dsparse.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dsparse.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dsparse.dll
Resource
win10v2004-20240426-en
General
-
Target
dsparse.dll
-
Size
29KB
-
MD5
d617c4c865117619e13242f8b4152a8e
-
SHA1
182a048fb983bd163a4100ba9752ef8f56477979
-
SHA256
2d9835ec112492bded892fcd9754bc1a6a96da84f18202f354368cce9b2beb71
-
SHA512
749f8b341797788396a9e3e86aa02eff05af39aecdf6e67cc738080b72f6fa5def69a43fe6c4d9a5975cb5e242a92b3b4c1e063ad748989b1010492c75e0c248
-
SSDEEP
384:oK7B7tv5/cVoUZLZfGsssCoM8pB8lnjPw1my/cLw4gjgxrUPsnDhWiTW:oK7B7gzOsssCocw1mIUxgPsX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dsparse.dll
Files
-
dsparse.dll.dll windows:6 windows x64 arch:x64
67fcfa19258893d40a26a9219e6aed04
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcschr
_wtoi
_itow_s
swscanf_s
iswdigit
towlower
iswxdigit
wcstol
memcpy
__C_specific_handler
_initterm
malloc
free
_amsg_exit
wcstoul
_XcptFilter
memset
ntdll
RtlIpv6StringToAddressExW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-eventing-classicprovider-l1-1-0
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceEnableLevel
TraceMessage
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-2
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-2-1
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-errorhandling-l1-1-1
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
LocalFree
rpcrt4
UuidFromStringW
api-ms-win-core-delayload-l1-1-1
DelayLoadFailureHook
ResolveDelayLoadedAPI
Exports
Exports
DsCrackSpn2A
DsCrackSpn2W
DsCrackSpn3W
DsCrackSpn4W
DsCrackSpnA
DsCrackSpnW
DsCrackUnquotedMangledRdnA
DsCrackUnquotedMangledRdnW
DsGetRdnW
DsIsMangledDnA
DsIsMangledDnW
DsIsMangledRdnValueA
DsIsMangledRdnValueW
DsMakeSpn2W
DsMakeSpnA
DsMakeSpnW
DsQuoteRdnValueA
DsQuoteRdnValueW
DsUnquoteRdnValueA
DsUnquoteRdnValueW
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ