dfshim.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dfshim.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
dfshim.dll
Resource
win10v2004-20240508-en
General
-
Target
dfshim.dll
-
Size
1.5MB
-
MD5
8bfe1b7da4a67d252f13ad3a78fa0f4e
-
SHA1
7532803a729e0e5d5d999b633987eff199865dd1
-
SHA256
f71fb9363c66b54a539934626217b0401103503d4b112ced9715f9adb9b49742
-
SHA512
8523010d94325353d8926e1a90c29cc04c8fd59a6dff3d5d5d6784d3a9cf588e107a041d9eec21b5fed13b4463263e124774e2033e1d59f3f65dd41b365cca93
-
SSDEEP
12288:0LqN5vwn5187oqqjwMosF917IUy+wxC7COxEUx5YloMTs5pWhIJoC:CqDvujwMosF917By+weuEnWyo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dfshim.dll
Files
-
dfshim.dll.dll windows:6 windows x64 arch:x64
505dcdcde3d0140bc490f5152375b77d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
HeapReAlloc
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapSize
SetThreadStackGuarantee
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
GetStartupInfoW
DeleteCriticalSection
GetFileType
GetStdHandle
HeapSetInformation
HeapDestroy
HeapCreate
GetModuleHandleExW
ExitProcess
GetCurrentThreadId
FlsFree
FlsGetValue
FlsAlloc
DecodePointer
EncodePointer
GetVersionExW
FlsSetValue
GetCommandLineA
GetVersion
LoadLibraryA
GetEnvironmentVariableA
GetVersionExA
GetFileInformationByHandle
ReadFile
SetEndOfFile
FindClose
CloseHandle
CreateDirectoryA
CreateDirectoryW
RemoveDirectoryA
RemoveDirectoryW
GetFullPathNameA
GetFullPathNameW
CreateFileA
CreateFileW
SetFileAttributesA
SetFileAttributesW
GetFileAttributesA
GetFileAttributesW
DeleteFileA
DeleteFileW
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
CopyFileA
CopyFileW
AreFileApisANSI
GetModuleHandleA
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateMutexW
RaiseException
DebugBreak
SetFilePointer
GetSystemDirectoryA
GetFileSize
GetProcessTimes
OpenProcess
lstrlenW
LoadLibraryW
InitializeCriticalSection
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
FlushFileBuffers
LoadLibraryExW
GetLastError
GetProcAddress
Sleep
GetModuleFileNameW
FreeLibrary
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
SetHandleCount
DisableThreadLibraryCalls
rpcrt4
UuidToStringW
RpcStringFreeW
ole32
CoTaskMemFree
shell32
SHParseDisplayName
mscoree
GetRequestedRuntimeInfo
urlmon
CoInternetCreateSecurityManager
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
shlwapi
SHStrDupW
advapi32
RegEnumValueA
RegEnumKeyExW
RegEnumKeyExA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyA
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGenRandom
RegEnumValueW
Exports
Exports
CleanOnlineAppCache
CreateActContext
CreateCMSFromXml
DllCanUnloadNow
DllGetClassObject
GetCurrentActContext
GetDeploymentDataFromManifest
GetUserStateManager
GetUserStore
KillService
LaunchApplication
ParseManifest
ShArpMaintain
ShArpMaintainW
ShOpenVerbApplication
ShOpenVerbApplicationW
ShOpenVerbExtension
ShOpenVerbExtensionW
ShOpenVerbShortcut
ShOpenVerbShortcutW
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ