WcsPlugInService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
WcsPlugInService.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
WcsPlugInService.dll
Resource
win10v2004-20240508-en
General
-
Target
WcsPlugInService.dll
-
Size
33KB
-
MD5
69059cd0abd70c3884117652e3b70431
-
SHA1
06b349547c798b70a2a0f5881580831c5045b83b
-
SHA256
8568210e62c827c43377c09f40974628ff25cfd35a45ea4d4e3fdd5884f91617
-
SHA512
9c7e21fc7a3a20829912cef93c88900eb0ee20df9f54817966428a87574710ad76cebdd624e7b7b36b9fb0ebe91cfbb528e7629e2aaf7a116c710cf46a384675
-
SSDEEP
768:VPGygfLQpVbftO9kD0j4RJ4Cwu8VcwHZEPluSuQ/2:V+WEkDe4TIaU8luSu62
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WcsPlugInService.dll
Files
-
WcsPlugInService.dll.dll windows:6 windows x86 arch:x86
6337861850b4c01378fd964f4d94c177
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
memset
_purecall
??2@YAPAXI@Z
??_U@YAPAXI@Z
memcpy_s
free
malloc
wcsncpy_s
??_V@YAXPAX@Z
??3@YAXPAX@Z
memcmp
oleaut32
BSTR_UserUnmarshal
VarUI4FromStr
BSTR_UserFree
BSTR_UserMarshal
BSTR_UserSize
ole32
CoUninitialize
CoResumeClassObjects
CoInitializeEx
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
ObjectStublessClient9
ObjectStublessClient5
ObjectStublessClient3
ObjectStublessClient10
ObjectStublessClient6
ObjectStublessClient13
ObjectStublessClient11
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient4
ObjectStublessClient12
user32
CharNextW
UnregisterClassA
kernel32
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
CloseHandle
WaitForSingleObject
CreateEventW
SetEvent
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
lstrcmpiW
advapi32
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
rpcrt4
IUnknown_QueryInterface_Proxy
NdrOleFree
CStdStubBuffer_AddRef
NdrCStdStubBuffer_Release
CStdStubBuffer_CountRefs
NdrDllCanUnloadNow
IUnknown_Release_Proxy
NdrOleAllocate
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
NdrDllGetClassObject
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
Exports
Exports
DllCanUnloadNow
DllGetClassObject
ServiceMain
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 218B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ