PortableDeviceConnectApi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
PortableDeviceConnectApi.dll
Resource
win10v2004-20240226-en
General
-
Target
PortableDeviceConnectApi.dll
-
Size
55KB
-
MD5
4c1cb0051b65d84aab01ebd65554a92d
-
SHA1
e86f3d3153317a4bad54fa3d3a71f834e0f09a72
-
SHA256
888b30ea9b31247d86a7473de84b53504378188064bf4df335deed5dd9f82352
-
SHA512
0b0fea6b1174c477c38bd6901ded7f0be451eb4aebc0aa201ef62341dd64cb7c9f44df3b5e212f10f1277a0c9c0a82755534eb3e9c5f32aa134294b087cc3fb0
-
SSDEEP
1536:de6hrs3UfacbTwBDVOWUj6NcW4QJsAniP:zhrbb+OWUj6t4QCAi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PortableDeviceConnectApi.dll
Files
-
PortableDeviceConnectApi.dll.dll regsvr32 windows:10 windows x86 arch:x86
678bd0dba642364c21974e403610ae54
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_lock
realloc
_unlock
__dllonexit
_except_handler4_common
__CxxFrameHandler3
_onexit
_initterm
_amsg_exit
_XcptFilter
_callnewh
calloc
memmove_s
wcscat_s
wcscpy_s
wcsncpy_s
malloc
free
_purecall
memcpy_s
_errno
_CxxThrowException
memset
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleFileNameW
FindResourceExW
LoadResource
GetProcAddress
SizeofResource
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
LeaveCriticalSection
SetEvent
DeleteCriticalSection
CreateEventW
InitializeCriticalSection
EnterCriticalSection
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
CancelIoEx
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapSize
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
user32
UnregisterClassA
kernel32
lstrcmpiW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ