d:\dbs\el\dec\target\x86\ship\misc_shellext\x-none\msoshext.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718.dll
Resource
win10v2004-20240226-en
General
-
Target
f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718
-
Size
1.6MB
-
MD5
e180df04028e8fdf3d6db4a766291751
-
SHA1
1b94e85065365d4b97b37bfecbad152a42d7f653
-
SHA256
f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718
-
SHA512
87cb27683131174eea48e8175d4bb105b28cbdeedeaa6b56bdbd19d71b19e0d7a987b7a85cb56ddda7e725e877afcad39605ba25a03d8762f17ccdef06b72173
-
SSDEEP
49152:YK8OhN1igMM94bX4N2wTA46hcjB/CrCHG:YeEb88AjhCSG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718
Files
-
f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718.dll regsvr32 windows:6 windows x86 arch:x86
ebc6f951c42764b1165e8b6d33b15546
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
WaitForSingleObjectEx
CancelIoEx
FlushFileBuffers
GetFileSizeEx
ResetEvent
CreateEventExW
GetOverlappedResult
CreateEventW
DeviceIoControl
FreeLibrary
GetFileInformationByHandleEx
GetModuleHandleW
GetProcAddress
GetLongPathNameW
GetSystemTimeAsFileTime
WriteFile
SetFilePointerEx
SetEndOfFile
CreateFileW
GetFileType
RaiseException
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
FlsFree
TlsFree
InterlockedPopEntrySList
GetTempPathW
GetStringTypeExW
GetSystemTime
WideCharToMultiByte
SetLastError
IsValidCodePage
MultiByteToWideChar
CreateDirectoryW
ReadFile
RemoveDirectoryW
ReleaseSemaphore
GetFileAttributesExW
CreateSemaphoreExW
CloseHandle
Sleep
SwitchToThread
GetCurrentThreadId
TryEnterCriticalSection
GetTickCount64
SystemTimeToFileTime
FileTimeToSystemTime
WaitForMultipleObjectsEx
CreateWaitableTimerW
QueryDepthSList
InitializeSRWLock
InitializeSListHead
InterlockedPushEntrySList
MulDiv
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetFileAttributesW
DeleteFileW
ReplaceFileW
GetLastError
CopyFileExW
GetTempFileNameW
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
QueryPerformanceCounter
GetCurrentProcessId
IsDebuggerPresent
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
LeaveCriticalSection
InitializeCriticalSectionEx
TlsAlloc
DeleteCriticalSection
HeapFree
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryW
HeapAlloc
GetProcessHeap
IsWow64Process
GetModuleFileNameA
GetShortPathNameA
SetFileInformationByHandle
IsProcessorFeaturePresent
ole32
CoCreateGuid
ReadClassStg
StgCreateDocfileOnILockBytes
StringFromGUID2
CreateStreamOnHGlobal
GetConvertStg
WriteFmtUserTypeStg
CreateILockBytesOnHGlobal
CoTaskMemFree
PropVariantClear
CoTaskMemAlloc
PropVariantCopy
CoCreateInstance
StgOpenStorageOnILockBytes
CoGetMalloc
CLSIDFromString
propsys
InitPropVariantFromStringAsVector
PropVariantChangeType
PropVariantToStringWithDefault
PropVariantToStringAlloc
PSCreateMemoryPropertyStore
PSGetPropertyDescription
vcruntime140
strchr
_purecall
__std_exception_copy
__std_exception_destroy
__std_terminate
__CxxFrameHandler3
wcschr
__std_type_info_compare
wcsstr
_except_handler4_common
__std_type_info_destroy_list
wcsrchr
memset
_CxxThrowException
memcmp
memcpy
memmove
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Xbad_alloc@std@@YAXXZ
_Thrd_id
?_Xlength_error@std@@YAXPBD@Z
_Thrd_sleep
_Xtime_get_ticks
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
_Query_perf_frequency
_Query_perf_counter
?_Xout_of_range@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@F@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xbad_function_call@std@@YAXXZ
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?__ExceptionPtrCreate@@YAXPAX@Z
api-ms-win-crt-heap-l1-1-0
free
realloc
malloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_errno
_register_onexit_function
_crt_atexit
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_initterm_e
_initterm
api-ms-win-crt-string-l1-1-0
strnlen
wcsncpy_s
wcscmp
_stricmp
strcmp
strncpy_s
wcsncat_s
wcsnlen
wcscpy_s
isdigit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__stdio_common_vsnprintf_s
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-locale-l1-1-0
__initialize_lconv_for_unsigned_char
advapi32
RegisterEventSourceW
ReportEventW
RegCreateKeyExW
RegOpenKeyExW
RegGetValueW
RegEnumValueW
RegQueryValueExW
RegCloseKey
EventWriteTransfer
DeregisterEventSource
gdi32
CreateCompatibleBitmap
SelectObject
ExtFloodFill
DeleteObject
DeleteDC
CreateCompatibleDC
oleaut32
SysAllocString
VariantClear
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayCopy
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
VariantChangeTypeEx
SysStringLen
SysAllocStringLen
VariantChangeType
VariantTimeToSystemTime
SystemTimeToVariantTime
SysFreeString
SysStringByteLen
VariantInit
gdiplus
GdiplusStartup
GdiplusShutdown
GdipGetImageHeight
GdipLoadImageFromStream
GdipDrawImageRectI
GdipSetInterpolationMode
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 796KB - Virtual size: 796KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 407KB - Virtual size: 406KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 425KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ