Bcp47Langs.pdb
Static task
static1
Behavioral task
behavioral1
Sample
BCP47Langs.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
BCP47Langs.dll
Resource
win10v2004-20240508-en
General
-
Target
BCP47Langs.dll
-
Size
270KB
-
MD5
963cb4cdd293fab48907b8a9211262e5
-
SHA1
3e2b3ac71ada34f28edef9c587927cadfef658fd
-
SHA256
8cddd8aaa865e23b8c52cd8fecd234e620256d01d0b7f0db284ab1c770735992
-
SHA512
bd362bb25079272a1d0d8ea7d018feebd9cb6e89355b21201f0994e6e9c441a14cfe57e6a566409562cfa4d2e85156c1242d0c89751a1725b2a0376928b7ef2a
-
SSDEEP
6144:3Y++moT+w3tPNOBfN7+vakWWEyPkSulnlLYjeHQE8ZDbAu/mz:3Y+w9PNOBfB+vBEyPDul0ewEu89
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BCP47Langs.dll
Files
-
BCP47Langs.dll.dll windows:6 windows x86 arch:x86
cc0a6caec16b8a0fb309a5acbe5b7f3c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_lock
??1type_info@@UAE@XZ
_unlock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
abort
strtod
tolower
isspace
__uncaught_exception
strerror
__dllonexit
_CxxThrowException
_callnewh
_errno
___mb_cur_max_func
calloc
___lc_codepage_func
___lc_handle_func
__pctype_func
memcpy
__CxxFrameHandler3
_except_handler4_common
malloc
__crtLCMapStringW
ldexp
strcspn
sprintf_s
localeconv
ceil
memchr
memmove_s
towlower
??8type_info@@QBEHABV0@@Z
wcschr
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
toupper
_ftol2_sse
_ftol2
_CIlog10
free
??1bad_cast@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0bad_cast@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
memmove
_onexit
bsearch
_wtoi
??_V@YAXPAX@Z
wcscpy_s
_purecall
_vsnwprintf
swscanf
_wcsicmp
??3@YAXPAX@Z
setlocale
memset
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteTreeW
RegCreateKeyExW
RegOpenCurrentUser
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
api-ms-win-core-string-l1-1-0
GetStringTypeW
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-localization-l1-2-1
LocaleNameToLCID
IsValidLocaleName
GetLocaleInfoEx
GetUILanguageInfo
GetUserPreferredUILanguages
GetSystemPreferredUILanguages
ResolveLocaleName
GetUserDefaultLocaleName
api-ms-win-core-errorhandling-l1-1-1
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-core-processthreads-l1-1-2
GetCurrentThreadId
GetCurrentProcessId
OpenProcessToken
TerminateProcess
SetThreadToken
GetCurrentProcess
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-base-l1-2-0
CopySid
IsWellKnownSid
GetTokenInformation
RevertToSelf
DuplicateTokenEx
GetLengthSid
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsDuplicateString
WindowsStringHasEmbeddedNull
WindowsCreateString
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-synch-l1-2-0
Sleep
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-1
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-localization-obsolete-l1-2-0
EnumUILanguagesW
LCIDToLocaleName
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
api-ms-win-core-localization-private-l1-1-0
LoadStringByReference
NlsUpdateLocale
ntdll
WinSqmAddToStream
WinSqmSetString
WinSqmSetDWORD
RtlFreeSid
NtCreateLowBoxToken
WinSqmIncrementDWORD
WinSqmIsOptedIn
api-ms-win-appmodel-runtime-l1-1-0
GetCurrentPackageFamilyName
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
DelayLoadFailureHook
ResolveDelayLoadedAPI
Exports
Exports
??0CLanguage@Internal@Windows@@QAE@ABV012@@Z
??0CLanguage@Internal@Windows@@QAE@PAUHKL__@@@Z
??0CLanguage@Internal@Windows@@QAE@PBG@Z
??0CLanguage@Internal@Windows@@QAE@XZ
??0CLanguage@Internal@Windows@@QAE@_K@Z
??0CLanguagesListFactory@Internal@Windows@@AAE@XZ
??0CRegion@Internal@Windows@@QAE@I@Z
??0CRegion@Internal@Windows@@QAE@PBG@Z
??1CLanguage@Internal@Windows@@UAE@XZ
??1CLanguagesListFactory@Internal@Windows@@AAE@XZ
??1CRegion@Internal@Windows@@QAE@XZ
??4CLanguage@Internal@Windows@@IAEAAV012@ABV012@@Z
??4CLanguagesListFactory@Internal@Windows@@QAEAAV012@ABV012@@Z
??4CRegion@Internal@Windows@@QAEAAV012@ABV012@@Z
??8CLanguage@Internal@Windows@@QBE_NABV012@@Z
??8CRegion@Internal@Windows@@QBE_NABV012@@Z
??8CRegion@Internal@Windows@@QBE_NI@Z
??BCLanguage@Internal@Windows@@QBE?AUBcp47TagSubtagsInfo@12@XZ
??BCLanguage@Internal@Windows@@QBE_KXZ
??_7CLanguage@Internal@Windows@@6B@
?CheckLanguageRegionAffinity@CLanguage@Internal@Windows@@QBEJABV123@PAH@Z
?CloseAppKey@CLanguagesListFactory@Internal@Windows@@CGXPBGPAUHKEY__@@PAX@Z
?Compare@CLanguage@Internal@Windows@@QBEJABV123@PAN@Z
?Compare@CLanguage@Internal@Windows@@QBEJPBGPAN@Z
?Compare@CRegion@Internal@Windows@@QBEJABV123@PAN@Z
?CompareUsingAny@CLanguage@Internal@Windows@@QBEJABV123@PAN@Z
?CompareUsingAny@CLanguage@Internal@Windows@@QBEJPBGPAN@Z
?CreateInstance@CLanguagesList@Internal@Windows@@SGJPBGPAPBV123@@Z
?FindClosestInList@CLanguage@Internal@Windows@@QBEJPBGW4BCP47_COMPARISON_ALGORITHM@23@PAPBGPAN@Z
?GetAbbreviation@CLanguage@Internal@Windows@@QBEJIPAGPAI@Z
?GetApplicationLanguageOverride@CLanguagesListFactory@Internal@Windows@@SGJPBGPAG@Z
?GetApplicationLanguages@CLanguagesListFactory@Internal@Windows@@SGJPBGPAPBVCLanguagesList@23@@Z
?GetApplicationLanguagesAsHTTPAccept@CLanguagesListFactory@Internal@Windows@@SGJPBGPAPAG@Z
?GetApplicationLanguagesAsMUI@CLanguagesListFactory@Internal@Windows@@SGJPBG_NPAPAG@Z
?GetCompositeRegionCode@CRegion@Internal@Windows@@QBEIXZ
?GetCompositeRegionCode@CRegion@Internal@Windows@@SGII@Z
?GetDirectionality@CLanguage@Internal@Windows@@QBEJPAW4BCP47_SCRIPT_DIRECTIONALITY@23@@Z
?GetIso15924Code@CLanguage@Internal@Windows@@QBEJIPAGPAI@Z
?GetIso3166Code@CLanguage@Internal@Windows@@QBEJIPAGPAI@Z
?GetIso639Code@CLanguage@Internal@Windows@@QBEJIPAGPAI@Z
?GetSubtagFields@CLanguage@Internal@Windows@@QBEJW4BCP47_SUBTAG_FLAGS@23@IPAGPAI@Z
?GetSubtagFields@CLanguage@Internal@Windows@@QBEJW4BCP47_SUBTAG_FLAGS@23@PAG@Z
?GetSubtagsMap@CLanguage@Internal@Windows@@QBE?AW4BCP47_SUBTAG_FLAGS@23@XZ
?GetUN_M49Code@CLanguage@Internal@Windows@@QBEJIPAGPAI@Z
?GetUserLanguages@CLanguagesListFactory@Internal@Windows@@SGJPAPBVCLanguagesList@23@@Z
?Initialize@CLanguage@Internal@Windows@@IAEJPBG@Z
?IsPseudoLanguage@CLanguage@Internal@Windows@@QBE_NXZ
?IsValidRegionTag@CRegion@Internal@Windows@@QAE_NXZ
?IsValidRegionTag@CRegion@Internal@Windows@@SG_NPBG@Z
?IsValidTag@CLanguage@Internal@Windows@@QBE_NXZ
?IsValidTag@CLanguage@Internal@Windows@@SG_NPBG@Z
?IsWellFormedTag@CLanguage@Internal@Windows@@QBE_NXZ
?IsWellFormedTag@CLanguage@Internal@Windows@@SG_NPBG@Z
?LanguageListToStringWrapper@CLanguagesListFactory@Internal@Windows@@CGJPBVCLanguagesList@23@W4BCP47_SUBTAG_FLAGS@23@PAIPAPAG@Z
?OpenAppKey@CLanguagesListFactory@Internal@Windows@@CGJPBGPAPAUHKEY__@@PAPAX@Z
?ParseTag@CLanguage@Internal@Windows@@IAE_NPBG@Z
?SetApplicationLanguageOverride@CLanguagesListFactory@Internal@Windows@@SGJPBGPBVCLanguage@23@@Z
?SetApplicationManifestLanguages@CLanguagesListFactory@Internal@Windows@@SGJPBGPBVCLanguagesList@23@@Z
?TryFindFirstInList@CLanguage@Internal@Windows@@QBEJPBGW4BCP47_CLOSENESS_MEASURE@23@PAPBG@Z
?TryFindRegionId@CRegion@Internal@Windows@@CGIPBG@Z
?ValidateTag@CLanguage@Internal@Windows@@IAE_NPBG@Z
?ValidateTagAndInitialize@CLanguage@Internal@Windows@@IAE_NPBG@Z
AppendUserLanguageInputMethods
AppendUserLanguageInternal
AppendUserLanguages
Bcp47BufferFromLcid
Bcp47FromCompactTagInternal
Bcp47FromHkl
Bcp47FromLcid
Bcp47GetAbbreviation
Bcp47GetDirectionality
Bcp47GetDistance
Bcp47GetExtensionSingletons
Bcp47GetExtensionSubstring
Bcp47GetIsoLanguageCode
Bcp47GetIsoScriptCode
Bcp47GetLanguageName
Bcp47GetMuiForm
Bcp47GetNeutralForm
Bcp47GetNlsForm
Bcp47GetSubtagMapInternal
Bcp47GetUnIsoRegionCode
Bcp47IsInstalledAndLicensedAsSystemLanguage
Bcp47IsValid
Bcp47IsWellFormed
Bcp47Normalize
Bcp47RequiresTransientLcid
ClearApplicationLanguageOverride
ClearApplicationManifestLanguages
ClearHttpAcceptLanguageOptOut
ClearUserDisplayLanguageOverride
ClearUserLocaleFromLanguageProfileOptOut
CompactTagFromBcp47Internal
FilterLanguageListOnInstalledMuiLanguages
GetApplicationLanguageOverride
GetApplicationLanguages
GetApplicationLayoutDirection
GetApplicationManifestLanguages
GetAppropriateUserLocaleForUserLanguages
GetAvailableTransientLcidCount
GetHttpAcceptLanguageOptOut
GetInputMethodOverrideForUser
GetPendingUserDisplayLanguage
GetSerializedUserLanguageProfile
GetUserDisplayLanguageOverride
GetUserLanguageInputMethods
GetUserLanguageInputMethodsForUser
GetUserLanguages
GetUserLanguagesForUser
GetUserLocaleFromLanguageProfileOptOut
IsTransientLcid
IsValidBcp47RegionSubtag
LanguageListAsHttpAcceptHeader
LanguageListAsMuiForm
LcidFromBcp47
RemoveInputsForAllLanguagesInternal
RemoveUserLanguageInputMethods
ResolveLanguages
SetApplicationLanguageOverride
SetApplicationManifestLanguages
SetHttpAcceptLanguageOptOut
SetInputMethodOverride
SetUserDisplayLanguageOverride
SetUserLanguageInputMethods
SetUserLanguagesInternal
SetUserLocaleFromLanguageProfileOptOut
SqmLanguageProfileData
Sections
.text Size: 244KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ