UnifiedConsent.pdb
Static task
static1
Behavioral task
behavioral1
Sample
660e5692d7a00386260a38cb31f3fe5ba0b55fc0dce81c73e1a543ec78669c65.dll
Resource
win10v2004-20240508-en
General
-
Target
660e5692d7a00386260a38cb31f3fe5ba0b55fc0dce81c73e1a543ec78669c65
-
Size
324KB
-
MD5
fc4f5645e86a32f671d29b7b22fd1aa4
-
SHA1
0ea62d8c0a733b247bf9e9ad937327f0c6f15863
-
SHA256
660e5692d7a00386260a38cb31f3fe5ba0b55fc0dce81c73e1a543ec78669c65
-
SHA512
4f1488060962f70341c4f949a2371219530faa529737cd73bda45b47834d4c32bfe917fd1d00912c508af67931c63595277e97d90948a8b836625c1a77f35361
-
SSDEEP
6144:GRA9Vet1Nun5j3PsU4IUDxEDxgO+CImGTcc93osAkub:GRAat1Nu5TsU4Io+xl+XmygX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 660e5692d7a00386260a38cb31f3fe5ba0b55fc0dce81c73e1a543ec78669c65
Files
-
660e5692d7a00386260a38cb31f3fe5ba0b55fc0dce81c73e1a543ec78669c65.dll regsvr32 windows:10 windows x64 arch:x64
8782ab85e4a999605453cf9119591df0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcp_win
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?id@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBUtm@@PEBG3@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
_Thrd_yield
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__execute_onexit_table
_o__gmtime64_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__errno
_o__wcsdup
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_towupper
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf
_o__callnewh
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_type_info_compare
__std_terminate
__CxxFrameHandler4
_o__crt_atexit
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-core-com-l1-1-0
CoGetObjectContext
CoGetApartmentType
PropVariantClear
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoTaskMemAlloc
CoTaskMemFree
CoResumeClassObjects
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetModuleFileNameA
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete
api-ms-win-core-synch-l1-1-0
CreateEventExW
SetEvent
InitializeCriticalSection
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
LeaveCriticalSection
ReleaseSRWLockExclusive
DeleteCriticalSection
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
CreateEventW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsDeleteString
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-l1-1-0
RoRevokeActivationFactories
RoRegisterActivationFactories
RoGetActivationFactory
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolWait
SetThreadpoolWait
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
ResumeThread
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
CreateThread
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
RoOriginateError
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
oleaut32
GetErrorInfo
SysAllocString
SysStringLen
SysFreeString
SetErrorInfo
VariantInit
VariantClear
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegDeleteTreeW
RegEnumKeyExW
RegCopyTreeW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-security-provider-l1-1-0
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
api-ms-win-security-trustee-l1-1-1
GetEffectiveRightsFromAclW
api-ms-win-core-registry-l1-1-1
RegDeleteKeyValueW
RegSetKeyValueW
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
ntdll
NtQueryWnfStateData
combase
ord66
ord67
ord68
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
Exports
Exports
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 232KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
fothk Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ