MSFLACDecoder.pdb
Static task
static1
Behavioral task
behavioral1
Sample
MSFlacDecoder.dll
Resource
win10v2004-20240426-en
General
-
Target
MSFlacDecoder.dll
-
Size
395KB
-
MD5
64019b3a0b0b39f83302a4c5613137f7
-
SHA1
adeedafc27b831ee9a7c4a8c93efa5a31e5de669
-
SHA256
1ce0db44d91f47297dd976b0b79ac340aa8e2ec3bfd54e8d39ab172ffcc963ca
-
SHA512
463725bc06b206cc709806c93b400769f6632a72f2f279f59aa24dfd53bbd13d68f2276b2bf04b014f597c2c54f5d69903017e59101a8807f565ae45bb4e6d81
-
SSDEEP
6144:Zwbz98h+yUPV7nALK5YVVPOqpS1gTKQppZIJqWLOudt3kRLRfyjP2pF5+CA:GbxPJenrOqpCgTVpjIUWLSfyjP6rA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MSFlacDecoder.dll
Files
-
MSFlacDecoder.dll.dll regsvr32 windows:10 windows x86 arch:x86
2523d3cd85c44b116f17f89d982e6b24
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_errno
??1exception@@UAE@XZ
_strdup
_strnicmp
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_vsnprintf
strcat_s
_strcmpi
_wchmod
qsort
_vsnprintf_s
memcmp
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
swscanf_s
_except_handler4_common
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
memmove
__CxxFrameHandler3
memcpy
_CxxThrowException
_wutime64
wcsncmp
strnlen
strncpy_s
_wcsicmp
realloc
fclose
calloc
_callnewh
_purecall
_vsnwprintf
wcscat_s
wcscpy_s
memcpy_s
malloc
wcsncpy_s
free
__iob_func
_CIlog
_CIsqrt
_ftol2
ceil
memchr
memset
oleaut32
SysAllocString
VarUI4FromStr
VariantChangeType
VariantInit
VariantClear
api-ms-win-core-synch-l1-1-0
SetEvent
EnterCriticalSection
WaitForSingleObjectEx
ReleaseMutex
OpenSemaphoreW
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
ReleaseSRWLockExclusive
ResetEvent
CreateEventW
AcquireSRWLockExclusive
WaitForMultipleObjectsEx
DeleteCriticalSection
CreateMutexExW
CreateSemaphoreExW
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
GetModuleFileNameA
FreeLibrary
GetModuleHandleExW
SizeofResource
FindResourceExW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
LoadResource
GetModuleFileNameW
api-ms-win-core-com-l1-1-0
PropVariantCopy
PropVariantClear
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
IIDFromString
CoTaskMemFree
StringFromGUID2
CreateStreamOnHGlobal
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
api-ms-win-core-registry-l1-1-0
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW
RegDeleteValueW
RegOpenKeyExW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentThreadId
TerminateProcess
TlsSetValue
GetCurrentProcess
GetCurrentProcessId
TlsGetValue
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
api-ms-win-core-featurestaging-l1-1-0
SubscribeFeatureStateChangeNotification
UnsubscribeFeatureStateChangeNotification
GetFeatureEnabledState
RecordFeatureUsage
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
api-ms-win-core-localization-obsolete-l1-2-0
CompareStringA
api-ms-win-core-shlwapi-obsolete-l1-1-0
QISearch
crypt32
CryptStringToBinaryW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
propsys
StgSerializePropVariant
StgDeserializePropVariant
PSPropertyKeyFromString
PSCreateMemoryPropertyStore
PropVariantChangeType
InitPropVariantFromDoubleVector
InitPropVariantFromCLSID
PSStringFromPropertyKey
avrt
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsW
Exports
Exports
??0Application@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0Application@Metadata@FLAC@@QAE@ABV012@@Z
??0Application@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0Application@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0Chain@Metadata@FLAC@@QAE@ABV012@@Z
??0CueSheet@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0CueSheet@Metadata@FLAC@@QAE@ABV012@@Z
??0CueSheet@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0CueSheet@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0Iterator@Metadata@FLAC@@QAE@ABV012@@Z
??0Padding@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0Padding@Metadata@FLAC@@QAE@ABV012@@Z
??0Padding@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0Padding@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0Picture@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0Picture@Metadata@FLAC@@QAE@ABV012@@Z
??0Picture@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0Picture@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0SeekTable@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0SeekTable@Metadata@FLAC@@QAE@ABV012@@Z
??0SeekTable@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0SeekTable@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0SimpleIterator@Metadata@FLAC@@QAE@ABV012@@Z
??0State@Stream@Decoder@FLAC@@QAE@W4FLAC__StreamDecoderState@@@Z
??0Status@Chain@Metadata@FLAC@@QAE@W4FLAC__Metadata_ChainStatus@@@Z
??0Status@SimpleIterator@Metadata@FLAC@@QAE@W4FLAC__Metadata_SimpleIteratorStatus@@@Z
??0StreamInfo@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0StreamInfo@Metadata@FLAC@@QAE@ABV012@@Z
??0StreamInfo@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0StreamInfo@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0Unknown@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0Unknown@Metadata@FLAC@@QAE@ABV012@@Z
??0Unknown@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0Unknown@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??0VorbisComment@Metadata@FLAC@@QAE@ABUFLAC__StreamMetadata@@@Z
??0VorbisComment@Metadata@FLAC@@QAE@ABV012@@Z
??0VorbisComment@Metadata@FLAC@@QAE@PAUFLAC__StreamMetadata@@_N@Z
??0VorbisComment@Metadata@FLAC@@QAE@PBUFLAC__StreamMetadata@@@Z
??4Application@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4Application@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Application@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4Chain@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4CueSheet@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4CueSheet@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4CueSheet@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4Iterator@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Padding@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4Padding@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Padding@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4Picture@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4Picture@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Picture@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4SeekTable@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4SeekTable@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4SeekTable@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4SimpleIterator@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4State@Stream@Decoder@FLAC@@QAEAAV0123@$$QAV0123@@Z
??4State@Stream@Decoder@FLAC@@QAEAAV0123@ABV0123@@Z
??4Status@Chain@Metadata@FLAC@@QAEAAV0123@$$QAV0123@@Z
??4Status@Chain@Metadata@FLAC@@QAEAAV0123@ABV0123@@Z
??4Status@SimpleIterator@Metadata@FLAC@@QAEAAV0123@$$QAV0123@@Z
??4Status@SimpleIterator@Metadata@FLAC@@QAEAAV0123@ABV0123@@Z
??4StreamInfo@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4StreamInfo@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4StreamInfo@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4Unknown@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4Unknown@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4Unknown@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??4VorbisComment@Metadata@FLAC@@QAEAAV012@ABUFLAC__StreamMetadata@@@Z
??4VorbisComment@Metadata@FLAC@@QAEAAV012@ABV012@@Z
??4VorbisComment@Metadata@FLAC@@QAEAAV012@PBUFLAC__StreamMetadata@@@Z
??8Application@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Application@Metadata@FLAC@@QBE_NABV012@@Z
??8Application@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8CueSheet@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8CueSheet@Metadata@FLAC@@QBE_NABV012@@Z
??8CueSheet@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8Padding@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Padding@Metadata@FLAC@@QBE_NABV012@@Z
??8Padding@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8Picture@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Picture@Metadata@FLAC@@QBE_NABV012@@Z
??8Picture@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8Prototype@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Prototype@Metadata@FLAC@@QBE_NABV012@@Z
??8Prototype@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8SeekTable@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8SeekTable@Metadata@FLAC@@QBE_NABV012@@Z
??8SeekTable@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8StreamInfo@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8StreamInfo@Metadata@FLAC@@QBE_NABV012@@Z
??8StreamInfo@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8Unknown@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8Unknown@Metadata@FLAC@@QBE_NABV012@@Z
??8Unknown@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??8VorbisComment@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??8VorbisComment@Metadata@FLAC@@QBE_NABV012@@Z
??8VorbisComment@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Application@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Application@Metadata@FLAC@@QBE_NABV012@@Z
??9Application@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9CueSheet@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9CueSheet@Metadata@FLAC@@QBE_NABV012@@Z
??9CueSheet@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Padding@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Padding@Metadata@FLAC@@QBE_NABV012@@Z
??9Padding@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Picture@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Picture@Metadata@FLAC@@QBE_NABV012@@Z
??9Picture@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Prototype@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Prototype@Metadata@FLAC@@QBE_NABV012@@Z
??9Prototype@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9SeekTable@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9SeekTable@Metadata@FLAC@@QBE_NABV012@@Z
??9SeekTable@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9StreamInfo@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9StreamInfo@Metadata@FLAC@@QBE_NABV012@@Z
??9StreamInfo@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9Unknown@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9Unknown@Metadata@FLAC@@QBE_NABV012@@Z
??9Unknown@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??9VorbisComment@Metadata@FLAC@@QBE_NABUFLAC__StreamMetadata@@@Z
??9VorbisComment@Metadata@FLAC@@QBE_NABV012@@Z
??9VorbisComment@Metadata@FLAC@@QBE_NPBUFLAC__StreamMetadata@@@Z
??BPrototype@Metadata@FLAC@@QBEPBUFLAC__StreamMetadata@@XZ
??BState@Stream@Decoder@FLAC@@QBE?AW4FLAC__StreamDecoderState@@XZ
??BStatus@Chain@Metadata@FLAC@@QBE?AW4FLAC__Metadata_ChainStatus@@XZ
??BStatus@SimpleIterator@Metadata@FLAC@@QBE?AW4FLAC__Metadata_SimpleIteratorStatus@@XZ
??BStream@Decoder@FLAC@@QBE_NXZ
??_7Application@Metadata@FLAC@@6B@
??_7Chain@Metadata@FLAC@@6B@
??_7CueSheet@Metadata@FLAC@@6B@
??_7Iterator@Metadata@FLAC@@6B@
??_7Padding@Metadata@FLAC@@6B@
??_7Picture@Metadata@FLAC@@6B@
??_7SeekTable@Metadata@FLAC@@6B@
??_7SimpleIterator@Metadata@FLAC@@6B@
??_7StreamInfo@Metadata@FLAC@@6B@
??_7Unknown@Metadata@FLAC@@6B@
??_7VorbisComment@Metadata@FLAC@@6B@
?as_cstring@State@Stream@Decoder@FLAC@@QBEPBDXZ
?as_cstring@Status@Chain@Metadata@FLAC@@QBEPBDXZ
?as_cstring@Status@SimpleIterator@Metadata@FLAC@@QBEPBDXZ
?assign@Application@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@CueSheet@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@Padding@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@Picture@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@SeekTable@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@StreamInfo@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@Unknown@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?assign@VorbisComment@Metadata@FLAC@@QAEAAV123@PAUFLAC__StreamMetadata@@_N@Z
?get_isrc@Track@CueSheet@Metadata@FLAC@@QBEPBDXZ
?get_num_indices@Track@CueSheet@Metadata@FLAC@@QBEEXZ
?get_number@Track@CueSheet@Metadata@FLAC@@QBEEXZ
?get_offset@Track@CueSheet@Metadata@FLAC@@QBE_KXZ
?get_pre_emphasis@Track@CueSheet@Metadata@FLAC@@QBE_NXZ
?get_track@Track@CueSheet@Metadata@FLAC@@QBEPBUFLAC__StreamMetadata_CueSheet_Track@@XZ
?get_type@Track@CueSheet@Metadata@FLAC@@QBEIXZ
?is_valid@Prototype@Metadata@FLAC@@QBE_NXZ
?resolved_as_cstring@State@Stream@Decoder@FLAC@@QBEPBDABV234@@Z
?set_number@Track@CueSheet@Metadata@FLAC@@QAEXE@Z
?set_offset@Track@CueSheet@Metadata@FLAC@@QAEX_K@Z
?set_pre_emphasis@Track@CueSheet@Metadata@FLAC@@QAEX_N@Z
?set_reference@Prototype@Metadata@FLAC@@AAEX_N@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 357KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ