InstallService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
InstallService.dll
Resource
win10v2004-20240426-en
General
-
Target
InstallService.dll
-
Size
1.8MB
-
MD5
149ceea16860def424b2635184107bfe
-
SHA1
95571d54c9576b19a389e3248b7c8e1cab7d7cab
-
SHA256
30c0165cdb06d69dc877b31f88e5a723dfa22ff45f93d71a2b9c4c4bdc0b43a6
-
SHA512
bb4a6cbf711eaaa985441d043ab409a363feb39760e58a4c4cf12fc8b21d20f728e56d198a3ae04d925ad4c2851d52c4618e1ffc5696670e3d376b31979e132d
-
SSDEEP
49152:AiNTyzR9k78a7qqUJArREkSV0KPcpRKCAE/IMWIK+bSHI3xvz+JaW9NEqaLZoPbM:/TyzR69gsREkSgKCAEUIIHIBL+JaW9NB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource InstallService.dll
Files
-
InstallService.dll.dll windows:10 windows x86 arch:x86
4ef9dd17b2dd2bd94216badd5e2ef3b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__localtime64_s
_o__lock_file
_o__mktime64
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__ui64tow_s
_o__unlock_file
_o__wcsicmp
_o__wcstoui64
memmove
_o__wtoi
_o__wtoi64
_o_ceil
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_isalnum
_o_iswspace
_o_malloc
_o_mbstowcs
_o_mbstowcs_s
_o_rand
_o_realloc
_o_setvbuf
_o_srand
_o_strncpy_s
_o_strtol
_o_terminate
_o_toupper
_o_ungetc
_o_ungetwc
_o_wcscat_s
_o_wcscpy_s
_o_wcsftime
_o_wcsncpy_s
_o_wcstok_s
_o_wcstol
_o_wcstombs
_o_wcstombs_s
_o_wcstoul
_except_handler4_common
_CxxThrowException
_o__fseeki64
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o____lc_codepage_func
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
_o__errno
__std_type_info_compare
wcsstr
strrchr
wcschr
strchr
api-ms-win-crt-string-l1-1-0
wcsnlen
memset
wcsncpy
umpdc
Pdcv2ActivationClientActivate
Pdcv2ActivationClientDeactivate
ntdll
RtlWow64IsWowGuestMachineSupported
RtlSetBit
RtlClearAllBits
RtlInitializeBitMap
RtlConvertDeviceFamilyInfoToString
RtlGetDeviceFamilyInfoEnum
RtlIsMultiSessionSku
NtQueryWnfStateData
RtlIsMultiUsersInSessionSku
api-ms-win-appmodel-runtime-internal-l1-1-1
GetPackageFullNameFromToken
api-ms-win-core-libraryloader-l1-2-0
LoadStringW
FindStringOrdinal
GetProcAddress
FreeLibrary
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-1-0
SetEvent
InitializeSRWLock
CreateEventW
AcquireSRWLockShared
ReleaseSRWLockShared
CreateEventExW
ReleaseSRWLockExclusive
DeleteCriticalSection
EnterCriticalSection
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
CreateMutexW
ResetEvent
LeaveCriticalSection
OpenSemaphoreW
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
CreateMutexExW
AcquireSRWLockExclusive
InitializeCriticalSection
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentThread
SetThreadToken
TerminateProcess
GetCurrentThreadId
OpenProcessToken
GetCurrentProcess
ProcessIdToSessionId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
LCMapStringEx
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventRegister
EventActivityIdControl
EventSetInformation
EventWriteTransfer
EventProviderEnabled
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
WakeByAddressAll
InitOnceBeginInitialize
Sleep
InitOnceComplete
WaitOnAddress
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
GlobalFree
api-ms-win-service-core-l1-1-0
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetTickCount64
GetVersionExA
GetSystemTimeAsFileTime
GetSystemTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
InterlockedFlushSList
api-ms-win-core-registry-l1-1-0
RegOpenCurrentUser
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegGetValueW
RegCloseKey
RegEnumValueW
RegOpenKeyExW
rpcrt4
RpcAsyncCompleteCall
RpcAsyncCancelCall
UuidCreate
NdrAsyncClientCall
I_RpcExceptionFilter
I_RpcBindingInqLocalClientPID
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcAsyncInitializeHandle
RpcStringFreeW
RpcBindingFree
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse
api-ms-win-security-capability-l1-1-0
CapabilityCheck
oleaut32
SysAllocString
SysStringLen
VarBstrCmp
VariantClear
VariantTimeToSystemTime
SysFreeString
SysStringByteLen
SysAllocStringByteLen
VariantInit
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolWork
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
SubmitThreadpoolWork
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
api-ms-win-core-registry-l2-1-0
RegCreateKeyW
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
RegSetKeyValueW
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-file-l1-1-0
GetFileAttributesW
SetFileAttributesW
CreateDirectoryW
DeleteFileW
ReadFile
GetFileAttributesExW
CreateFileW
CompareFileTime
FindFirstFileExW
GetFinalPathNameByHandleW
SetFileInformationByHandle
FindFirstFileW
GetTempFileNameW
GetFileSizeEx
WriteFile
FindClose
FindNextFileW
winhttp
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpOpen
WinHttpConnect
WinHttpCreateUrl
WinHttpGetProxyForUrl
WinHttpSetOption
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
api-ms-win-core-url-l1-1-0
UrlEscapeW
api-ms-win-shell-namespace-l1-1-0
SHGetIDListFromObject
api-ms-win-core-path-l1-1-0
PathCchRemoveExtension
PathCchAddExtension
PathCchRemoveFileSpec
PathCchStripToRoot
PathCchCombine
PathCchAppend
api-ms-win-shell-shdirectory-l1-1-0
ord290
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
PathFileExistsW
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
FlushViewOfFile
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
GetEnvironmentVariableW
api-ms-win-core-file-l1-2-0
GetVolumeNameForVolumeMountPointW
GetTempPathW
userenv
ExpandEnvironmentStringsForUserW
api-ms-win-core-kernel32-legacy-l1-1-1
PowerClearRequest
PowerSetRequest
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-security-cryptoapi-l1-1-0
CryptAcquireContextW
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptGetHashParam
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
combase
ord67
ord68
ord66
ord69
wldp
WldpIsAppApprovedByPolicy
msvcp_win
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?_Winerror_message@std@@YAKKPADK@Z
?_Xinvalid_argument@std@@YAXPBD@Z
_Thrd_id
?uncaught_exceptions@std@@YAHXZ
?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
?_Incref@facet@locale@std@@UAEXXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?id@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXXZ
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?_Getcat@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
_Cnd_wait
?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBG4@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
_Cnd_register_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
_Cnd_broadcast
?_Xbad_alloc@std@@YAXXZ
?__ExceptionPtrDestroy@@YAXPAX@Z
_Mtx_destroy_in_situ
_Cnd_destroy_in_situ
_Cnd_unregister_at_thread_exit
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
_Xtime_get_ticks
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z
?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z
?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
_Mtx_init_in_situ
_Cnd_init_in_situ
?_XGetLastError@std@@YAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
??0task_continuation_context@Concurrency@@AAE@XZ
?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?imbue@?$basic_ios@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Xbad_function_call@std@@YAXXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
_Mtx_lock
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
_Mtx_unlock
api-ms-win-crt-time-l1-1-0
_time32
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
mpr
WNetGetConnectionW
api-ms-win-service-management-l1-1-0
OpenSCManagerW
StartServiceW
OpenServiceW
CloseServiceHandle
api-ms-win-ntuser-sysparams-l1-1-0
GetMonitorInfoW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
ServiceMain
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 548B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ