bidispl.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bidispl.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
bidispl.dll
Resource
win10v2004-20240508-en
General
-
Target
bidispl.dll
-
Size
46KB
-
MD5
1ccf8514568e0c5548a3cb3e9bc3d0a3
-
SHA1
2fe6e3b15ef605daff2dd6e3838ed478b1f88486
-
SHA256
b40b741e74430948e50cd52ede7f4cea781cc6c09528e8164eb1dc5ce84e047d
-
SHA512
e6653400891eeccdd84010fc5279c748fd73967da4817a56a1f8a48c7a2b4589283667cf8eb8a78a40407885461abc9e11a1ce344a47b633f3b2fda6ae24cc2c
-
SSDEEP
768:dF+PQ9Ge3C9iPkvz3XEeoVPj0F8XwRflFUpbKPstmdZiD/hLdrlLrG:/+8LXH0F8XwRfqmniD/7RG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bidispl.dll
Files
-
bidispl.dll.dll regsvr32 windows:6 windows x64 arch:x64
e7062969bd26122ac5a1e26a3d4a05e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
free
malloc
_initterm
__C_specific_handler
_vsnwprintf
__CxxFrameHandler3
_amsg_exit
_XcptFilter
swscanf
_wcsicmp
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
memcpy
memset
wcscmp
kernel32
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleFileNameW
SetLastError
lstrlenW
GetLastError
GetModuleHandleW
GetProcAddress
FindResourceW
SizeofResource
LoadResource
LockResource
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
TerminateProcess
oleaut32
VariantClear
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
VariantInit
winspool.drv
ClosePrinter
OpenPrinterW
crypt32
CryptBinaryToStringW
CryptStringToBinaryW
api-ms-win-core-com-l1-1-1
StringFromCLSID
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
RegisterTraceGuidsW
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegSetValueExW
RegDeleteTreeW
RegCloseKey
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ