WcsPlugInService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
WcsPlugInService.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
WcsPlugInService.dll
Resource
win10v2004-20240508-en
General
-
Target
WcsPlugInService.dll
-
Size
33KB
-
MD5
9dd1ab3300c8d8e126f9ca280d631418
-
SHA1
0dcb32e803985d15b07e06dbe238327f46f1d821
-
SHA256
b6c09c37f4965fff6210d777390bbefc3fb81e77862435df958da0958eaa4f71
-
SHA512
a2d3a5ad40deae0514a8bbcf93a8a39b5be8fc2701d161db8adcb624a1f8b433d15541ea0a41f1b79a13933c1b478b611e265dde014ef61c51caa83fe9817854
-
SSDEEP
768:VXt5afXFxLXllU25gahqZw1gJ1p0uAO+bGoVPuuxWUL:VXf01ldgahqpJXVUbbuuxWU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WcsPlugInService.dll
Files
-
WcsPlugInService.dll.dll windows:6 windows x86 arch:x86
6337861850b4c01378fd964f4d94c177
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
memset
_purecall
??2@YAPAXI@Z
??_U@YAPAXI@Z
memcpy_s
free
malloc
wcsncpy_s
??_V@YAXPAX@Z
??3@YAXPAX@Z
memcmp
oleaut32
BSTR_UserUnmarshal
VarUI4FromStr
BSTR_UserFree
BSTR_UserMarshal
BSTR_UserSize
ole32
CoUninitialize
CoResumeClassObjects
CoInitializeEx
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
ObjectStublessClient9
ObjectStublessClient5
ObjectStublessClient3
ObjectStublessClient10
ObjectStublessClient6
ObjectStublessClient13
ObjectStublessClient11
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient4
ObjectStublessClient12
user32
CharNextW
UnregisterClassA
kernel32
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
CloseHandle
WaitForSingleObject
CreateEventW
SetEvent
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
lstrcmpiW
advapi32
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
rpcrt4
IUnknown_QueryInterface_Proxy
NdrOleFree
CStdStubBuffer_AddRef
NdrCStdStubBuffer_Release
CStdStubBuffer_CountRefs
NdrDllCanUnloadNow
IUnknown_Release_Proxy
NdrOleAllocate
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
NdrDllGetClassObject
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
Exports
Exports
DllCanUnloadNow
DllGetClassObject
ServiceMain
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 229B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ