bitsprx6.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bitsprx6.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bitsprx6.dll
Resource
win10v2004-20240508-en
General
-
Target
bitsprx6.dll
-
Size
14KB
-
MD5
e3523d8044c44940382a5caf9bc12147
-
SHA1
5b94eb630bd2007b9de196d9cdda9e51c041e071
-
SHA256
db4754957484375cb24fa0f6ba30c93aee47bbb387a70cc3824885b95d6d6b9a
-
SHA512
0d221a61ecd12f178779916c4b36a14257074d4c0ad41db669ed9bf221bbf30bc333793fb374d344b947d3b96e3d5f16daddb4191f489a3f8f12c69282653e0d
-
SSDEEP
192:5/K0j3vqcEP8NmLyp2AxkXr9IcfA8GMkSnBZ+sWPpW:lK0DqDkU9okpIIGM9BfWPpW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bitsprx6.dll
Files
-
bitsprx6.dll.dll regsvr32 windows:6 windows x64 arch:x64
f21c193d1be3f39f29b13816a1f82ac5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memcmp
rpcrt4
NdrDllGetClassObject
NdrDllUnregisterProxy
CStdStubBuffer_AddRef
NdrCStdStubBuffer2_Release
NdrOleFree
NdrStubForwardingFunction
NdrOleAllocate
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
NdrStubCall3
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
IUnknown_QueryInterface_Proxy
combase
ord36
ord6
ord32
ord37
ord5
ord2
ord4
ord39
ord40
ord34
ord38
ord11
ord33
ord35
ord3
kernel32
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
Sleep
QueryPerformanceCounter
GetCurrentProcessId
DisableThreadLibraryCalls
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 142B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ