PortableDeviceStatus.pdb
Static task
static1
Behavioral task
behavioral1
Sample
PortableDeviceStatus.dll
Resource
win10v2004-20240508-en
General
-
Target
PortableDeviceStatus.dll
-
Size
59KB
-
MD5
2540c89bd3cfc03bd5b9b9752452ccba
-
SHA1
680892b8952fdca705b1c0f0ee4007dff7cc8678
-
SHA256
f1038f9c9732982bfd277cd8a0d469b8aebe835879665d46c44dc8cc53bd661c
-
SHA512
92769591bbe5c903ed7bb318b339b881753a1c824b95447da0bf48fb9b6ee731b63af60565beb7ea735b915e68f1b7a9dccac58e32b5197add92c0edbe4a784b
-
SSDEEP
1536:PP3lRzjXWTjJc8FK72qZQsLt3+LXt5aZZ9iFMA1zJGkPfpnmpnPVGyr:lIa8+2qZQsLt3+Ld5aZZ9i9JGkP8nPV/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PortableDeviceStatus.dll
Files
-
PortableDeviceStatus.dll.dll regsvr32 windows:10 windows x86 arch:x86
275cfa2a0c2fbb9e16d713daca8e5047
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_initterm
_except_handler4_common
_errno
realloc
_amsg_exit
_XcptFilter
memcpy_s
_lock
_unlock
__dllonexit
_onexit
_callnewh
memmove_s
_vsnwprintf
wcsncpy_s
malloc
free
_purecall
wcscat_s
wcscpy_s
memcmp
memset
kernel32
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SizeofResource
SetThreadLocale
EnterCriticalSection
GetModuleFileNameW
GetThreadLocale
LeaveCriticalSection
InitializeCriticalSection
MultiByteToWideChar
GetLastError
DisableThreadLibraryCalls
RaiseException
FindResourceExW
LoadResource
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
FreeLibrary
lstrcmpiW
LoadLibraryExW
WaitForSingleObject
GetCurrentThreadId
CloseHandle
OpenThread
GetModuleHandleExW
CompareStringOrdinal
CreateFileW
FormatMessageW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
user32
PostMessageW
DefWindowProcW
IsWindow
GetWindowLongW
LoadStringW
UnregisterClassA
DestroyWindow
RegisterDeviceNotificationW
CreateWindowExW
DispatchMessageW
PeekMessageW
UnregisterDeviceNotification
SetWindowLongW
PostQuitMessage
CharNextW
UnregisterClassW
RegisterClassExW
GetMessageW
ole32
GetRunningObjectTable
CreateItemMoniker
CoInitializeEx
CoUninitialize
PropVariantCopy
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
PropVariantClear
oleaut32
VarUI4FromStr
shlwapi
ord16
ord354
advapi32
RegCreateKeyExW
TraceMessage
GetTraceLoggerHandle
RegEnumKeyExW
GetTraceEnableFlags
RegSetValueExW
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
RegOpenKeyExW
EventUnregister
RegDeleteValueW
EventRegister
EventWriteTransfer
RegQueryInfoKeyW
RegCloseKey
RegGetValueW
propsys
PSGetNameFromPropertyKey
PropVariantCompareEx
InitPropVariantFromFileTime
PSCreateMemoryPropertyStore
InitPropVariantFromCLSID
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ