C:\SourceCode\Git\h2o-core_clean\h2o-core\ServiceHide\ServiceHide.Net\Release\ServiceHide.Net.pdb
Static task
static1
Behavioral task
behavioral1
Sample
966fd4e99fbfc12d4e7b8e652bef6f235f64b3d3011eeede1bb5aa7f60fd7efc.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
966fd4e99fbfc12d4e7b8e652bef6f235f64b3d3011eeede1bb5aa7f60fd7efc.dll
Resource
win10v2004-20240508-en
General
-
Target
966fd4e99fbfc12d4e7b8e652bef6f235f64b3d3011eeede1bb5aa7f60fd7efc
-
Size
101KB
-
MD5
08f683b987c9fbe54e25c90525c9694a
-
SHA1
26f6f40094f2f8ce2e019944697373ce3ea5704e
-
SHA256
966fd4e99fbfc12d4e7b8e652bef6f235f64b3d3011eeede1bb5aa7f60fd7efc
-
SHA512
72c092910705ceea440124399cc82ad4f7512e1f0ff775772374a8392ff2049561fdd8e4cade03670078bcea035d3c5dc735159de552f10796a68bbabde8561c
-
SSDEEP
3072:gdJa6tzjj4kH7JoqI36Ow6l7BZHQxgey:gdvtzjEkH7Ja36OwO7BV1f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 966fd4e99fbfc12d4e7b8e652bef6f235f64b3d3011eeede1bb5aa7f60fd7efc
Files
-
966fd4e99fbfc12d4e7b8e652bef6f235f64b3d3011eeede1bb5aa7f60fd7efc.dll windows:6 windows x86 arch:x86
bbe8ad3aa1e96cc928ee8c0d844c060f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
vcruntime140
_except_handler4_common
memset
__FrameUnwindFilter
memmove
__current_exception_context
__current_exception
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
abort
_cexit
terminate
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
kernel32
Sleep
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MultiByteToWideChar
WideCharToMultiByte
LocalFree
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
servicehide
?TryGetStringValue@Win32Operations@ServiceHide@@QAE?AV?$optional@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?TryGetBinaryValue@Win32Operations@ServiceHide@@QAE?AV?$optional@V?$vector@EV?$allocator@E@std@@@std@@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?TryGetQwordValue@Win32Operations@ServiceHide@@QAE?AV?$optional@_K@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?TryGetDwordValue@Win32Operations@ServiceHide@@QAE?AV?$optional@K@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?GetApparatusCapabiliites@GraphicsOperations@ServiceHide@@QAEHPAUHDC__@@H@Z
?ImageColourTransfer@GraphicsOperations@ServiceHide@@QAEHPAUHDC__@@HHHH0HHK@Z
?PrepareCompatibleImage@GraphicsOperations@ServiceHide@@QAEPAUHBITMAP__@@PAUHDC__@@HH@Z
?PrepareCompatibleDrawingSurface@GraphicsOperations@ServiceHide@@QAEPAUHDC__@@PAU3@@Z
?RemoveDrawingSurface@GraphicsOperations@ServiceHide@@QAEHPAUHDC__@@@Z
?RemoveDrawingSurfaceComponent@GraphicsOperations@ServiceHide@@QAEHPAX@Z
?RetrieveDrawingSurfaceComponent@GraphicsOperations@ServiceHide@@QAEPAXPAUHDC__@@PAX@Z
??1ObjectSearcher@ServiceHide@@QAE@XZ
?COMInitialize@ObjectSearcher@ServiceHide@@SAJXZ
?IsServerVersion@ObjectSearcher@ServiceHide@@QAE_NXZ
?IsVirtualMachine@ObjectSearcher@ServiceHide@@QAE_NXZ
?IsHyperVEnabled@ObjectSearcher@ServiceHide@@QAE_NXZ
??0ObjectSearcher@ServiceHide@@QAE@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetSecurityCenterInfo@ObjectSearcher@ServiceHide@@QAE?AV?$shared_ptr@V?$list@V?$shared_ptr@VSecurityCenterDataWideString@ServiceHide@@@std@@V?$allocator@V?$shared_ptr@VSecurityCenterDataWideString@ServiceHide@@@std@@@2@@std@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?GetAPI@Sciter@ServiceHide@@QAEPAU_ISciterAPI@@XZ
?GetAPI32@Sciter@ServiceHide@@QAEPAU_ISciterAPI@@XZ
?GetAPI64@Sciter@ServiceHide@@QAEPAU_ISciterAPI@@XZ
??0StructureOperations@ServiceHide@@QAE@XZ
??1StructureOperations@ServiceHide@@QAE@XZ
?GetCurrentActivityId@StructureOperations@ServiceHide@@QAEKXZ
?GetOperationLocation@StructureOperations@ServiceHide@@QAEP6GHXZPAUHINSTANCE__@@PBD@Z
?LoadLocation@StructureOperations@ServiceHide@@QAEPAUHINSTANCE__@@PB_W@Z
?IsLocationCapabilityAvailable@StructureOperations@ServiceHide@@QAEHK@Z
?GetActualPlacedLocationRecall@StructureOperations@ServiceHide@@QAEHPA_K@Z
?AdjustAsset@StructureOperations@ServiceHide@@QAEHPB_W0K@Z
?WriteHiddenString@StructureOperations@ServiceHide@@QAEHPB_W000@Z
?CloseConnection@StructureOperations@ServiceHide@@QAEHPAX@Z
?TerminateConnection@StructureOperations@ServiceHide@@QAEHPAXI@Z
?CreateConnection@StructureOperations@ServiceHide@@QAEHPB_WPA_WPAU_SECURITY_ATTRIBUTES@@2HKPAX0PAU_STARTUPINFOW@@PAU_PROCESS_INFORMATION@@@Z
?GetBaseLocation@StructureOperations@ServiceHide@@QAEPAUHWND__@@XZ
?AdjustLocation@StructureOperations@ServiceHide@@QAEHPAUHWND__@@HHHHH@Z
?IsLocation@StructureOperations@ServiceHide@@QAEHPAUHWND__@@@Z
?DestroyLocation@StructureOperations@ServiceHide@@QAEHPAUHWND__@@@Z
?StructurePropertiesInfo@StructureOperations@ServiceHide@@QAEHIIPAXI@Z
?CreateLocation@StructureOperations@ServiceHide@@QAEPAUHWND__@@KPB_W0KHHHHPAU3@PAUHMENU__@@PAUHINSTANCE__@@PAX@Z
?GetReducedLocationName@StructureOperations@ServiceHide@@QAEKPB_WPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetHiddenString@StructureOperations@ServiceHide@@QAEKPB_W00PA_WK0@Z
?ConnectOperationsInput@UserOperations@ServiceHide@@QAEHKKH@Z
?LocateLocationByTitle@UserOperations@ServiceHide@@QAEPAUHWND__@@PB_W0@Z
?GetLocationLayout@UserOperations@ServiceHide@@QAEHPAUHWND__@@PAUtagRECT@@@Z
?SeInFrontLocation@UserOperations@ServiceHide@@QAEHPAUHWND__@@@Z
?SeLocationPosition@UserOperations@ServiceHide@@QAEHPAUHWND__@@0HHHHI@Z
?SearchStringAssociation@Win32Operations@ServiceHide@@QAEJKIPB_W0PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?RetrieveStructureOptions@UserOperations@ServiceHide@@QAEPAUHMENU__@@PAUHWND__@@H@Z
?EnableOptionsSeelction@UserOperations@ServiceHide@@QAEHPAUHMENU__@@II@Z
?EnumLocations@UserOperations@ServiceHide@@QAEHP6GHPAUHWND__@@J@ZJ@Z
?GetInFrontLocation@UserOperations@ServiceHide@@QAEPAUHWND__@@XZ
?RetrieveLocationActivityId@UserOperations@ServiceHide@@QAEKPAUHWND__@@PAK@Z
?GetLocationLabelLength@UserOperations@ServiceHide@@QAEHPAUHWND__@@@Z
?IsLocationViewable@UserOperations@ServiceHide@@QAEHPAUHWND__@@@Z
?GetBaseLocation@UserOperations@ServiceHide@@QAEPAUHWND__@@XZ
?BringLocationAboveAll@UserOperations@ServiceHide@@QAEHPAUHWND__@@@Z
?GetLocationOrientation@UserOperations@ServiceHide@@QAEHPAUHWND__@@PAUtagWINDOWPLACEMENT@@@Z
?SendNotification@UserOperations@ServiceHide@@QAEHPAUHWND__@@IIJ@Z
?SendNotificationAndWait@UserOperations@ServiceHide@@QAEJPAUHWND__@@IIJ@Z
?GetLocationDimensions@UserOperations@ServiceHide@@QAEHPAUHWND__@@PAUtagRECT@@@Z
?NotificationControl@UserOperations@ServiceHide@@QAEHPAUHWND__@@PB_W1I@Z
?GetLocationReference@UserOperations@ServiceHide@@QAEJPAUHWND__@@H@Z
?SetLocationAttribute@UserOperations@ServiceHide@@QAEJPAUHWND__@@HJ@Z
?SetLocationAttribute64@UserOperations@ServiceHide@@QAEJPAUHWND__@@HJ@Z
?RetreiveLocationSurface@UserOperations@ServiceHide@@QAEPAUHWND__@@XZ
?RetrieveSurface@UserOperations@ServiceHide@@QAEPAUHDC__@@PAUHWND__@@@Z
?FreeLocationSurface@UserOperations@ServiceHide@@QAEHPAUHWND__@@PAUHDC__@@@Z
?SendExitNotification@UserOperations@ServiceHide@@QAEXH@Z
?GetLocationText@UserOperations@ServiceHide@@QAEHPAUHWND__@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
??0Win32Operations@ServiceHide@@QAE@XZ
??1Win32Operations@ServiceHide@@QAE@XZ
?Close@Win32Operations@ServiceHide@@QAEXXZ
?RegQueryValueExService@Win32Operations@ServiceHide@@QAEJPAUHKEY__@@PB_WPAKPAE2@Z
?Open@Win32Operations@ServiceHide@@QAEJPAUHKEY__@@PB_WKAAPAU3@_N@Z
?MonitorRegistryChange@Win32Operations@ServiceHide@@QAEJHKPAXH@Z
?OpenAccess@Win32Operations@ServiceHide@@QAEHPAXK@Z
?GetAccessInformation@Win32Operations@ServiceHide@@QAEHW4_TOKEN_INFORMATION_CLASS@@PAXKPAK@Z
?DuplicateAccess@Win32Operations@ServiceHide@@QAEHW4_SECURITY_IMPERSONATION_LEVEL@@PAPAX@Z
?GetIdentifiedLocation@Win32Operations@ServiceHide@@QAEJABU_GUID@@KPAXPAPA_W@Z
?RetreiveOperationInformation@Win32Operations@ServiceHide@@QAEJPAXW4_PROCESSINFOCLASS@@PAUPROCESS_BASIC_INFORMATION_EXTEND@@PAK@Z
?PrepareLinkingInitialize@Win32Operations@ServiceHide@@QAEJPAX@Z
?GetOrganizationBenchMarks@Win32Operations@ServiceHide@@QAEHH@Z
?RetrieveNotification@Win32Operations@ServiceHide@@QAEHPAUtagMSG@@PAUHWND__@@II@Z
?TranslateNotification@Win32Operations@ServiceHide@@QAEHPAUtagMSG@@@Z
?DispatchNotification@Win32Operations@ServiceHide@@QAEHPBUtagMSG@@@Z
?ObserveFromLocation@Win32Operations@ServiceHide@@QAEPAUHMONITOR__@@PAUHWND__@@K@Z
?RetrieveDisplayData@Win32Operations@ServiceHide@@QAEHPAUHMONITOR__@@PAUtagMONITORINFO@@@Z
?GetActiveRegistryHandle@Win32Operations@ServiceHide@@QAEPAUHKEY__@@XZ
?CloseRegistryHandle@Win32Operations@ServiceHide@@QAEXPAUHKEY__@@@Z
?MonitorRegistryChange@Win32Operations@ServiceHide@@QAEJHKPAXHPAUHKEY__@@@Z
?SetCloseKey@Win32Operations@ServiceHide@@QAEX_N@Z
?RegQueryInfoKeyService@Win32Operations@ServiceHide@@QAEJPAUHKEY__@@PA_WPAK2222222PAU_FILETIME@@@Z
?QueryValueType@Win32Operations@ServiceHide@@QAEKABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?EnumSubKeys@Win32Operations@ServiceHide@@QAE?AV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@XZ
?DisplayLocation@UserOperations@ServiceHide@@QAEHPAUHWND__@@H@Z
msvcp140
?_Xlength_error@std@@YAXPBD@Z
mscoree
_CorDllMain
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 800B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ