C:\DevOps\agent_2022\workspace\p-9630373565024d8ba931b5c85c1da13c\src\build\Release\VersionServiceProxy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a687fe19a212e1af65c9674b2f05578f844cc2c1f281033a4eba8b88b50849b7.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a687fe19a212e1af65c9674b2f05578f844cc2c1f281033a4eba8b88b50849b7.dll
Resource
win10v2004-20240226-en
General
-
Target
a687fe19a212e1af65c9674b2f05578f844cc2c1f281033a4eba8b88b50849b7
-
Size
1.8MB
-
MD5
e8a8dca2d873e7db16fee311e5f612a3
-
SHA1
f214b7c1ec3796f32d69fc5927a3792e0ca76f09
-
SHA256
a687fe19a212e1af65c9674b2f05578f844cc2c1f281033a4eba8b88b50849b7
-
SHA512
e10f6fbef5208cf879ada56d2e62ae35e0409383bfc0b29b4a7adaefee7b0147e6be8726e66857aaa840dd891183a7d5b53436d67e2df0ee37d376b7d17ebc01
-
SSDEEP
49152:K9J/pUW2MknzBLD1cze5G6D0WZTdX2UPki0c9GE:K9J/pYnFLqzeg6o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a687fe19a212e1af65c9674b2f05578f844cc2c1f281033a4eba8b88b50849b7
Files
-
a687fe19a212e1af65c9674b2f05578f844cc2c1f281033a4eba8b88b50849b7.dll windows:5 windows x86 arch:x86
1ebc0931a5efbf27034e90ffac20b7f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetTickCount
ConnectNamedPipe
CreateFileW
CreateNamedPipeW
CancelSynchronousIo
TerminateProcess
CreateProcessW
GetModuleFileNameW
GetLongPathNameW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReleaseSemaphore
FlushFileBuffers
SetFileTime
GetSystemTime
SystemTimeToFileTime
MapViewOfFile
UnmapViewOfFile
CreateSemaphoreW
CreateFileMappingW
OutputDebugStringA
OutputDebugStringW
CreateDirectoryW
GetFullPathNameW
GetFileInformationByHandle
DeviceIoControl
SetEndOfFile
SetFilePointerEx
FindClose
GetFileTime
SetCurrentDirectoryW
GetCurrentDirectoryW
ReadFile
CreateDirectoryExW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
GetFileAttributesExW
DeleteFileW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileExW
SetLastError
GetFileSize
GetFileSizeEx
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
CreateThread
SetFilePointer
InterlockedDecrement
LocalAlloc
LocalFree
lstrcpyW
GetCurrentProcessId
GetCurrentThreadId
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventA
WriteFile
WaitForSingleObject
TerminateThread
WideCharToMultiByte
HeapSize
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
MultiByteToWideChar
OpenMutexW
CreateMutexW
CloseHandle
Sleep
ReleaseMutex
GetDiskFreeSpaceExW
GetLastError
GetOEMCP
IsValidCodePage
FindNextFileA
DuplicateHandle
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
GetNativeSystemInfo
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
QueryPerformanceCounter
QueryPerformanceFrequency
FindFirstFileExW
GetTempPathW
AreFileApisANSI
CreateHardLinkW
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetProcAddress
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
HeapAlloc
HeapFree
GetProcessHeap
WaitForMultipleObjectsEx
OpenEventA
SetWaitableTimer
ResumeThread
GetSystemInfo
GetLogicalProcessorInformation
CreateWaitableTimerA
FormatMessageA
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
SetProcessAffinityMask
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RaiseException
RtlUnwind
ExitThread
GetModuleHandleExW
GetDriveTypeW
GetFullPathNameA
SetEnvironmentVariableA
SetEnvironmentVariableW
SetCurrentDirectoryA
GetCurrentDirectoryA
ExitProcess
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetACP
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetConsoleCtrlHandler
GetTimeZoneInformation
HeapReAlloc
FindFirstFileExA
RtlCaptureStackBackTrace
shell32
ShellExecuteExW
SHCreateDirectoryExW
ole32
CoTaskMemFree
IIDFromString
StringFromCLSID
oleaut32
CreateErrorInfo
SetErrorInfo
SysFreeString
SysAllocString
VariantChangeType
VariantClear
VariantInit
GetErrorInfo
crypt32
CertFindCertificateInStore
CryptMsgClose
CertFreeCertificateContext
CertGetNameStringW
CryptMsgGetParam
CertCloseStore
CryptQueryObject
ws2_32
ntohl
htonl
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
Exports
Exports
_create_wgtinydl@4
_release_wgtinydl@4
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 307KB - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ