OnDemandConnRouteHelper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
OnDemandConnRouteHelper.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
OnDemandConnRouteHelper.dll
Resource
win10v2004-20240426-en
General
-
Target
OnDemandConnRouteHelper.dll
-
Size
27KB
-
MD5
8b623d50c30c128c027602637e6eb7f3
-
SHA1
96af80572e88919d35403d5732423e27186d3021
-
SHA256
0c668522c11fe0e774705c20ac3232c5b917fe9cf8b70a525011ef17af7436f3
-
SHA512
9e4032f57ff85c37e838078f26920e5de417aab1894beeddb2071ec70e66a31324af787ad4bff3bebe926794f8c408785cd33954a64f4482d16cb2b4a63676cb
-
SSDEEP
384:GDGL0kDvR4nsf3mBDUYfrfc43sB0MrN3aBYZ/+MMTK4w3aVP0+WCMUWC3a:QkDZ4nk3mBDjc43wtSK4w3sPqc3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource OnDemandConnRouteHelper.dll
Files
-
OnDemandConnRouteHelper.dll.dll windows:6 windows x86 arch:x86
49a2797a692237f23535744f29efd104
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
??1type_info@@UAE@XZ
_onexit
__dllonexit
??2@YAPAXI@Z
_lock
_initterm
_amsg_exit
_XcptFilter
_vsnwprintf
__CxxFrameHandler3
free
malloc
??_U@YAPAXI@Z
_except_handler4_common
??_V@YAXPAX@Z
_unlock
_wcstoui64
??3@YAXPAX@Z
_ftol2
_CxxThrowException
memset
api-ms-win-core-synch-l1-2-0
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
LeaveCriticalSection
InitializeCriticalSection
Sleep
EnterCriticalSection
DeleteCriticalSection
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-registry-l1-1-0
RegDeleteKeyExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteTreeW
RegNotifyChangeKeyValue
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
FindStringOrdinal
GetModuleHandleExW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
SetThreadpoolWait
api-ms-win-core-com-l1-1-1
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-2
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-2-1
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-errorhandling-l1-1-1
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-appmodel-runtime-l1-1-1
GetCurrentApplicationUserModelId
ntdll
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwGetTraceLoggerHandle
EtwTraceMessage
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
Exports
Exports
OnDemandAddRouteRequest
OnDemandGetRoutingHint
OnDemandRegisterNotification
OnDemandRemoveMatchingRoute
OnDemandRemoveRouteRequest
OnDemandUnRegisterNotification
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ