Query.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Query.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Query.dll
Resource
win10v2004-20240508-en
General
-
Target
Query.dll
-
Size
65KB
-
MD5
2483c838e8ddfab000b9dfee7e462fd5
-
SHA1
50e80f9e0e8220c9158cef389743636024e37617
-
SHA256
65db4ae73597de4873646049fbe0dcb5d6bd6192ce60aed68acb5e271b2a7fa5
-
SHA512
88ec0bc85a970588a27bcb2df4b8efe2aaa2a12db4bb12c84a4e3266fa59ad9baccc9ade6903001d0528b80f7b8ec21c843bdc31f85b4d31340324f55ddb4a02
-
SSDEEP
1536:fl0zLJGnrCaNA4ykQyGMoo43gYW91jVlQ+Y8KH8I:9nnrCkAEVnGLyjVlQ+Y8KcI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Query.dll
Files
-
Query.dll.dll regsvr32 windows:6 windows x86 arch:x86
2145ed6ae5e12dcd3c0b35284f98a52c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_purecall
_CxxThrowException
__CxxFrameHandler3
memcmp
_except_handler4_common
??1type_info@@UAE@XZ
??3@YAXPAX@Z
_onexit
__dllonexit
_unlock
_lock
_initterm
free
_amsg_exit
_XcptFilter
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
malloc
_wcsicmp
memcpy
ntdll
RtlQueryRegistryValues
RtlFreeHeap
RtlDosPathNameToNtPathName_U
NtCreateFile
NtFsControlFile
_vsnwprintf
wcscpy_s
wcsrchr
shlwapi
ord219
PathFindExtensionW
ole32
CLSIDFromString
StringFromGUID2
CoTaskMemAlloc
CoCreateInstance
kernel32
FlushFileBuffers
GetOverlappedResult
ReadFile
WriteFile
SetLastError
FlushViewOfFile
SetEndOfFile
UnmapViewOfFile
ResetEvent
CreateFileMappingW
CreateEventW
CloseHandle
GetLocaleInfoW
MapViewOfFile
SetFilePointer
GetFileSize
GetDiskFreeSpaceExW
WaitForSingleObjectEx
QueryPerformanceCounter
HeapAlloc
GetCurrentProcess
GetProcessHeap
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FreeLibrary
GetVersionExW
GetProcAddress
LoadLibraryA
GetLastError
HeapFree
DisableThreadLibraryCalls
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
LCMapStringW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
GetStringTypeW
GetCPInfo
GetSystemDefaultLCID
MultiByteToWideChar
IsDBCSLeadByteEx
advapi32
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
Exports
Exports
BeginCacheTransaction
BindIFilterFromStorage
BindIFilterFromStream
CIBuildQueryNode
CIBuildQueryTree
CICreateCommand
CIGetGlobalPropertyList
CIMakeICommand
CIRestrictionToFullTree
CIRevertToSelf
CIShutdown
CIState
CITextToFullTree
CITextToFullTreeEx
CITextToSelectTree
CITextToSelectTreeEx
CiCreateSecurityDescriptor
CiSvcMain
CollectCIISAPIPerformanceData
CollectCIPerformanceData
CollectFILTERPerformanceData
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DoneCIISAPIPerformanceData
DoneCIPerformanceData
DoneFILTERPerformanceData
EndCacheTransaction
FsCiShutdown
InitializeCIISAPIPerformanceData
InitializeCIPerformanceData
InitializeFILTERPerformanceData
InternalBindIFilterFromDocCLSID
InternalBindIFilterFromFileName
InternalBindIFilterFromStorage
InternalBindIFilterFromStream
LoadBinaryFilter
LoadIFilter
LoadIFilterEx
LoadTextFilter
LocateCatalogs
LocateCatalogsA
LocateCatalogsW
SetCatalogState
SetupCache
SetupCacheEx
SvcEntry_CiSvc
Sections
.text Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ