xbpbxnxouib8mt
Static task
static1
Behavioral task
behavioral1
Sample
19ba36e13532b0a75f4a27409a2de01a08072fc18e7f00cdf605aa519bc64072.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
19ba36e13532b0a75f4a27409a2de01a08072fc18e7f00cdf605aa519bc64072.dll
Resource
win10v2004-20240426-en
General
-
Target
19ba36e13532b0a75f4a27409a2de01a08072fc18e7f00cdf605aa519bc64072
-
Size
836KB
-
MD5
8e174a9a58e1c60aac0e011b1ded4ba7
-
SHA1
b98df4dddb2918d9f4dd4543d9f9280faf03422b
-
SHA256
19ba36e13532b0a75f4a27409a2de01a08072fc18e7f00cdf605aa519bc64072
-
SHA512
bbb0a64ea4a5bbf8dbba343207fe1582380a32af2b03bfd98170718cc11a9a5dc48d1780c895656da697ff6870bea5cad739604be76de944c0ac7c9ef3486b89
-
SSDEEP
6144:Hi05kH9OyU2uv5SRf/FWgFgtegqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukTP:CrHGPv5SmptjDmUWuVZkxikdXcq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19ba36e13532b0a75f4a27409a2de01a08072fc18e7f00cdf605aa519bc64072
Files
-
19ba36e13532b0a75f4a27409a2de01a08072fc18e7f00cdf605aa519bc64072.dll windows:4 windows x64 arch:x64
9a873558f9739b47d573400f9a0176b2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mprapi
MprAdminInterfaceTransportAdd
user32
GetDoubleClickTime
kernel32
GetBinaryTypeW
SetLastError
GetCurrentThreadId
MulDiv
ExitProcess
EnumResourceTypesA
GetModuleHandleA
GetModuleFileNameW
CreateDirectoryA
GetLastError
crypt32
CryptFreeOIDFunctionAddress
winmm
midiInReset
Exports
Exports
??0?$CEventLock@UAppEvents@@@@QEAA@XZ
??0CEventBuffer@@QEAA@AEBV0@@Z
??0CEventBuffer@@QEAA@XZ
??0CMMCStrongReferences@@AEAA@XZ
??0SC@mmcerror@@QEAA@AEBV01@@Z
??0SC@mmcerror@@QEAA@J@Z
??1?$CEventLock@UAppEvents@@@@QEAA@XZ
??1CEventBuffer@@QEAA@XZ
??1SC@mmcerror@@QEAA@XZ
??4?$CEventLock@UAppEvents@@@@QEAAAEAV0@AEBV0@@Z
??4CEventBuffer@@QEAAAEAV0@AEBV0@@Z
??4CMMCStrongReferences@@QEAAAEAV0@$$QEAV0@@Z
??4CMMCStrongReferences@@QEAAAEAV0@AEBV0@@Z
??4SC@mmcerror@@QEAAAEAV01@AEBV01@@Z
??4SC@mmcerror@@QEAAAEAV01@J@Z
??7SC@mmcerror@@QEBAHXZ
??8SC@mmcerror@@QEBA_NAEBV01@@Z
??8SC@mmcerror@@QEBA_NJ@Z
??9SC@mmcerror@@QEBA_NAEBV01@@Z
??9SC@mmcerror@@QEBA_NJ@Z
??BSC@mmcerror@@QEBA_NXZ
??_FSC@mmcerror@@QEAAXXZ
?AddItem@BookKeeping@@SAJAEAVItemHandle@@@Z
?AddRef@CMMCStrongReferences@@SAKXZ
?AddSnapin@BookKeeping@@SAJPEBGAEAH@Z
?AddSnapinInterface@BookKeeping@@SA_NPEAUIUnknown@@PEBGAEAH@Z
?CheckCallingThreadID@SC@mmcerror@@QEAAXXZ
?Clear@SC@mmcerror@@QEAAXXZ
?DumpWatsonTables@BookKeeping@@SAJPEAXPEBGH@Z
?EnableDiagnosticMessageBox@BookKeeping@@SA_N_N@Z
?ExceptionFilter@CMMCWatsonAPI@@SAJPEAU_EXCEPTION_POINTERS@@H@Z
?FatalError@SC@mmcerror@@QEBAXXZ
?FindAllSnapinUIThreads@BookKeeping@@SAJHPEAPEAKPEAK@Z
?FindAllSnapinUIThreads@BookKeeping@@SAJPEAPEAKPEAK@Z
?FindItem@BookKeeping@@SAPEAVItemHandle@@PEAX@Z
?FindSnapin@BookKeeping@@SAAEBVSnapinBookkeepingInfo@@H@Z
?FindSnapin@BookKeeping@@SAAEBVSnapinBookkeepingInfo@@PEAUIUnknown@@@Z
?FindSnapin@BookKeeping@@SAAEBVSnapinBookkeepingInfo@@PEBG@Z
?ForceException@CMMCWatsonAPI@@SAXH@Z
?FormatErrorIds@@YAXIVSC@mmcerror@@IPEAG@Z
?FormatErrorShort@@YAXVSC@mmcerror@@IPEAG@Z
?FormatErrorString@@YAXPEBGVSC@mmcerror@@IPEAGH@Z
?FromLastError@SC@mmcerror@@QEAAAEAV12@XZ
?FromMMC@SC@mmcerror@@QEAAAEAV12@J@Z
?FromWin32@SC@mmcerror@@QEAAAEAV12@J@Z
?FxSnapinException@BookKeeping@@SA_NHPEBG000HPEAUHWND__@@@Z
?GetCode@SC@mmcerror@@QEBAJXZ
?GetErrorMessage@SC@mmcerror@@QEBAXIPEAG@Z
?GetFacility@SC@mmcerror@@AEBA?AW4facility_type@12@XZ
?GetFunctionName@SC@mmcerror@@QEBAPEBGXZ
?GetHWnd@SC@mmcerror@@SAPEAUHWND__@@XZ
?GetHelpFile@SC@mmcerror@@SAPEBGXZ
?GetHelpID@SC@mmcerror@@QEAAKXZ
?GetHinst@SC@mmcerror@@SAPEAUHINSTANCE__@@XZ
?GetMainThreadID@SC@mmcerror@@SAKXZ
?GetModalHWND@SC@mmcerror@@SAPEAUHWND__@@XZ
?GetNewSnapinInstanceId@BookKeeping@@SAHXZ
?GetSingletonObject@CMMCStrongReferences@@CAAEAV1@XZ
?GetSnapinModuleName@BookKeeping@@SAPEBGH@Z
?GetSnapinName@BookKeeping@@SAPEBGH@Z
?GetSnapinName@SC@mmcerror@@QEBAPEBGXZ
?HrFromSc@@YAJAEBVSC@mmcerror@@@Z
?InitInstance@BookKeeping@@SAJXZ
?InterfaceFailure@BookKeeping@@SAXHPEBG0@Z
?InterfaceMethodActivationContextException@BookKeeping@@SAXHPEBG0KPEAU_EXCEPTION_POINTERS@@@Z
?InterfaceMethodException@BookKeeping@@SAXHPEBG0KPEAU_EXCEPTION_POINTERS@@@Z
?InterfaceNotFound@BookKeeping@@SAXHPEBG@Z
?InternalAddRef@CMMCStrongReferences@@AEAAKXZ
?InternalLastRefReleased@CMMCStrongReferences@@AEAA_NXZ
?InternalRelease@CMMCStrongReferences@@AEAAKXZ
?InvalidInterface@BookKeeping@@SAXHPEBG0@Z
?InvalidMMCInterface@BookKeeping@@SAXHPEBG0@Z
?InvalidMMCInterfaceRelease@BookKeeping@@SAXHPEBG0@Z
?IsError@SC@mmcerror@@QEBA_NXZ
?IsLocked@CEventBuffer@@QEAA_NXZ
?IsValid@ItemHandle@@SA_NPEBV1@@Z
?LKResult2HRESULT@BookKeeping@@SAJ_J@Z
?LastRefReleased@CMMCStrongReferences@@SA_NXZ
?Lock@CEventBuffer@@QEAAXXZ
?MMCErrorBox@@YAHII@Z
?MMCErrorBox@@YAHIVSC@mmcerror@@I@Z
?MMCErrorBox@@YAHPEBGI@Z
?MMCErrorBox@@YAHPEBGVSC@mmcerror@@I@Z
?MMCErrorBox@@YAHVSC@mmcerror@@I@Z
?MMCInterfaceError@BookKeeping@@SAXHPEBG0@Z
?MMCInterfaceLeak@BookKeeping@@SAXHPEBG@Z
?MMCInterfaceMethodException@BookKeeping@@SAXHPEBG0KPEAU_EXCEPTION_POINTERS@@W4_SnapinError@1@@Z
?MMCNullInterface@BookKeeping@@SAXHPEBG0@Z
?MakeSc@SC@mmcerror@@AEAAXW4facility_type@12@J@Z
?RegisterSnapinInterfaceErrorHandler@BookKeeping@@SAP6A_NAEAVSnapinBookkeepingInfo@@W4_SnapinError@1@PEBG222KPEAU_EXCEPTION_POINTERS@@@ZP6A_N012222K3@Z@Z
?RegisterThread@BookKeeping@@SAJHHKW4SnapinThreadFlags@1@@Z
?Release@CMMCStrongReferences@@SAKXZ
?ReleaseSnapinInterface@BookKeeping@@SAJPEAUIUnknown@@H@Z
?RemoveItem@BookKeeping@@SAJPEAX@Z
?SCODEFromSc@@YAJAEBVSC@mmcerror@@@Z
?ScEmitOrPostpone@CEventBuffer@@QEAA?AVSC@mmcerror@@PEAUIDispatch@@JPEAVCComVariant@ATL@@H@Z
?ScFlushPostponed@CEventBuffer@@AEAA?AVSC@mmcerror@@XZ
?ScFromMMC@@YA?AVSC@mmcerror@@J@Z
?ScGetConsoleEventDispatcher@CConsoleEventDispatcherProvider@@SA?AVSC@mmcerror@@AEAPEAVCConsoleEventDispatcher@@@Z
?ScSetConsoleEventDispatcher@CConsoleEventDispatcherProvider@@SA?AVSC@mmcerror@@PEAVCConsoleEventDispatcher@@@Z
?SetFunctionName@SC@mmcerror@@QEAAXPEBG@Z
?SetHWnd@SC@mmcerror@@SAXPEAUHWND__@@@Z
?SetHinst@SC@mmcerror@@SAXPEAUHINSTANCE__@@@Z
?SetMainThreadID@SC@mmcerror@@SAXK@Z
?SetModalHWND@SC@mmcerror@@SAPEAUHWND__@@PEAU3@@Z
?SetSnapinName@SC@mmcerror@@QEAAXPEBG@Z
?Throw@SC@mmcerror@@QEAAXJ@Z
?Throw@SC@mmcerror@@QEAAXXZ
?ToHr@SC@mmcerror@@QEBAJXZ
?TraceAndClear@SC@mmcerror@@QEAAXXZ
?TraceError@@YAXPEBGAEBVSC@mmcerror@@@Z
?TraceSnapinError@@YAXPEBGAEBVSC@mmcerror@@@Z
?Trace_@SC@mmcerror@@QEBAXXZ
?Unlock@CEventBuffer@@QEAAXXZ
?UnregisterAllSnapinInstanceThreads@BookKeeping@@SAJH@Z
?UnregisterThread@BookKeeping@@SAJHK@Z
?s_CallDepth@SC@mmcerror@@0IA
?s_dwMainThreadID@SC@mmcerror@@0KA
?s_hInst@SC@mmcerror@@0PEAUHINSTANCE__@@EA
?s_hWnd@SC@mmcerror@@0PEAUHWND__@@EA
?s_hWndModal@SC@mmcerror@@0PEAUHWND__@@EA
?s_pDispatcher@CConsoleEventDispatcherProvider@@0PEAVCConsoleEventDispatcher@@EA
EnterModalLoop
GetComObjectEventSource
GetEventBuffer
GetStringModule
InsideModalLoop
LeaveModalLoop
LoadStandardOverlays
MMCUpdateRegistry
MMC_PickIconDlg
ReportFxSnapinException
Sections
.text Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.code Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sbss Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 80KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.crt Size: 160KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.xlhmxa Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hxtf Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.iars Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ies Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dds Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pngago Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lfjy Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bcfwb Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zzmxs Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tvvljl Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gocp Size: 280KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.szfebu Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.adli Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ