bitsperf.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bitsperf.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bitsperf.dll
Resource
win10v2004-20240508-en
General
-
Target
bitsperf.dll
-
Size
24KB
-
MD5
64501eef0fd4d2e81ea2935255c53b4e
-
SHA1
26816ef4c3de46990e9ae81eca3e10385baaba59
-
SHA256
b9b9ab1bec792429837d58d9e324a904c0d6dd51c3e816c20db19d3eb2a72bce
-
SHA512
edc3adba519fd5b0db164b66230e6d74141beea409b93abc3cb1ae8c737a6d85c7eaa8d15373c0e0a946a90d31d5cb63f5bd2611ff57e047c64c8d84e7554a0e
-
SSDEEP
384:cHptgsKPnpY2VVh4PktF0YDD1p9n06pCQ7DJ8V8ej7qCC5HBW5cWa:cHptN2/hX350QNstC5cQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bitsperf.dll
Files
-
bitsperf.dll.dll windows:6 windows x64 arch:x64
9caf06ba05e5c814ef0e9648003ab61b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
__C_specific_handler
malloc
free
_amsg_exit
_initterm
_XcptFilter
_vsnwprintf
memcpy
_wcsicmp
memset
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
rpcrt4
RpcStringFreeW
UuidToStringW
UuidCreate
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-memory-l1-1-2
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
api-ms-win-core-errorhandling-l1-1-1
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-heap-l1-2-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-2
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-2-1
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
Exports
Exports
??0CPerfMon@@QEAA@PEAGPEAU_PERF_ITEM@0@@Z
??1CPerfMon@@QEAA@XZ
??4CPerfMon@@QEAAAEAV0@AEBV0@@Z
?CalcBytesForPerfObject@CPerfMon@@AEBAKPEAU__OBJECT_ORD@1@@Z
?CalcPerfMetrics@CPerfMon@@AEBAXPEAU__OBJECT_ORD@1@PEAU__INSTANCE_ID@1@PEAU_PERF_METRICS@1@PEAPEAU_PERF_ITEM@1@@Z
?Collect@CPerfMon@@QEAAKPEAGPEAPEAEPEAK2@Z
?CollectAllObjects@CPerfMon@@AEBAKPEAGPEAPEAEPEAK2@Z
?CollectAnObject@CPerfMon@@AEBAKPEAU__OBJECT_ORD@1@PEAPEAE@Z
?ConvertInstIdToInUseInstId@CPerfMon@@AEBAHPEAU__OBJECT_ORD@1@PEAU__INSTANCE_ID@1@@Z
?CounterIdToObjectOrd@CPerfMon@@AEBAPEAU__OBJECT_ORD@1@PEAU__COUNTER_ID@1@PEAH@Z
?CounterIdToPerfItem@CPerfMon@@AEBAPEAU_PERF_ITEM@1@PEAU__COUNTER_ID@1@@Z
?CounterIdToPerfItemIndex@CPerfMon@@AEBAHPEAU__COUNTER_ID@1@PEAH@Z
?CounterOrdToPerfItem@CPerfMon@@AEBAPEAU_PERF_ITEM@1@PEAU__OBJECT_ORD@1@PEAU__COUNTER_ORD@1@@Z
?DetermineObjectsToCollect@CPerfMon@@AEBAXPEAU__OBJECT_ORD@1@@Z
?GetCounter32@CPerfMon@@QEAAPEAJPEAU__COUNTER_ID@1@PEAU__INSTANCE_ID@1@@Z
?GetCounter64@CPerfMon@@QEAAPEA_JPEAU__COUNTER_ID@1@PEAU__INSTANCE_ID@1@@Z
?GetCounter@CPerfMon@@AEAAPEAEPEAU__COUNTER_ID@1@PEAU__INSTANCE_ID@1@@Z
?HowManyInstancesAreInUse@CPerfMon@@AEBAHPEAU__OBJECT_ORD@1@@Z
?IdToPerfItemIndex@CPerfMon@@AEBAHH_K@Z
?Initialize@CPerfMon@@QEAAKH@Z
?InitializePerfMon@CPerfMon@@AEAAKH@Z
?IsValidInstId@CPerfMon@@AEBAHPEAU__OBJECT_ORD@1@PEAU__INSTANCE_ID@1@@Z
?IsValidObjOrd@CPerfMon@@AEBAHPEAU__OBJECT_ORD@1@@Z
?ObjectIdToObjectOrd@CPerfMon@@AEBAPEAU__OBJECT_ORD@1@PEAU__OBJECT_ID@1@@Z
?ObjectIdToPerfItem@CPerfMon@@AEBAPEAU_PERF_ITEM@1@PEAU__OBJECT_ID@1@@Z
?ObjectIdToPerfItemIndex@CPerfMon@@AEBAHPEAU__OBJECT_ID@1@@Z
?ObjectOrdToPerfItem@CPerfMon@@AEBAPEAU_PERF_ITEM@1@PEAU__OBJECT_ORD@1@@Z
?ObjectOrdToPerfItemIndex@CPerfMon@@AEBAHPEAU__OBJECT_ORD@1@@Z
?VerifyPerfItemTable@CPerfMon@@AEAAKXZ
PerfMon_Close
PerfMon_Collect
PerfMon_Open
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ