OnDemandBrokerClient[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

OnDemandBrokerClient.dll
Size

33KB
MD5

823a425033070ea1343f315c00c84f71
SHA1

fd163b26d136df11d7cbd32c4877d770a4601652
SHA256

7a379c3aef13f86fe7726caee6f6ac302b0bc70ef4d5d49c7ea981907a8c0d90
SHA512

732074b2a5aff0eafe7fc6f5bf56767d572518819d81613ea0943956f8f9f7f7f6f8abb2b351bd685930740b09c1456f43982ddf9bf36d81a2823d3a28592c5c
SSDEEP

384:JGu7fpL3aCLte2uZ53sJjHhIg1Ny7BExOTZBD4iBLaDLOTSA0VKmeo2wvgfR2Mp0:b7ZKCLE2+sRBIe0TZBlL/TfhdelZmyt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OnDemandBrokerClient.dll

Files

OnDemandBrokerClient.dll
.dll windows:10 windows x86 arch:x86

8662f5084900bd18b5cee0532e16e5f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

OnDemandBrokerClient.pdb

Imports

msvcrt

_amsg_exit
_callnewh
_initterm
malloc
_except_handler4_common
free
_XcptFilter
memcpy_s
wcscpy_s
_purecall
__CxxFrameHandler3
memset

rpcrt4

RpcBindingFree
RpcBindingBind
NdrClientCall4
I_RpcMapWin32Status
RpcBindingCreateW
I_RpcExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExA
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoCreateFreeThreadedMarshaler
IIDFromString
CoTaskMemAlloc

oleaut32

SysFreeString

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateString

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
GetTokenInformation
RevertToSelf

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

ntdll

RtlSubscribeWnfStateChangeNotification
RtlCopySid
RtlLengthSid
RtlUnsubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-appmodel-runtime-l1-1-0

GetPackagesByPackageFamily

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CreateOnDemandBrokerClient

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8662f5084900bd18b5cee0532e16e5f5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

rpcrt4

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

ntdll

api-ms-win-appmodel-runtime-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 25KB - Virtual size: 24KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 25KB - Virtual size: 24KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB