wshtcpip.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b7ea30d95c0af8646eb7325aedf9def26fccaf2ce1947fd4174ee52b6d9072a0.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b7ea30d95c0af8646eb7325aedf9def26fccaf2ce1947fd4174ee52b6d9072a0.dll
Resource
win10v2004-20240508-en
General
-
Target
b7ea30d95c0af8646eb7325aedf9def26fccaf2ce1947fd4174ee52b6d9072a0
-
Size
19KB
-
MD5
b5f81710a63a411bd9b985aa16eb3ad5
-
SHA1
381e0dd5bce0f4db7fb6b1700fd51dce22eeb5e2
-
SHA256
b7ea30d95c0af8646eb7325aedf9def26fccaf2ce1947fd4174ee52b6d9072a0
-
SHA512
da132ed1fd5639d83cf90a06fa9b387ede273e686bb1a312851b92c53223c4c19d671954639ffd50c16b0ad0fb6c7f813967f4367712ce916fc34732337a1e9a
-
SSDEEP
384:llfsaG4rN9uegBSwRzslZvw9nOcl1M1CnuCWddPYqYEVJsDWwDW:llUadJ9UB1ReS9nplICnuC4dABeG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7ea30d95c0af8646eb7325aedf9def26fccaf2ce1947fd4174ee52b6d9072a0
Files
-
b7ea30d95c0af8646eb7325aedf9def26fccaf2ce1947fd4174ee52b6d9072a0.dll windows:5 windows x86 arch:x86
df8b1a6943bedd6236ca9af8e00a2921
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
ntdll
NtDelayExecution
RtlAppendUnicodeStringToString
RtlUnwind
NtQueryVirtualMemory
RtlIntegerToUnicodeString
RtlInitUnicodeString
NtCreateFile
NtDeviceIoControlFile
RtlAllocateHeap
NtClose
RtlIpv4StringToAddressExW
RtlIpv4AddressToStringExW
_wcsicmp
RtlFreeHeap
wcslen
wcscpy
memmove
ws2_32
ntohs
htonl
Exports
Exports
WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ