ComposableShellProxyStub.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ComposableShellProxyStub.dll
Resource
win10v2004-20240426-en
General
-
Target
ComposableShellProxyStub.dll
-
Size
148KB
-
MD5
c045d55658b6c47be815d211d5930123
-
SHA1
ed9c2589e376d8c8f5c9ced6e75aa54afc914e6c
-
SHA256
8d3dd864f8533bff4589749e0a1bf4eb5a732836578f915aee0a61636b54432a
-
SHA512
6ee74fd3c6cc88b66203e39c7782eee0f81a0205031d04b955ac64eb0e11b668133eb37c8ff1ea27b942fa6cac0642097b888ae4f5daa43efa81cd6b098e3000
-
SSDEEP
3072:eI/GRfdQUWEkXrOlb8CAnLtirjdsm3NKbO4Gj4A4fMhLkoXK0hHdN4unmkVoWNuI:IXFCY5cs3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ComposableShellProxyStub.dll
Files
-
ComposableShellProxyStub.dll.dll windows:10 windows x86 arch:x86
269e478e31f08bb314abafaa042891e2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
memcmp
_o__seh_filter_dll
_except_handler4_common
_o___std_type_info_destroy_list
rpcrt4
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrStubCall2
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_CountRefs
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-com-midlproxystub-l1-1-0
NdrProxyForwardingFunction3
CStdStubBuffer2_Connect
ObjectStublessClient8
ObjectStublessClient6
NdrProxyForwardingFunction5
NdrProxyForwardingFunction4
ObjectStublessClient11
ObjectStublessClient5
CStdStubBuffer2_QueryInterface
ObjectStublessClient4
ObjectStublessClient7
CStdStubBuffer2_Disconnect
ObjectStublessClient3
ObjectStublessClient12
ObjectStublessClient14
CStdStubBuffer2_CountRefs
ObjectStublessClient15
ObjectStublessClient13
ObjectStublessClient17
ObjectStublessClient10
ObjectStublessClient16
ObjectStublessClient18
ObjectStublessClient20
ObjectStublessClient19
ObjectStublessClient9
ObjectStublessClient21
api-ms-win-core-marshal-l1-1-0
HWND_UserFree
HWND_UserMarshal
HWND_UserUnmarshal
HWND_UserSize
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
DllCanUnloadNow
DllGetClassObject
GetProxyDllInfo
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ