WpcRefreshTask.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6e45bbf40556b06704a3e79075b38bffb851a10bf54e530b5fa3ca6ba320d312.dll
Resource
win10v2004-20240611-en
General
-
Target
6e45bbf40556b06704a3e79075b38bffb851a10bf54e530b5fa3ca6ba320d312
-
Size
1.0MB
-
MD5
4fff856e1717507691f006473e31c96c
-
SHA1
c8ba666e816f4695ee09050b523a38d2c10ee68d
-
SHA256
6e45bbf40556b06704a3e79075b38bffb851a10bf54e530b5fa3ca6ba320d312
-
SHA512
9c0811a75e6a1b04bb5ce191ba4a00ccb7243511687ae5dcca189cb24df805223925ea3e03d0bd62200580fd809399ebc6cac03867ccbbe5a88406b8700ec233
-
SSDEEP
12288:+opwMLyngdJioRxf/aHVR/Z2wDSnFz/Bi7frUzgfnBTxJa63Vtf+MDs3WiVo0O:Rg23EHyi5fnBFJllslGiVo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e45bbf40556b06704a3e79075b38bffb851a10bf54e530b5fa3ca6ba320d312
Files
-
6e45bbf40556b06704a3e79075b38bffb851a10bf54e530b5fa3ca6ba320d312.dll windows:10 windows x64 arch:x64
bee03e94bca247c8c052c5d99d007c48
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcp_win
_Mtx_lock
_Mtx_unlock
_Mtx_destroy_in_situ
_Cnd_wait
_Mtx_init_in_situ
?_Throw_Cpp_error@std@@YAXH@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Xbad_alloc@std@@YAXXZ
_Cnd_broadcast
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
_Cnd_destroy_in_situ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
_Wcsxfrm
_Wcscoll
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?tolower@?$ctype@G@std@@QEBAGG@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$collate@G@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
?_Xout_of_range@std@@YAXPEBD@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Cnd_init_in_situ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Xlength_error@std@@YAXPEBD@Z
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__itoa_s
_o__lock_file
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__ui64tow_s
_o__unlock_file
_o__wcsicmp
_o__wcstoi64
_o__wcstoui64
memmove
_o__invalid_parameter_noinfo_noreturn
_o_abort
_o_ceilf
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_isspace
_o_iswascii
_o_iswdigit
_o_iswlower
_o_iswxdigit
_o_malloc
_o_realloc
_o_setvbuf
_o_strncpy_s
_o_strtol
_o_terminate
_o_towlower
_o_ungetc
_o_ungetwc
_o_wcscpy_s
_o_wcstol
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__invalid_parameter_noinfo
_o__fseeki64
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__i64tow_s
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___std_type_info_name
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
__std_terminate
__CxxFrameHandler4
__std_type_info_compare
strchr
memcmp
memcpy
api-ms-win-crt-string-l1-1-0
strncmp
memset
propsys
ord435
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetLocaleInfoEx
IdnToAscii
GetThreadPreferredUILanguages
api-ms-win-core-processthreads-l1-1-0
OpenThread
QueueUserAPC
OpenProcessToken
GetCurrentProcessId
TlsSetValue
TlsFree
TlsAlloc
TlsGetValue
CreateProcessAsUserW
GetCurrentThreadId
OpenThreadToken
GetExitCodeProcess
TerminateProcess
SetPriorityClass
GetCurrentProcess
GetCurrentThread
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExW
LoadStringW
GetModuleFileNameA
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-handle-l1-1-0
SetHandleInformation
CloseHandle
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
WaitForSingleObjectEx
ReleaseMutex
OpenSemaphoreW
InitializeCriticalSectionEx
CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockShared
SetEvent
AcquireSRWLockExclusive
WaitForMultipleObjectsEx
CreateEventExW
InitializeSRWLock
AcquireSRWLockShared
LeaveCriticalSection
SleepEx
InitializeCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ResetEvent
EnterCriticalSection
ReleaseSemaphore
ReleaseSRWLockExclusive
CreateEventW
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
EventActivityIdControl
api-ms-win-core-com-l1-1-0
CoMarshalInterface
CoUninitialize
CoInitializeEx
CoReleaseMarshalData
CoTaskMemAlloc
CoWaitForMultipleHandles
CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemFree
ntdll
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
NtQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
RtlNtStatusToDosError
RtlGetDeviceFamilyInfoEnum
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
SetRestrictedErrorInfo
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolTimer
CallbackMayRunLong
IsThreadpoolTimerSet
CloseThreadpool
SetThreadpoolTimer
CloseThreadpoolTimer
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks
oleaut32
SysFreeString
SysAllocString
VariantClear
VariantInit
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
InitOnceBeginInitialize
InitOnceComplete
InitOnceInitialize
InitOnceExecuteOnce
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-security-lsapolicy-l1-1-0
LsaRemoveAccountRights
LsaAddAccountRights
LsaClose
LsaOpenPolicy
api-ms-win-security-base-l1-1-0
CopySid
CreateWellKnownSid
SetTokenInformation
GetTokenInformation
GetSidLengthRequired
CheckTokenMembership
DuplicateTokenEx
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
api-ms-win-core-registry-l1-1-0
RegDeleteTreeW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegEnumKeyExW
RegGetValueW
RegCreateKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-fibers-l2-1-0
ConvertFiberToThread
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-file-l1-1-0
CreateFileW
GetFileAttributesW
CreateDirectoryW
ReadFile
SetFilePointerEx
CompareFileTime
WriteFile
GetFileTime
SetEndOfFile
DeleteFileW
GetFileAttributesExW
FileTimeToLocalFileTime
GetFileSizeEx
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
api-ms-win-core-datetime-l1-1-1
GetTimeFormatEx
api-ms-win-base-util-l1-1-0
IsTextUnicode
api-ms-win-shcore-stream-l1-1-0
SHCreateStreamOnFileEx
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-kernel32-legacy-l1-1-2
GetBinaryTypeW
rpcrt4
UuidCreate
api-ms-win-core-shlwapi-legacy-l1-1-0
PathStripPathW
PathRemoveFileSpecW
PathCombineW
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-url-l1-1-0
UrlEscapeW
winhttp
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpOpen
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
api-ms-win-core-kernel32-legacy-l1-1-0
MoveFileW
GetComputerNameW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountNameW
LookupAccountSidW
crypt32
CryptMsgGetParam
CryptMsgClose
CertCloseStore
CertGetNameStringW
CertFindCertificateInStore
CryptQueryObject
CertFreeCertificateContext
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW
api-ms-win-appmodel-runtime-l1-1-0
PackageFamilyNameFromFullName
PackageIdFromFullName
GetPackagePath
api-ms-win-rtcore-ntuser-window-l1-1-0
PeekMessageW
PostThreadMessageW
DispatchMessageW
PostQuitMessage
TranslateMessage
api-ms-win-rtcore-ntuser-synch-l1-1-0
MsgWaitForMultipleObjectsEx
api-ms-win-shell-shellfolders-l1-1-0
SHGetKnownFolderPath
SHGetFolderPathW
mrmcorer
ResourceManagerQueueGetString
ResourceManagerQueueSetGlobalFlags
bcp47langs
GetUserLanguagesForUser
diagnosticdatasettings
TelIsTelemetryTypeAllowed
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 656KB - Virtual size: 652KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
fothk Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 244KB - Virtual size: 242KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 92KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 4KB - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ