crt-l2-1-0
_initterm_e
_initterm
oleaut32
BSTR_UserUnmarshal
BSTR_UserFree
VARIANT_UserFree
BSTR_UserMarshal
VARIANT_UserMarshal
BSTR_UserSize
VARIANT_UserUnmarshal
VARIANT_UserSize
rpcrt4
NdrOleFree
IUnknown_QueryInterface_Proxy
NdrOleAllocate
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
NdrStubCall2
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
NdrStubForwardingFunction
NdrDllUnregisterProxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-heap-l1-2-0
HeapFree
GetProcessHeap
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-2
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-2-1
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-errorhandling-l1-1-1
SetUnhandledExceptionFilter
UnhandledExceptionFilter
combase
ord3
ord7
ord14
ord16
ord17
ord10
ord12
ord5
ord9
ord2
ord4
ord8
ord15
ord35
ord33
ord22
ord32
ord23
ord20
ord21
ord34
ord19
ord18
ord11
ord13
ord6
api-ms-win-core-crt-l1-1-0
_except_handler4_common
memcmp
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 1024B - Virtual size: 575B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ