TaskSchdPS[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

TaskSchdPS.dll
Size

34KB
MD5

e002c881fbade296859a1946e4fde771
SHA1

68fa552ca375882edecf716c3b2c706b6cca6073
SHA256

6c85ecccc35158baa96d92063637d3738fca964b637a79aba2e749549b14f4ab
SHA512

f2487088409aa1a13396ea52a0488d1876d2fa4bd686fd08460ace697c95638b618db0770bbb09001b64d95bec58e0941340f40f1dbdfe91bddfcd1e6ecf4d18
SSDEEP

768:x6Be7VgWtd7hZcPCHJDEnZUnDsJaJfxkSU2Rk7Fua:B73cPCHJ8JaJfxkSU2a7Ma

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TaskSchdPS.dll

Files

TaskSchdPS.dll
.dll regsvr32 windows:6 windows x86 arch:x86

5d458fcac4b1fdb7bf10ed7a8876e939

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

TaskSchdPS.pdb

Imports

api-ms-win-core-crt-l2-1-0

_initterm_e
_initterm

oleaut32

BSTR_UserUnmarshal
BSTR_UserFree
VARIANT_UserFree
BSTR_UserMarshal
VARIANT_UserMarshal
BSTR_UserSize
VARIANT_UserUnmarshal
VARIANT_UserSize

rpcrt4

NdrOleFree
IUnknown_QueryInterface_Proxy
NdrOleAllocate
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
NdrStubCall2
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
NdrStubForwardingFunction
NdrDllUnregisterProxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer2_Release

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter

combase

ord3
ord7
ord14
ord16
ord17
ord10
ord12
ord5
ord9
ord2
ord4
ord8
ord15
ord35
ord33
ord22
ord32
ord23
ord20
ord21
ord34
ord19
ord18
ord11
ord13
ord6

api-ms-win-core-crt-l1-1-0

_except_handler4_common
memcmp

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 558B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d458fcac4b1fdb7bf10ed7a8876e939

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-crt-l2-1-0

oleaut32

rpcrt4

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

combase

api-ms-win-core-crt-l1-1-0

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 11KB

.orpc Size: 1024B - Virtual size: 558B

.data Size: 512B - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 14KB - Virtual size: 14KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 12KB - Virtual size: 11KB

.orpc
Size: 1024B - Virtual size: 558B

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 14KB - Virtual size: 14KB

.reloc
Size: 2KB - Virtual size: 2KB