TSWA_migplugin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5b7f2135c8531eb4e5728aaf76e8a27815a624c7b0090c62be6059e3e173c5d6.dll
Resource
win10v2004-20240508-en
General
-
Target
5b7f2135c8531eb4e5728aaf76e8a27815a624c7b0090c62be6059e3e173c5d6
-
Size
190KB
-
MD5
5b2a03cb7f1d5e73956170a52a0b7d34
-
SHA1
f8d0c3662a61d1e8c48203c05dedc8ec5076afbf
-
SHA256
5b7f2135c8531eb4e5728aaf76e8a27815a624c7b0090c62be6059e3e173c5d6
-
SHA512
1197a782045ca801efea263de429f29b395753f496b5e89e201a67b66eb5d99183341abbd965d73e8074d1ff928aec040ae8d7d178addfd8982a4575da96a045
-
SSDEEP
3072:YHqTLEx2j7dFodgJJUNPxZ7Dn4I2hCcG9jXQDVEnE6x:YK9jnlvUNPH7DnXQjD6E6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b7f2135c8531eb4e5728aaf76e8a27815a624c7b0090c62be6059e3e173c5d6
Files
-
5b7f2135c8531eb4e5728aaf76e8a27815a624c7b0090c62be6059e3e173c5d6.dll regsvr32 windows:10 windows x64 arch:x64
73acc792b508a61869aa41bdaba46dbb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LoadResource
FindResourceExW
GetModuleFileNameW
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FormatMessageW
GetCurrentThreadId
HeapFree
GetProcessHeap
HeapAlloc
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
IsDebuggerPresent
OutputDebugStringW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SetLastError
CloseHandle
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
InitializeCriticalSectionEx
WaitForSingleObject
OpenSemaphoreW
CreateThreadpoolTimer
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
WideCharToMultiByte
GetCommandLineA
FlsSetValue
GetVersionExW
RtlLookupFunctionEntry
RtlUnwindEx
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
MultiByteToWideChar
TerminateProcess
SetThreadStackGuarantee
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
RtlPcToFileHeader
EncodePointer
DecodePointer
FlsAlloc
FlsGetValue
FlsFree
ExitProcess
HeapCreate
HeapDestroy
HeapSetInformation
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringA
WriteFile
HeapReAlloc
HeapSize
Sleep
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleCP
GetConsoleMode
SetFilePointer
GetStringTypeW
LCMapStringW
SetStdHandle
WriteConsoleW
CreateFileW
FlushFileBuffers
SizeofResource
RaiseException
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
GetCurrentProcess
FreeLibrary
ole32
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance
oleaut32
RegisterTypeLi
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
SysFreeString
VarUI4FromStr
UnRegisterTypeLi
user32
UnregisterClassA
CharNextW
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryInfoKeyW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 126KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ