Windows.Web.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Windows.Web.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Windows.Web.dll
Resource
win10v2004-20240508-en
General
-
Target
Windows.Web.dll
-
Size
553KB
-
MD5
af65521a5b136f0d53dfcf66ad1b3b62
-
SHA1
e1535306d49091a91478edcb4a8d2c881e3e35d4
-
SHA256
bb348c855ee042d1b2053cf019252d895155ce13325421a435020a504a376841
-
SHA512
ff1504a3f9f833467fc5d0671e8ae23cc695f09d26283b72ec2085a2bfe1c563022d18131dfe4ce8145f3626c505339d266749194cd6eb35b993bd78ecf2666b
-
SSDEEP
12288:8OifklQPCzbHwMGsaqdSumQWAnc8JX7JkNutMXhdd:IfklQPCPXYGc8Jd7eXt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Windows.Web.dll
Files
-
Windows.Web.dll.dll regsvr32 windows:6 windows x86 arch:x86
0054dd7624583847e5d4e62f05770685
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_XcptFilter
_itoa_s
_ftol2
_itow_s
_wcsicmp
memcmp
_amsg_exit
_initterm
_ecvt_s
_finite
_lock
_unlock
__dllonexit
memcpy
??3@YAXPAX@Z
_onexit
__CxxFrameHandler3
_except_handler4_common
_wtof
free
realloc
malloc
memmove_s
_purecall
??2@YAPAXI@Z
memset
ntdll
WinSqmIncrementDWORD
WinSqmIsOptedIn
WinSqmSetDWORD
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-synch-l1-2-0
AcquireSRWLockShared
ReleaseSRWLockShared
LeaveCriticalSection
EnterCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DeleteCriticalSection
InitOnceExecuteOnce
InitializeCriticalSection
CreateEventW
Sleep
api-ms-win-core-processthreads-l1-1-2
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
OpenProcessToken
OpenProcess
api-ms-win-security-base-l1-2-0
GetTokenInformation
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-1
UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
CallbackMayRunLong
TrySubmitThreadpoolCallback
SubmitThreadpoolWork
CreateThreadpoolWait
CloseThreadpoolWait
CloseThreadpoolWork
SetThreadpoolWait
FreeLibraryWhenCallbackReturns
WaitForThreadpoolWorkCallbacks
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventWrite
EventUnregister
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-sysinfo-l1-2-1
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
rpcrt4
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
RpcStringFreeW
UuidToStringW
UuidCreate
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllUnregisterProxy
CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
NdrStubCall2
CStdStubBuffer_DebugServerRelease
NdrStubForwardingFunction
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
FreeLibrary
GetModuleHandleExW
DisableThreadLibraryCalls
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
combase
ord34
ord13
ord11
ord16
ord7
ord14
ord6
ord10
ord12
ord9
ord8
ord15
ord17
ord5
ord32
ord2
ord3
ord33
api-ms-win-core-localization-l1-2-1
FormatMessageW
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
api-ms-win-core-delayload-l1-1-1
DelayLoadFailureHook
ResolveDelayLoadedAPI
Exports
Exports
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 483KB - Virtual size: 482KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ