ShareHost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ShareHost.dll
Resource
win10v2004-20240508-en
General
-
Target
ShareHost.dll
-
Size
567KB
-
MD5
19a5eff58908d88a32069ca5defdab16
-
SHA1
8c1a2c58193055a0629a374a5888094bfdddc189
-
SHA256
8b57eed3de348a1c0b6fe1316e53fd2b22263a7ae7a9b39cbea875c8ead06a26
-
SHA512
9b4c304b6232e56776fdb2f287045a7e9870cc246de0de92fa7f518e4f58303619665e90219c3e1067b46a2793bd6634e04189ac745efb9e0db473423c36e735
-
SSDEEP
12288:IrZ1BkYsbGLq3jLAOhPaIXIkCzL4wu3pUo1CJEsUIj:U12dbGa0OhrXIkCzLOZUo1Gj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ShareHost.dll
Files
-
ShareHost.dll.dll windows:10 windows x86 arch:x86
5c277fcee5c439bb950c2d71cab4a702
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
_XcptFilter
_amsg_exit
memcmp
free
memcpy
malloc
??0exception@@QAE@XZ
__CxxFrameHandler3
_initterm
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_lock
_unlock
_onexit
memmove
strncpy_s
_purecall
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
_set_errno
_errno
_get_errno
strtol
_ui64tow_s
strchr
strrchr
memmove_s
sprintf_s
??_V@YAXPAX@Z
realloc
wcscpy_s
??0exception@@QAE@ABQBD@Z
_vsnprintf
__ExceptionPtrAssign
__ExceptionPtrCreate
__ExceptionPtrCopy
__ExceptionPtrToBool
__ExceptionPtrDestroy
__ExceptionPtrCurrentException
__ExceptionPtrRethrow
_wcsicmp
wcscspn
wcschr
_callnewh
__dllonexit
??3@YAXPAX@Z
memcpy_s
_CxxThrowException
_vsnwprintf
??1exception@@UAE@XZ
memset
windows.storage
SHGetKnownFolderPath
STORAGE_CreateStorageItemFromPath_FullTrustCaller
api-ms-win-core-libraryloader-l1-2-0
LoadResource
LockResource
GetModuleFileNameA
GetModuleHandleExA
FindResourceExW
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
Sleep
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
CreateEventW
SetEvent
DeleteCriticalSection
CreateMutexExW
ReleaseMutex
InitializeSRWLock
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
LeaveCriticalSection
WaitForSingleObjectEx
CreateEventExW
AcquireSRWLockShared
EnterCriticalSection
OpenSemaphoreW
ReleaseSemaphore
ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserSize
HSTRING_UserMarshal
WindowsDuplicateString
HSTRING_UserFree
HSTRING_UserUnmarshal
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsCreateString
WindowsCompareStringOrdinal
WindowsIsStringEmpty
WindowsSubstringWithSpecifiedLength
WindowsCreateStringReference
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventActivityIdControl
EventUnregister
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-0
SetThreadToken
CreateThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
OpenThreadToken
GetThreadId
TerminateProcess
OpenProcessToken
GetCurrentThread
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
RoTransformError
SetRestrictedErrorInfo
GetRestrictedErrorInfo
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCloseKey
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
CoGetInterfaceAndReleaseStream
CoTaskMemFree
CoGetCallContext
CoCreateInstance
CoWaitForMultipleHandles
CoUnmarshalInterface
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CreateStreamOnHGlobal
CoReleaseMarshalData
CoCreateGuid
CoMarshalInterface
CoInitializeEx
CoUninitialize
CoGetMalloc
CoGetStdMarshalEx
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
PathIsFileSpecW
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWaitCallbacks
SetThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
api-ms-win-core-kernel32-legacy-l1-1-1
PowerCreateRequest
PowerSetRequest
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
ntdll
RtlFreeHeap
NtQueryInformationToken
RtlInitUnicodeString
EtwTraceMessage
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
RtlQueryPackageClaims
RtlGetDeviceFamilyInfoEnum
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpIW
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient3
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
combase
ord154
msvcp110_win
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?in@?$codecvt@GDH@std@@QBEHAAHPBD1AAPBDPAG3AAPAG@Z
??0?$codecvt@GDH@std@@QAE@I@Z
?_Getcat@?$codecvt@GDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1?$codecvt@GDH@std@@MAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
??0id@locale@std@@QAE@I@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_BADOFF@std@@3_JB
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Add_vtordisp1@?$basic_ios@GU?$char_traits@G@std@@@std@@UAEXXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Add_vtordisp2@?$basic_ostream@GU?$char_traits@G@std@@@std@@UAEXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@GDH@std@@2V0locale@2@A
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetProxyDllInfo
ResolveConnectedSharePlatformToken
Sections
.text Size: 516KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ