H:\WorkshopAgent\DevelopProj\Code\Oppo\4.72.XXX.1301\TRMenuShl_4.72.507.1301\Bin\Release\TRMenuShl64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e1656d30072c10d4f08fe8b516b50b4632cd8ec73a59afc2682c1497682d0d53.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e1656d30072c10d4f08fe8b516b50b4632cd8ec73a59afc2682c1497682d0d53.dll
Resource
win10v2004-20240508-en
General
-
Target
e1656d30072c10d4f08fe8b516b50b4632cd8ec73a59afc2682c1497682d0d53
-
Size
1.3MB
-
MD5
239aa8df18fbbb6b48ce5eb9223a0747
-
SHA1
dd947ab9038771f4804a7a91ea3647fdad218396
-
SHA256
e1656d30072c10d4f08fe8b516b50b4632cd8ec73a59afc2682c1497682d0d53
-
SHA512
e8af6b26827a9b2286da12a0335ee11568b93baea13fd7edd46bc602311c781c8cb75f3cf851ea3ef839a349186a3227655d1ca73ffc317ce8c17abbb7e2b440
-
SSDEEP
24576:2O4D5qlxyCLGg45hZ1i75YUFWA461LfLVx/9UHECZhi/:pa5qlxyCLpwA4611x6HECZhi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e1656d30072c10d4f08fe8b516b50b4632cd8ec73a59afc2682c1497682d0d53
Files
-
e1656d30072c10d4f08fe8b516b50b4632cd8ec73a59afc2682c1497682d0d53.dll regsvr32 windows:5 windows x64 arch:x64
1b7d4aefb2c29366608cf1bab62d32c5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetCPInfo
GetOEMCP
FileTimeToLocalFileTime
GetFileAttributesExA
LocalFileTimeToFileTime
SetFileTime
GetFileSizeEx
GetFileTime
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
VirtualQuery
FlsSetValue
GetCommandLineA
HeapReAlloc
RtlPcToFileHeader
ExitProcess
ExitThread
HeapSize
HeapQueryInformation
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetACP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
LCMapStringA
LCMapStringW
GetStdHandle
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
FatalAppExitA
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetShortPathNameA
GetStringTypeA
GetStringTypeW
GetDateFormatA
GetTimeFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
TerminateThread
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
WriteFile
GetStringTypeExA
FreeResource
GlobalFindAtomA
GetVersionExA
GlobalFlags
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
SystemTimeToFileTime
FileTimeToSystemTime
QueryDosDeviceW
DefineDosDeviceA
GetDiskFreeSpaceExA
SetVolumeLabelA
GetLogicalDrives
WaitForMultipleObjects
ResetEvent
PulseEvent
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
SleepEx
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
GetEnvironmentVariableW
GetEnvironmentVariableA
GetTempPathW
GetTempPathA
CopyFileW
MoveFileExW
CreateDirectoryW
CreateDirectoryA
MoveFileW
GetFileAttributesW
FormatMessageW
FindResourceExA
GetLocalTime
AllocConsole
FreeConsole
OutputDebugStringW
FindResourceW
GetThreadLocale
GetAtomNameA
GlobalGetAtomNameA
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
TlsGetValue
LocalAlloc
GlobalAddAtomA
CreateEventA
SuspendThread
ResumeThread
SetThreadPriority
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
CompareStringA
SetLastError
GlobalFree
GlobalSize
GlobalAlloc
FormatMessageA
MulDiv
GlobalLock
GlobalUnlock
lstrcpynW
lstrcpynA
QueryDosDeviceA
LoadLibraryExA
GetVersion
IsDBCSLeadByte
GetModuleHandleW
lstrcmpiA
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
OpenEventW
SetEvent
OpenMutexW
OpenMutexA
CreateProcessA
SetFilePointer
WaitForSingleObject
OpenEventA
MoveFileExA
GetFileAttributesExW
ReadFile
GetTickCount
MoveFileA
CopyFileA
SetFileAttributesW
lstrcmpW
RemoveDirectoryW
DeleteFileW
GetFileAttributesA
SetFileAttributesA
lstrcmpA
GetExitCodeThread
RemoveDirectoryA
DeleteFileA
GetSystemInfo
FindFirstFileW
FindNextFileW
FindFirstFileA
FindNextFileA
FindClose
LocalFree
OpenProcess
GetCurrentProcess
CreateThread
GetFileInformationByHandle
GetModuleHandleA
GetCurrentProcessId
GetCurrentThreadId
CreateFileA
GetDriveTypeA
Sleep
GetLastError
CreateFileW
DeviceIoControl
CloseHandle
OutputDebugStringA
GetProfileStringA
LoadLibraryA
FreeLibrary
LoadLibraryW
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
GetLocaleInfoW
FindResourceA
LoadResource
LockResource
SizeofResource
GetModuleFileNameA
GetWindowsDirectoryW
GetWindowsDirectoryA
GetCurrentDirectoryW
GetModuleFileNameW
GetSystemDirectoryW
GetCurrentDirectoryA
GetTimeZoneInformation
GetSystemDirectoryA
user32
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
SetWindowLongPtrA
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
UpdateWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
SetWindowPlacement
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
BeginDeferWindowPos
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
SetWindowTextA
EndPaint
SetPropA
GetWindowDC
CloseDesktop
SetThreadDesktop
GetThreadDesktop
OpenInputDesktop
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
DeleteMenu
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetWindowTextLengthA
UnregisterClassA
UnhookWindowsHookEx
GetLastActivePopup
IsWindowEnabled
EnableWindow
ShowOwnedPopups
GetClassLongPtrA
GetClassLongA
GetCapture
IsChild
LoadAcceleratorsA
WinHelpA
SetActiveWindow
GetForegroundWindow
SetFocus
IsWindow
RemovePropA
GetWindowPlacement
GetPropA
GetUserObjectInformationA
OpenDesktopA
GetProcessWindowStation
CloseWindowStation
SetProcessWindowStation
OpenWindowStationA
MessageBoxA
MessageBoxW
GetWindowThreadProcessId
EnumDesktopWindows
GetParent
GetWindowTextA
GetWindowTextW
GetWindowLongA
IsWindowVisible
EnumWindows
MsgWaitForMultipleObjects
EnumChildWindows
GetDesktopWindow
CharNextA
CharNextW
SendDlgItemMessageA
LoadIconA
RegisterWindowMessageA
CheckDlgButton
CheckRadioButton
GetDlgItemInt
GetDlgItemTextA
SetDlgItemInt
SetDlgItemTextA
IsDlgButtonChecked
IsDialogMessageA
MoveWindow
ShowWindow
ScrollWindowEx
DestroyIcon
CharUpperA
InflateRect
GetMenuItemInfoA
DestroyMenu
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
SetRectEmpty
InvalidateRect
GetDialogBaseUnits
TranslateAcceleratorA
BringWindowToTop
InsertMenuItemA
SetCapture
LockWindowUpdate
GetDCEx
UnionRect
SetParent
GetSystemMenu
IsRectEmpty
MapVirtualKeyA
GetKeyNameTextA
WindowFromPoint
KillTimer
SetTimer
SetRect
UnpackDDElParam
ReuseDDElParam
LoadMenuA
GetMenuBarInfo
ReleaseCapture
BeginPaint
LoadBitmapA
InsertMenuItemW
CreatePopupMenu
EnableMenuItem
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
GetMenuCheckMarkDimensions
GetFocus
SendMessageA
ModifyMenuA
CheckMenuItem
PostMessageA
PostQuitMessage
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
GetMenuItemCount
GetSubMenu
RemoveMenu
InsertMenuA
InsertMenuW
SetMenuItemBitmaps
GetWindowLongPtrA
gdi32
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
CreateCompatibleDC
GetStockObject
SelectPalette
ExtTextOutA
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
GetDCOrgEx
CreateFontIndirectA
GetTextExtentPoint32A
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
GetCharWidthA
CreateFontA
StretchDIBits
CreateCompatibleBitmap
GetTextMetricsA
GetBkColor
RectVisible
TextOutA
PtVisible
StartDocA
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
GetObjectA
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetTextColor
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
CreateDCA
CopyMetaFileA
PlayMetaFileRecord
DeleteObject
GetDeviceCaps
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
LookupAccountSidW
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
SetSecurityDescriptorDacl
LookupAccountNameW
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
RegCreateKeyExW
RegCreateKeyW
RegOpenKeyW
RegQueryValueExW
RegSetValueExW
RegEnumValueA
RegConnectRegistryA
RegQueryValueA
RegEnumKeyA
RegSetValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyA
GetUserNameA
GetTokenInformation
LookupAccountSidA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyA
RegQueryValueExA
RegCloseKey
InitializeSecurityDescriptor
shell32
SHGetFileInfoA
ExtractIconA
DragQueryFileA
DragQueryFileW
DragFinish
shlwapi
PathIsUNCA
PathStripToRootA
PathRemoveExtensionA
PathFindExtensionA
PathFindFileNameA
PathRemoveFileSpecW
ole32
OleDuplicateData
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
CLSIDFromString
WriteFmtUserTypeStg
SetConvertStg
ReleaseStgMedium
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoDisconnectObject
CoUninitialize
WriteClassStg
CoInitializeEx
OleRegGetUserType
oleaut32
VariantInit
VarBstrFromDate
VarCyFromStr
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarDateFromStr
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
VariantChangeType
SafeArrayRedim
VariantClear
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysAllocStringByteLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString
oleacc
LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 821KB - Virtual size: 821KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 316KB - Virtual size: 316KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ