CPFilters.pdb
Static task
static1
Behavioral task
behavioral1
Sample
CPFilters.dll
Resource
win10v2004-20240426-en
General
-
Target
CPFilters.dll
-
Size
693KB
-
MD5
813327bd25eaa7a82eb85ac0544ae99a
-
SHA1
74b002f4199645eab297f7a1acc7f5d249ec5a9b
-
SHA256
a6beebaf1df7464eb7a132f9b83cd0022e895de8e593859fc64b781a586ce22f
-
SHA512
600533c8121b1eb94046aa355faa0a4e2a48d314f9cfa898baab8a587a6425f42b995038793edf9429a8f970b41dccb98c4b419772b1b68981b6e7c48a8b74bf
-
SSDEEP
12288:O+ZTBoRg3vlpzYxH0ClJyZNqnuQiCWm8pPJe/cSB7pelI57a6HD4cxmIX//7lHCH:O+ZTBoRg3vlpzYxH0CvC+uQiCpIJe/cj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CPFilters.dll
Files
-
CPFilters.dll.dll regsvr32 windows:10 windows x86 arch:x86
fdedaa861316f3040b2e837241138554
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcschr
realloc
_wtol
wcspbrk
memcpy
memset
_wcsicmp
wcsncmp
isupper
wcsstr
swscanf
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
tolower
_endthread
_beginthreadex
swscanf_s
iswxdigit
swprintf_s
srand
memmove
wcsncpy_s
strnlen
strcat_s
wcstoul
wcscat_s
strncpy_s
wcsnlen
_time32
time
rand
??0exception@@QAE@XZ
_callnewh
malloc
free
_vsnwprintf
memmove_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_purecall
_wcsnicmp
_ftol2
_ftol2_sse
_lock
_unlock
__dllonexit
memcpy_s
_onexit
??1type_info@@UAE@XZ
_except_handler4_common
sscanf_s
memcmp
advapi32
RegDeleteKeyW
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptGenRandom
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
TraceMessage
crypt32
CertFreeCertificateChain
CertGetNameStringW
CertGetCertificateChain
CertVerifyCertificateChainPolicy
kernel32
GlobalFree
GlobalAlloc
DebugBreak
InterlockedDecrement
LocalAlloc
GetVersion
FreeEnvironmentStringsA
GetEnvironmentStringsW
GetProcessHeap
HeapAlloc
FreeEnvironmentStringsW
DeviceIoControl
GetSystemTime
GetGeoInfoA
GetModuleHandleA
RaiseException
WriteFile
ReadFile
lstrlenW
SetFilePointer
GlobalLock
GetFileSize
GlobalUnlock
CompareStringW
lstrlenA
InterlockedIncrement
GlobalMemoryStatusEx
ExpandEnvironmentStringsW
WaitForMultipleObjects
WaitForSingleObject
LoadLibraryW
GetProcAddress
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DecodeSystemPointer
Sleep
OutputDebugStringW
EncodeSystemPointer
DeleteCriticalSection
GetCurrentProcessId
VirtualProtect
GetCurrentProcess
ResumeThread
GetLastError
RaiseFailFastException
GetCurrentThread
CloseHandle
GetModuleHandleW
DisableThreadLibraryCalls
GetVersionExW
GetModuleFileNameA
MultiByteToWideChar
lstrcmpW
CreateEventW
ResetEvent
GetCurrentThreadId
SetEvent
CreateThread
GetTickCount
SetThreadPriority
lstrcmpiW
CompareFileTime
GetSystemTimeAsFileTime
WideCharToMultiByte
GetLocalTime
SystemTimeToFileTime
GetSystemFirmwareTable
LocalFree
GetTickCount64
GetModuleHandleExW
GetModuleFileNameW
CreateFileW
QueryPerformanceCounter
OutputDebugStringA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
HeapFree
GetDiskFreeSpaceW
ole32
CoCreateGuid
PropVariantCopy
CoCreateInstance
StringFromGUID2
CoFileTimeNow
PropVariantClear
CLSIDFromString
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoFreeUnusedLibraries
CoInitializeEx
oleaut32
SysAllocStringLen
SysAllocString
VariantCopy
SysStringLen
SysStringByteLen
VariantInit
VariantClear
SafeArrayCreate
VariantChangeType
SafeArrayAccessData
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
SafeArrayUnaccessData
slc
SLGetWindowsInformationDWORD
winmm
timeGetTime
wintrust
CryptCATCatalogInfoFromContext
WinVerifyTrust
WTHelperProvDataFromStateData
mfplat
MFCreateCollection
ws2_32
htonl
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
UpdatePlayready
Sections
.text Size: 657KB - Virtual size: 656KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ