defragproxy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
defragproxy.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
defragproxy.dll
Resource
win10v2004-20240508-en
General
-
Target
defragproxy.dll
-
Size
20KB
-
MD5
f2b71e641493e7d6c5388f1d8b91fc75
-
SHA1
083396c33c8c60f55339f26f5623d7c2639b35e3
-
SHA256
2af8b729f5624b95d87fe15d60c5ad4481ff3095f380301b86d96e53881f9660
-
SHA512
305f71a530a3b58a8dff012d13e247f0ae04df3a667664d412b2ddf5d4b1a00438102ff019f1b0daada2d3ae3020e148a97c60a1a3dad5cd9f9298e322051c4c
-
SSDEEP
384:saX425B9XW79RxXfGPunYTikSJyW3vmWH5:sVZRtn7kSJ7f5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource defragproxy.dll
Files
-
defragproxy.dll.dll regsvr32 windows:6 windows x64 arch:x64
0702b193d3b092ad93bd737ed01d2d51
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_amsg_exit
free
malloc
_initterm
__C_specific_handler
_XcptFilter
memcmp
rpcrt4
NdrOleAllocate
CStdStubBuffer_CountRefs
NdrOleFree
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllCanUnloadNow
CStdStubBuffer_DebugServerQueryInterface
NdrDllGetClassObject
NdrDllUnregisterProxy
CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-2
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-sysinfo-l1-2-1
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-2-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-1
UnhandledExceptionFilter
SetUnhandledExceptionFilter
combase
ord14
ord18
ord15
ord19
ord21
ord8
ord20
ord4
ord2
ord9
ord5
ord13
ord11
ord16
ord3
ord7
ord6
ord17
ord10
ord12
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 584B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ