ShareHost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ShareHost.dll
Resource
win10v2004-20240426-en
General
-
Target
ShareHost.dll
-
Size
858KB
-
MD5
e06b2fd7b2d9fcc4b66e30e1a32eaee6
-
SHA1
74b30c415cf1d6b83252d70b579fa204b4f61365
-
SHA256
e46f589d3bd9b95c8284fa555ec9bc7f2bab14e8578cbb893383a1bc09bfcdbc
-
SHA512
78799e7954af1487f34285e281de770d8d3c0b16abd5326746d0538d05488efba258b3805c33f0cffaff0cc359a24ecd80a10cbf5d0421bc17dd3b13c9ff1544
-
SSDEEP
24576:P2bTNZmgQyCP1jnT2jOmp1y/AB7BJIrAa6tTv9KN:4TVGdjajOWlFtTwN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ShareHost.dll
Files
-
ShareHost.dll.dll windows:10 windows x86 arch:x86
0fc009c78c5169199f37268681d1c91f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
strncpy_s
__ExceptionPtrCopy
__ExceptionPtrToBool
__ExceptionPtrDestroy
_purecall
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
__ExceptionPtrCurrentException
__ExceptionPtrRethrow
_set_errno
_errno
_get_errno
strtol
strchr
strrchr
memmove_s
sprintf_s
??_V@YAXPAX@Z
_wcsicmp
realloc
wcscpy_s
??0exception@@QAE@ABQBD@Z
_vsnprintf
wcscspn
wcsrchr
wcschr
_wtoi
_ui64tow_s
wcsnlen
??0bad_cast@@QAE@PBD@Z
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
toupper
_callnewh
memcpy
memmove
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__ExceptionPtrAssign
__ExceptionPtrCreate
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
__CxxFrameHandler3
_XcptFilter
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
memcmp
memset
windows.storage
STORAGE_CStorageItem_GetValidatedStorageItemObject
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller
STORAGE_CreateStorageItemFromPath_FullTrustCaller
SHGetKnownFolderPath
SHCreateItemFromParsingName
api-ms-win-appmodel-runtime-internal-l1-1-4
GetExtensionProperty
api-ms-win-appmodel-runtime-internal-l1-1-2
GetEffectivePackageStatusForUser
api-ms-win-shlwapi-ie-l1-1-0
SHRegGetValueFromHKCUHKLM
IUnknown_QueryService
api-ms-win-core-libraryloader-l1-2-0
FindResourceExW
GetModuleHandleW
DisableThreadLibraryCalls
LoadResource
GetModuleFileNameA
LockResource
FreeLibrary
GetProcAddress
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
InitOnceBeginInitialize
WakeAllConditionVariable
Sleep
SleepConditionVariableSRW
InitOnceComplete
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
CreateEventExW
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
EnterCriticalSection
CreateSemaphoreExW
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
SetEvent
CreateEventW
InitializeCriticalSectionEx
LeaveCriticalSection
InitializeSRWLock
ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsIsStringEmpty
WindowsDeleteString
WindowsCreateString
WindowsCompareStringOrdinal
WindowsConcatString
WindowsStringHasEmbeddedNull
WindowsDuplicateString
WindowsGetStringLen
HSTRING_UserMarshal
WindowsSubstringWithSpecifiedLength
HSTRING_UserSize
WindowsGetStringRawBuffer
WindowsCreateStringReference
HSTRING_UserFree
HSTRING_UserUnmarshal
api-ms-win-eventing-provider-l1-1-0
EventProviderEnabled
EventActivityIdControl
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
SetThreadToken
OpenThreadToken
GetCurrentThread
GetThreadId
OpenProcessToken
GetCurrentProcess
GetProcessId
GetCurrentThreadId
GetCurrentProcessId
GetExitCodeThread
CreateThread
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoOriginateError
RoTransformError
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetSystemTime
GetTickCount64
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW
RegQueryInfoKeyW
RegOpenKeyExW
api-ms-win-core-com-l1-1-0
CoMarshalInterface
CoReleaseMarshalData
CoUninitialize
CoGetCallContext
CreateStreamOnHGlobal
CoGetStdMarshalEx
CoInitializeEx
CoTaskMemRealloc
CoUnmarshalInterface
CoGetMalloc
CoGetInterfaceAndReleaseStream
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoWaitForMultipleHandles
CoCreateGuid
StringFromGUID2
CoTaskMemAlloc
api-ms-win-shcore-stream-l1-1-0
IStream_Read
IStream_Write
IStream_Reset
SHCreateMemStream
IStream_Size
rpcrt4
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerRelease
UuidCreate
CStdStubBuffer_Connect
I_RpcBindingInqLocalClientPID
api-ms-win-core-shlwapi-legacy-l1-1-0
PathIsFileSpecW
PathFindFileNameW
PathFindExtensionW
coremessaging
MsgBufferShare
CoreUICreate
MsgRelease
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolWait
CloseThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolTimer
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
api-ms-win-core-string-l2-1-1
SHLoadIndirectString
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-winrt-propertysetprivate-l1-1-1
RoCreatePropertySetSerializer
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-shcore-thread-l1-1-0
SHGetThreadRef
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-kernel32-legacy-l1-1-1
PowerCreateRequest
PowerSetRequest
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
ntdll
RtlFreeHeap
NtQueryInformationToken
RtlInitUnicodeString
RtlAllocateHeap
EtwTraceMessage
RtlCompareUnicodeString
NtQueryWnfStateData
RtlGetAppContainerSidType
RtlQueryPackageClaims
RtlGetDeviceFamilyInfoEnum
RtlNtStatusToDosErrorNoTeb
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrCmpIW
StrCmpLogicalW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
api-ms-win-appmodel-runtime-l1-1-0
GetPackageFamilyName
PackageFamilyNameFromFullName
GetPackagesByPackageFamily
api-ms-win-appmodel-runtime-l1-1-1
GetApplicationUserModelIdFromToken
ParseApplicationUserModelId
GetPackageFamilyNameFromToken
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-atoms-l1-1-0
GlobalGetAtomNameW
api-ms-win-appmodel-unlock-l1-1-0
IsDeveloperModeEnabled
api-ms-win-shlwapi-winrt-storage-l1-1-1
AssocCreate
api-ms-win-storage-exports-external-l1-1-0
STORAGE_CStorageItem_GetValidatedStorageItem
api-ms-win-appmodel-state-l1-2-0
OpenStateExplicit
CloseState
GetSystemAppDataKey
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
combase
ord154
coreuicomponents
CoreUIFactoryCreate
msvcp110_win
?_Winerror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
??0id@locale@std@@QAE@I@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_BADOFF@std@@3_JB
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Add_vtordisp1@?$basic_ios@GU?$char_traits@G@std@@@std@@UAEXXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Add_vtordisp2@?$basic_ostream@GU?$char_traits@G@std@@@std@@UAEXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?_Xbad_alloc@std@@YAXXZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@GDH@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??1?$codecvt@GDH@std@@MAE@XZ
?_Getcat@?$codecvt@GDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$codecvt@GDH@std@@QAE@I@Z
?in@?$codecvt@GDH@std@@QBEHAAHPBD1AAPBDPAG3AAPAG@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
??1facet@locale@std@@MAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?_Add_vtordisp1@?$basic_istream@GU?$char_traits@G@std@@@std@@UAEXXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
??Bios_base@std@@QBEPAXXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Wcscoll
_Wcsxfrm
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@G@std@@2V0locale@2@A
?id@?$collate@G@std@@2V0locale@2@A
?c_str@?$_Yarn@D@std@@QBEPBDXZ
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?tolower@?$ctype@G@std@@QBEGG@Z
?is@?$ctype@G@std@@QBE_NFG@Z
??0facet@locale@std@@IAE@I@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?good@ios_base@std@@QBE_NXZ
?exceptions@ios_base@std@@QAEXH@Z
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient5
ObjectStublessClient4
ObjectStublessClient3
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
ResolveConnectedSharePlatformToken
Sections
.text Size: 783KB - Virtual size: 782KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ