vbscript.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c5ed451dd216ef2a518b080a73040eedcf7824fd6c295a8433a09a1ee910743f.dll
Resource
win10v2004-20240508-en
General
-
Target
c5ed451dd216ef2a518b080a73040eedcf7824fd6c295a8433a09a1ee910743f
-
Size
648KB
-
MD5
3a6c8bb63106f5602e36c034a208dc91
-
SHA1
7f0b7cd7addd023934b95edb1aad728a8550511f
-
SHA256
c5ed451dd216ef2a518b080a73040eedcf7824fd6c295a8433a09a1ee910743f
-
SHA512
81c90d41ba69305931c29da1f86bc0a1c15230a28d1b476681184ab52225c3140255d73edfec60073803d79701d90e88b5a711e4c0828995045190b016d35a7c
-
SSDEEP
12288:bNOmZZkJmSXFxW7nVeaCw4LYL2teQwtEh5gF0Ajkf1q8:NZZkJ9XfW7VeFb0F0Ajkfh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c5ed451dd216ef2a518b080a73040eedcf7824fd6c295a8433a09a1ee910743f
Files
-
c5ed451dd216ef2a518b080a73040eedcf7824fd6c295a8433a09a1ee910743f.dll regsvr32 windows:10 windows x64 arch:x64
38c695eb2db133bd606091b1d2f6db74
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_mbsrchr
_vsnprintf
_mbslwr_s
_mbsnbset
_errno
_ltow
modf
wcstol
bsearch
iswspace
_wtoi
_ismbblead
_onexit
calloc
_callnewh
sin
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_snwprintf_s
_resetstkoflw
toupper
_statusfp
_clearfp
wcscpy_s
strrchr
strcat_s
strcpy_s
_vsnwprintf
wcsncat_s
swprintf_s
wcscspn
atoi
towlower
_ultow_s
_XcptFilter
wcsncmp
strtoul
_controlfp
longjmp
sprintf_s
__C_specific_handler
wcsncpy_s
_wcsnicmp
wcschr
realloc
_wcsdup
_wcsicmp
malloc
free
memmove_s
_purecall
memcpy_s
wcscat_s
_setjmp
atan
cos
exp
floor
floorf
fmod
log
memchr
memcmp
memcpy
memmove
memset
pow
sqrt
oleaut32
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantChangeType
VarUdateFromDate
VarDateFromUdate
VariantChangeTypeEx
SysReleaseString
SafeArrayReleaseDescriptor
SafeArrayAddRef
SysAddRefString
OleLoadPicture
SafeArrayRedim
SafeArrayDestroy
CreateTypeLi
SafeArrayCreate
VariantCopy
LoadTypeLibEx
GetActiveObject
GetErrorInfo
VarR8FromStr
VarDateFromStr
SafeArrayUnlock
SafeArrayReleaseData
SafeArrayLock
LoadTypeLi
RegisterTypeLi
VarBstrFromR8
VariantCopyInd
VarBstrFromR4
VarBstrFromI4
VarBstrFromDate
VarBstrFromUI4
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysReAllocString
LoadRegTypeLi
SysFreeString
CreateTypeLib2
SysAllocString
SysStringLen
SysAllocStringLen
VariantClear
kernel32
CreateMutexExW
DelayLoadFailureHook
ResolveDelayLoadedAPI
WerGetFlags
VirtualProtect
WerSetFlags
MapViewOfFile
CreateFileMappingW
FindResourceExW
LCIDToLocaleName
UnmapViewOfFile
GetVersionExW
CreateFileW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetSystemDefaultUILanguage
SearchPathW
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
Sleep
UnhandledExceptionFilter
RaiseException
TerminateProcess
MulDiv
GetDateFormatW
LCMapStringW
GetDateFormatA
CompareStringA
GetVersion
GetLocaleInfoW
LCMapStringA
CompareStringW
GetLocalTime
LocaleNameToLCID
GetUserDefaultLangID
K32GetModuleInformation
GetCurrentProcess
GetTickCount64
GetTickCount
QueryPerformanceCounter
GetComputerNameA
TlsFree
TlsAlloc
TlsSetValue
LoadResource
LockResource
FreeResource
FindResourceA
GetModuleFileNameW
LoadLibraryExA
SizeofResource
WideCharToMultiByte
GetVersionExA
MultiByteToWideChar
LoadLibraryExW
VirtualQuery
FreeLibrary
IsValidLocale
GetUserDefaultLCID
IsValidCodePage
GetACP
GetLocaleInfoA
RtlCaptureContext
GetSystemDefaultLCID
TlsGetValue
InitializeCriticalSection
GetModuleHandleA
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
AcquireSRWLockShared
GetProcAddress
HeapAlloc
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
GetModuleHandleExW
ReleaseSemaphore
EnterCriticalSection
SetLastError
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
user32
MessageBoxIndirectW
GetWindowRect
GetDC
SetWindowPos
EndDialog
SetWindowTextW
ShowWindow
MapWindowPoints
GetDlgItemTextW
MoveWindow
WinHelpW
SendDlgItemMessageA
SendMessageA
GetClientRect
GetDlgItem
GetWindowLongPtrA
DrawTextW
GetDesktopWindow
SetWindowLongPtrA
DialogBoxParamW
SetForegroundWindow
ReleaseDC
EnableWindow
GetWindowTextW
iertutil
ord594
ord793
ord791
ord796
ord398
ord597
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 480KB - Virtual size: 477KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
fothk Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 4KB - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ