E:\TemporaryBuilds\azure-main-pool-build-de-2\8\s\App\_bin\soda\x64\Release\pdfactivedoc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
90a681166c310fa8c3e8f43ba55811cb7f5dd318f3d85065825cd5dcd218a917.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
90a681166c310fa8c3e8f43ba55811cb7f5dd318f3d85065825cd5dcd218a917.dll
Resource
win10v2004-20240802-en
General
-
Target
90a681166c310fa8c3e8f43ba55811cb7f5dd318f3d85065825cd5dcd218a917
-
Size
976KB
-
MD5
249349f942a9debfd9b6fb642d363f7b
-
SHA1
452710dfb3e1760da9545cb0b2a58762f7e1ca53
-
SHA256
90a681166c310fa8c3e8f43ba55811cb7f5dd318f3d85065825cd5dcd218a917
-
SHA512
74d3b5ea7efbc129855f5fb44f0af30f2d4e6d806eb0a6d626ad664eb79511ecf514d0dac4bec9f81742bf7acc3b1a118da29f2714f5cdf7aff75bf8baa23657
-
SSDEEP
12288:sQqV4bLCFekuHy9GvuDzeIwyWdO2xM3JHJaoF567g4MVXNdowt/pVjXhTTkHhyNE:DAFuHysG+I5B3NKwt/pBXdTkK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 90a681166c310fa8c3e8f43ba55811cb7f5dd318f3d85065825cd5dcd218a917
Files
-
90a681166c310fa8c3e8f43ba55811cb7f5dd318f3d85065825cd5dcd218a917.dll regsvr32 windows:6 windows x64 arch:x64
1c7502955222677230eb5d92c4fba756
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LoadResource
CloseHandle
HeapReAlloc
DisableThreadLibraryCalls
HeapSize
EncodePointer
GetCurrentProcess
HeapFree
SizeofResource
MulDiv
WriteConsoleW
FindResourceW
GetConsoleMode
GetConsoleOutputCP
WriteFile
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
HeapAlloc
HeapDestroy
GetProcAddress
LocalFree
SetEvent
ResetEvent
CreateEventA
OpenEventA
LoadLibraryExW
lstrcmpiW
FreeLibrary
GetModuleHandleW
GetProcessHeap
GlobalUnlock
GetCurrentProcessId
DeleteCriticalSection
GlobalLock
DecodePointer
RaiseException
GlobalAlloc
GetLastError
FormatMessageW
ProcessIdToSessionId
MultiByteToWideChar
GetCurrentThreadId
LocalAlloc
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
EnterCriticalSection
SetLastError
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
VirtualQuery
VirtualProtect
GetSystemInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
CreateDirectoryW
CreateFileW
DeleteFileW
FlushFileBuffers
GetFileAttributesW
GetFileInformationByHandle
GetFileTime
RemoveDirectoryW
SetFileAttributesW
SetFilePointerEx
DeviceIoControl
FormatMessageA
CopyFileExW
WideCharToMultiByte
AreFileApisANSI
GetLongPathNameW
GetTempPathW
InitializeCriticalSectionEx
FindClose
CreateProcessW
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
IsDebuggerPresent
OutputDebugStringW
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
GetExitCodeThread
GetLocaleInfoEx
QueryPerformanceCounter
LCMapStringEx
WakeAllConditionVariable
SleepConditionVariableSRW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
CompareStringEx
user32
GetClassInfoExW
GetParent
PtInRect
SetParent
ReleaseDC
BeginPaint
EndPaint
GetClientRect
InvalidateRect
LoadCursorW
SendNotifyMessageW
SetFocus
IntersectRect
IsChild
OffsetRect
IsWindow
ShowWindow
RegisterClassExW
GetWindowLongPtrW
CharNextW
DefWindowProcW
GetKeyState
CallWindowProcW
PostMessageW
SendMessageTimeoutW
GetFocus
DestroyWindow
GetDC
SetWindowPos
EqualRect
SetWindowLongPtrW
SetWindowRgn
FillRect
CreateWindowExW
UnionRect
UnregisterClassW
gdi32
SaveDC
CloseMetaFile
CreateDCW
SetWindowOrgEx
CreateRectRgnIndirect
SetWindowExtEx
GetDeviceCaps
DeleteDC
TextOutW
SetViewportOrgEx
SetBkColor
RestoreDC
LPtoDP
DeleteObject
CreateSolidBrush
SetMapMode
SetTextAlign
DeleteMetaFile
CreateMetaFileW
advapi32
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
GetSidSubAuthority
GetSidLengthRequired
RegCreateKeyExW
CopySid
InitializeSid
RegEnumKeyExW
IsValidSid
RegSetValueExW
OpenProcessToken
RegOpenKeyExW
ConvertSidToStringSidW
RegDeleteValueW
GetLengthSid
GetTokenInformation
RegQueryValueExW
ole32
CoInitializeEx
OleRegGetMiscStatus
CoUninitialize
CoCreateInstance
OleRegEnumVerbs
StringFromGUID2
CoTaskMemAlloc
StringFromCLSID
OleRegGetUserType
OleRun
CoTaskMemRealloc
CreateDataAdviseHolder
CoTaskMemFree
CreateOleAdviseHolder
StringFromIID
oleaut32
VariantChangeType
SysStringLen
SysAllocString
SysStringByteLen
VariantClear
GetErrorInfo
OleCreatePropertyFrame
SysFreeString
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
VariantInit
LoadTypeLi
wtsapi32
WTSQueryUserToken
userenv
UnloadUserProfile
Exports
Exports
??0?$codecvt_null@_W@archive@boost@@QEAA@_K@Z
??0?$oserializer@Vxml_woarchive@archive@boost@@UCreateProcessRequest@KernelBridgeProxy@@@detail@archive@boost@@QEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@UCreateProcessRequest@KernelBridgeProxy@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@UCreateProcessResponse@KernelBridgeProxy@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??1?$codecvt_null@_W@archive@boost@@UEAA@XZ
??_F?$codecvt_null@_W@archive@boost@@QEAAXXZ
?do_always_noconv@?$codecvt_null@_W@archive@boost@@EEBA_NXZ
?do_encoding@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_in@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?do_max_length@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_out@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCreateProcessRequest@KernelBridgeProxy@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@UCreateProcessRequest@KernelBridgeProxy@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCreateProcessResponse@KernelBridgeProxy@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@UCreateProcessResponse@KernelBridgeProxy@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@UCreateProcessResponse@KernelBridgeProxy@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vxml_wiarchive@archive@boost@@UCreateProcessResponse@KernelBridgeProxy@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vxml_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vxml_woarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vxml_woarchive@archive@boost@@UCreateProcessRequest@KernelBridgeProxy@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$oserializer@Vxml_woarchive@archive@boost@@UCreateProcessRequest@KernelBridgeProxy@@@detail@archive@3@XZ
?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ
?get_mutable_instance@?$singleton@V?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vxml_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vxml_woarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?is_destroyed@?$singleton@V?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vxml_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_locked@singleton_module@serialization@boost@@QEAA_NXZ
?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@UCreateProcessResponse@KernelBridgeProxy@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@QEAAXXZ
?save_object_data@?$oserializer@Vxml_woarchive@archive@boost@@UCreateProcessRequest@KernelBridgeProxy@@@detail@archive@boost@@UEBAXAEAVbasic_oarchive@234@PEBX@Z
?unlock@singleton_module@serialization@boost@@QEAAXXZ
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 679KB - Virtual size: 679KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 194KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ