wls0wndh.pdb
Static task
static1
Behavioral task
behavioral1
Sample
WlS0WndH.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
WlS0WndH.dll
Resource
win10v2004-20240426-en
General
-
Target
WlS0WndH.dll
-
Size
9KB
-
MD5
6fb18abae8833fc8aebe2a47ce3653f4
-
SHA1
e111b0fc0756be4e67015d5ff33ad13f2ceb4102
-
SHA256
d505f3e1e33974643f4c29552954c5714e82e0f8953864b309df47f227e4eaf2
-
SHA512
8463a2e2f08b36f08009a58e8efa63da7019034f12ee978594f508d93bf65d43687afeca9bddc5f0710ce8b3b2cf71981bf46e4b75d6eea1000be3a6b720a7f1
-
SSDEEP
96:wxkaCg5v+n/rTVPZWNsiGEep4WYELmPTUadaF/ItJBdhEsBSCDsiEWOOkWwt93za:C7C/XVPkNhGEFFToF0BbBSCDGWOOkWg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WlS0WndH.dll
Files
-
WlS0WndH.dll.dll windows:6 windows x86 arch:x86
275273b4f8cf46153aff2db128a43145
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_amsg_exit
free
_except_handler4_common
_initterm
malloc
_XcptFilter
ntdll
RtlTimeToSecondsSince1980
user32
GetParent
CallNextHookEx
FindWindowW
kernel32
GetSystemTimeAsFileTime
ResolveDelayLoadedAPI
DelayLoadFailureHook
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls
QueueUserWorkItem
GetLastError
Exports
Exports
Session0ViewerWindowProcHook
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 870B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ