RADCUI.pdb
Static task
static1
Behavioral task
behavioral1
Sample
RADCUI.dll
Resource
win10v2004-20240426-en
General
-
Target
RADCUI.dll
-
Size
329KB
-
MD5
9707d6fca0459f05552fa49cc1d0d873
-
SHA1
a86fccf4f6f8618dc1cd54606410501faa357504
-
SHA256
4679acec103446fa706eced2800fa5b39184038e5d26585158a1ec2b28740126
-
SHA512
8607b26c4ffd13018b1ae60eda5f04e5d35ef0148735bb36550a53f25365d183bdb54eef6da1d9533d83dcb2b8a8f8437d40d669a739647ba9bd8c958210e48b
-
SSDEEP
6144:P6PIhsTp4tuk0+jxq9V0/W8qdaOWrUbr3zEJYscqq:K+uKkLmW8qdakrO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RADCUI.dll
Files
-
RADCUI.dll.dll windows:10 windows x86 arch:x86
a8396a85d587d5e6d11c99d8900e14bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_wcsicmp
wcstombs
_vsnprintf_s
memcpy
memcmp
_ftol2_sse
wcsncmp
??3@YAXPAX@Z
_vsnwprintf
bsearch
_wcsnicmp
memmove
realloc
_errno
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QAE@XZ
calloc
_purecall
?what@exception@@UBEPBDXZ
memmove_s
iswspace
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
memcpy_s
free
malloc
wcsncpy_s
??_V@YAXPAX@Z
__CxxFrameHandler3
memset
ole32
CoCreateInstance
CoGetMalloc
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsDeleteString
advapi32
UnregisterTraceGuids
RegNotifyChangeKeyValue
RegQueryValueExW
EventActivityIdControl
EventWriteTransfer
RegGetValueW
EventUnregister
EventRegister
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyW
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
ntdll
EtwEventRegister
EtwEventUnregister
WinSqmAddToStream
EtwLogTraceEvent
EtwEventSetInformation
EtwEventWriteTransfer
kernel32
ResetEvent
ReleaseSemaphore
OpenThread
DebugBreak
TlsFree
TlsGetValue
CreateSemaphoreW
SwitchToThread
CreateThread
GetSystemInfo
TlsAlloc
OutputDebugStringW
FreeLibraryAndExitThread
WaitForSingleObject
DeactivateActCtx
ActivateActCtx
GetModuleHandleExW
GetModuleFileNameA
CreateEventW
LocalAlloc
TlsSetValue
CloseHandle
SetEvent
ReleaseActCtx
WaitForMultipleObjects
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
CancelWaitableTimer
GetAtomNameW
CreateMutexW
ReleaseMutex
FormatMessageW
IsDebuggerPresent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SetLastError
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
InitializeCriticalSectionEx
OpenSemaphoreW
CreateThreadpoolTimer
CreateWaitableTimerW
SetWaitableTimer
CreateMutexExW
CreateSemaphoreExW
GetVersionExW
CompareStringOrdinal
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDateFormatW
GetTimeFormatW
TerminateThread
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
LocalFree
CompareStringW
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
DisableThreadLibraryCalls
GetModuleHandleExA
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
CreateActCtxW
InitOnceBeginInitialize
InitOnceComplete
SearchPathW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
CreateFileW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
oleaut32
SysAllocString
VariantClear
VarUI4FromStr
SysFreeString
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetDim
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
SafeArrayGetVartype
user32
SetCursor
LoadCursorW
DefWindowProcW
CreateWindowExW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
PostMessageW
DestroyWindow
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
PostThreadMessageW
UnregisterClassA
CharNextW
LoadStringW
DestroyIcon
GetWindowLongW
GetMessageW
TranslateMessage
GetFocus
dui70
?Create@XResourceProvider@DirectUI@@SGJPAUHINSTANCE__@@PBG11PAPAV12@@Z
?QueryInterface@XProvider@DirectUI@@UAGJABU_GUID@@PAPAX@Z
??1XProvider@DirectUI@@UAE@XZ
??0XProvider@DirectUI@@QAE@XZ
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
??1Element@DirectUI@@UAE@XZ
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?Initialize@XProvider@DirectUI@@QAEJPAVElement@2@PAVIXProviderCP@2@@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z
?GetStringNull@Value@DirectUI@@SGPAV12@XZ
?SetActive@Element@DirectUI@@QAEJH@Z
?GetUnset@Value@DirectUI@@SGPAV12@XZ
?GetAtomZero@Value@DirectUI@@SGPAV12@XZ
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?GetRoot@XProvider@DirectUI@@IAEPAVElement@2@XZ
?CreateDUI@XProvider@DirectUI@@UAGJPAVIXElementCP@2@PAPAUHWND__@@@Z
?SetHandleEnterKey@XProvider@DirectUI@@IAEX_N@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?AddRef@XProvider@DirectUI@@UAGKXZ
?SetParameter@XProvider@DirectUI@@UAGJABU_GUID@@PAX@Z
?GetDesiredSize@XProvider@DirectUI@@UAGJHHPAUtagSIZE@@@Z
?IsDescendent@XProvider@DirectUI@@UAGJPAVElement@2@PA_N@Z
?SetFocus@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?Navigate@XProvider@DirectUI@@UAGJHPA_N@Z
?CanSetFocus@XProvider@DirectUI@@UAGJPA_N@Z
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UAGHGH@Z
?GetHostedElementID@XProvider@DirectUI@@UAGJPAG@Z
?ForceThemeChange@XProvider@DirectUI@@UAGJIJ@Z
?ClickDefaultButton@XProvider@DirectUI@@UAGHXZ
?SetRegisteredDefaultButton@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UAGJ_N@Z
?CreateXBaby@XProvider@DirectUI@@UAEJPAVIXElementCP@2@PAUHWND__@@PAVElement@2@PAKPAPAUIXBaby@2@@Z
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
InitProcessPriv
InitThread
?SetDefaultButtonTracking@XProvider@DirectUI@@UAGJ_N@Z
?GetCheckedState@TouchCheckBox@DirectUI@@QAE?AW4CheckedStateFlags@2@XZ
?SetCheckedState@TouchCheckBox@DirectUI@@QAEJW4CheckedStateFlags@2@@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
??1CritSecLock@DirectUI@@QAE@XZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
UnInitProcessPriv
UnInitThread
??0Element@DirectUI@@QAE@XZ
??0ClassInfoBase@DirectUI@@QAE@XZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?SetValue@Element@DirectUI@@QAEJPBUPropertyInfo@2@HPAVValue@2@@Z
?CreateString@Value@DirectUI@@SGPAV12@PBGPAUHINSTANCE__@@@Z
?Register@Element@DirectUI@@SGJXZ
?Release@Value@DirectUI@@QAEXXZ
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?SetReadOnly@TouchEditBase@DirectUI@@QAEJ_N@Z
?Enter@TouchEditBase@DirectUI@@SG?AVUID@@XZ
?Destroy@Element@DirectUI@@QAEJ_N@Z
?PasteText@TouchEdit2@DirectUI@@QAEJPBG@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
StrToID
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?Click@TouchButton@DirectUI@@SG?AVUID@@XZ
RegisterPVLBehaviorFactory
?GetClassInfoPtr@TouchCheckBox@DirectUI@@SGPAUIClassInfo@2@XZ
?SetContentAlign@Element@DirectUI@@QAEJH@Z
?Click@Button@DirectUI@@SG?AVUID@@XZ
?Add@Element@DirectUI@@QAEJPAV12@P6AHPBX1@Z@Z
?EndDefer@Element@DirectUI@@QAEXK@Z
?SetClass@Element@DirectUI@@QAEJPBG@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?DestroyAll@Element@DirectUI@@QAEJ_N@Z
propsys
PSPropertyBag_ReadInt
PSPropertyBag_ReadType
PSPropertyBag_ReadStr
PSPropertyBag_WriteUnknown
tsworkspace
ord1
ord2
windows.ui.immersive
ord100
ord101
api-ms-win-core-path-l1-1-0
PathAllocCombine
shlwapi
ord158
ord219
ord618
ord176
ord514
ord278
ord172
ord256
PathFileExistsW
ord174
ord156
SHStrDupW
ord204
ord24
ord199
shell32
SHGetKnownFolderPath
ShellExecuteW
SHParseDisplayName
ord155
ord18
ord25
SHBindToObject
ShellExecuteExW
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
wininet
InternetCanonicalizeUrlW
InternetCrackUrlW
Exports
Exports
DUIRemoveSubscriptionDialogModal
DUISubscribeWizardModal
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 223KB - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ