SpeechSDKShim.pdb
Static task
static1
Behavioral task
behavioral1
Sample
96f4302ccff641338c58bab7f02fddfacc55ed46b9d49137797b1f9390669601.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
96f4302ccff641338c58bab7f02fddfacc55ed46b9d49137797b1f9390669601.dll
Resource
win10v2004-20240802-en
General
-
Target
96f4302ccff641338c58bab7f02fddfacc55ed46b9d49137797b1f9390669601
-
Size
247KB
-
MD5
8d5fd2f49db85377aad7899c2a882e9b
-
SHA1
01cc3208df3b31f13f81be725306ca864ce26617
-
SHA256
96f4302ccff641338c58bab7f02fddfacc55ed46b9d49137797b1f9390669601
-
SHA512
58e61289b7e3bb7c4dcc89f7261cc5a982364e9809c87794f9da8a4d35930f6393b692b7748bad09ed2dd1454cd6fcbc72e7163928f4ce22b6132d6b10d787f5
-
SSDEEP
6144:kqmPFTxToQy4odcieBCfoKaVoJxMSCk3QGZzEVq2:kqmPFRoQynvecahGYq2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96f4302ccff641338c58bab7f02fddfacc55ed46b9d49137797b1f9390669601
Files
-
96f4302ccff641338c58bab7f02fddfacc55ed46b9d49137797b1f9390669601.dll windows:5 windows x86 arch:x86
e0b0eed09e8129fb63989e4ea35b299b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
WaitForMultipleObjects
CreateSemaphoreW
CreateWaitableTimerW
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
SwitchToThread
CreateThread
GetCurrentThreadId
GetExitCodeThread
GetThreadTimes
IsProcessorFeaturePresent
SetThreadIdealProcessor
GlobalMemoryStatusEx
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetVersionExW
GetNativeSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
VirtualAllocEx
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
MapViewOfFileEx
UnmapViewOfFile
GetProcessWorkingSetSize
SetProcessWorkingSetSize
AllocateUserPhysicalPages
QueueUserWorkItem
UnregisterWaitEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryW
LocalAlloc
LocalFree
ConvertThreadToFiber
SetThreadAffinityMask
SetThreadExecutionState
CreateFileMappingA
EnumResourceLanguagesA
EnumResourceLanguagesW
RegisterWaitForSingleObject
UnregisterWait
BindIoCompletionCallback
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
SetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
SetWaitableTimer
GetCalendarInfoW
GetNumberFormatW
GetCurrencyFormatW
EnumCalendarInfoExW
EnumTimeFormatsW
EnumDateFormatsExW
GetThreadLocale
GetUserDefaultLangID
GetSystemDefaultLangID
GetSystemDefaultLCID
GetUserDefaultLCID
EnumSystemLocalesW
RtlCaptureStackBackTrace
QueryDepthSList
InterlockedPopEntrySList
GetModuleHandleExA
DisableThreadLibraryCalls
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
HeapSize
GetFileType
GetStdHandle
GetProcessHeap
CreateEventW
CreateEventA
CreateMutexW
CreateMutexA
WaitForSingleObjectEx
WaitForSingleObject
ReleaseMutex
ReleaseSemaphore
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CreateFileW
LeaveCriticalSection
EnterCriticalSection
CancelIo
GetQueuedCompletionStatus
HeapFree
HeapReAlloc
HeapAlloc
SetErrorMode
SetLastError
GetLastError
RaiseException
DuplicateHandle
CloseHandle
AreFileApisANSI
GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW
GetLongPathNameW
GetFileAttributesW
FindFirstFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindClose
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DeleteCriticalSection
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
InitializeSListHead
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
Sleep
FindFirstFileA
GetLocaleInfoW
WTSGetActiveConsoleSessionId
user32
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
PostMessageW
DefWindowProcW
PostQuitMessage
RegisterClassW
CreateWindowExW
DestroyWindow
SetTimer
GetWindowLongW
SetWindowLongW
advapi32
RegOpenKeyExW
RegCloseKey
RegCreateKeyExA
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyW
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
ole32
CoUninitialize
CoInitializeEx
shlwapi
SHDeleteKeyA
SHDeleteKeyW
SHCopyKeyW
SHCopyKeyA
SHQueryValueExW
SHQueryValueExA
psapi
GetModuleFileNameExA
GetModuleFileNameExW
GetWsChanges
GetProcessImageFileNameA
GetProcessImageFileNameW
GetModuleBaseNameA
GetModuleBaseNameW
EmptyWorkingSet
QueryWorkingSet
InitializeProcessForWsWatch
GetMappedFileNameW
EnumProcessModules
EnumDeviceDrivers
GetDeviceDriverBaseNameA
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameA
GetDeviceDriverFileNameW
GetPerformanceInfo
EnumPageFilesW
EnumPageFilesA
GetProcessMemoryInfo
EnumProcesses
GetModuleInformation
GetMappedFileNameA
Exports
Exports
AbortSystemShutdownA
AbortSystemShutdownW
AccessCheck
AccessCheckAndAuditAlarmA
AccessCheckAndAuditAlarmW
AccessCheckByType
AccessCheckByTypeAndAuditAlarmA
AccessCheckByTypeAndAuditAlarmW
AccessCheckByTypeResultList
AccessCheckByTypeResultListAndAuditAlarmA
AccessCheckByTypeResultListAndAuditAlarmByHandleA
AccessCheckByTypeResultListAndAuditAlarmByHandleW
AccessCheckByTypeResultListAndAuditAlarmW
AcquireSRWLockExclusive
AcquireSRWLockShared
ActivateActCtx
AddAccessAllowedAce
AddAccessAllowedAceEx
AddAccessAllowedObjectAce
AddAccessDeniedAce
AddAccessDeniedAceEx
AddAccessDeniedObjectAce
AddAce
AddAtomA
AddAtomW
AddAuditAccessAce
AddAuditAccessAceEx
AddAuditAccessObjectAce
AddConsoleAliasA
AddConsoleAliasW
AddLocalAlternateComputerNameA
AddLocalAlternateComputerNameW
AddRefActCtx
AddUsersToEncryptedFile
AddVectoredContinueHandler
AddVectoredExceptionHandler
AdjustTokenGroups
AdjustTokenPrivileges
AllocConsole
AllocateAndInitializeSid
AllocateLocallyUniqueId
AllocateUserPhysicalPages
AllocateUserPhysicalPagesNuma
AreAllAccessesGranted
AreAnyAccessesGranted
AreFileApisANSI
AssignProcessToJobObject
AttachConsole
BackupEventLogA
BackupEventLogW
BackupRead
BackupSeek
BackupWrite
Beep
BeginUpdateResourceA
BeginUpdateResourceW
BindIoCompletionCallback
BuildCommDCBA
BuildCommDCBAndTimeoutsA
BuildCommDCBAndTimeoutsW
BuildCommDCBW
BuildExplicitAccessWithNameA
BuildExplicitAccessWithNameW
BuildImpersonateExplicitAccessWithNameA
BuildImpersonateExplicitAccessWithNameW
BuildImpersonateTrusteeA
BuildImpersonateTrusteeW
BuildSecurityDescriptorA
BuildSecurityDescriptorW
BuildTrusteeWithNameA
BuildTrusteeWithNameW
BuildTrusteeWithObjectsAndNameA
BuildTrusteeWithObjectsAndNameW
BuildTrusteeWithObjectsAndSidA
BuildTrusteeWithObjectsAndSidW
BuildTrusteeWithSidA
BuildTrusteeWithSidW
CallNamedPipeA
CallNamedPipeW
CancelDeviceWakeupRequest
CancelIo
CancelIoEx
CancelOverlappedAccess
CancelSynchronousIo
CancelThreadpoolIo
CancelTimerQueueTimer
CancelWaitableTimer
ChangeServiceConfig2A
ChangeServiceConfig2W
ChangeServiceConfigA
ChangeServiceConfigW
ChangeTimerQueueTimer
CheckNameLegalDOS8Dot3A
CheckNameLegalDOS8Dot3W
CheckRemoteDebuggerPresent
CheckTokenMembership
ClearCommBreak
ClearCommError
ClearEventLogA
ClearEventLogW
CloseCodeAuthzLevel
CloseEncryptedFileRaw
CloseEventLog
CloseHandle
CloseServiceHandle
CloseThreadpoolIo
CloseThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolWork
CloseTrace
CommConfigDialogA
CommConfigDialogW
CommandLineFromMsiDescriptor
CompareFileTime
CompareStringA
CompareStringEx
CompareStringOrdinal
CompareStringW
ComputeAccessTokenFromCodeAuthzLevel
ConnectNamedPipe
ContinueDebugEvent
ControlService
ControlTraceA
ControlTraceW
ConvertAccessToSecurityDescriptorA
ConvertAccessToSecurityDescriptorW
ConvertDefaultLocale
ConvertFiberToThread
ConvertSDToStringSDRootDomainA
ConvertSDToStringSDRootDomainW
ConvertSecurityDescriptorToAccessA
ConvertSecurityDescriptorToAccessNamedA
ConvertSecurityDescriptorToAccessNamedW
ConvertSecurityDescriptorToAccessW
ConvertSecurityDescriptorToStringSecurityDescriptorA
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertSidToStringSidA
ConvertSidToStringSidW
ConvertStringSDToSDDomainA
ConvertStringSDToSDDomainW
ConvertStringSDToSDRootDomainA
ConvertStringSDToSDRootDomainW
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidA
ConvertStringSidToSidW
ConvertThreadToFiber
ConvertThreadToFiberEx
ConvertToAutoInheritPrivateObjectSecurity
CopyContext
CopyFileA
CopyFileExA
CopyFileExW
CopyFileW
CopySid
CreateActCtxA
CreateActCtxW
CreateCodeAuthzLevel
CreateConsoleScreenBuffer
CreateDirectoryA
CreateDirectoryExA
CreateDirectoryExW
CreateDirectoryW
CreateEventA
CreateEventExA
CreateEventExW
CreateEventW
CreateFiber
CreateFiberEx
CreateFile2
CreateFileA
CreateFileMapping2
CreateFileMappingA
CreateFileMappingFromApp
CreateFileMappingNumaA
CreateFileMappingNumaW
CreateFileMappingW
CreateFileW
CreateHardLinkA
CreateHardLinkW
CreateIoCompletionPort
CreateJobObjectA
CreateJobObjectW
CreateJobSet
CreateMailslotA
CreateMailslotW
CreateMemoryResourceNotification
CreateMutexA
CreateMutexExA
CreateMutexExW
CreateMutexW
CreateNamedPipeA
CreateNamedPipeW
CreatePipe
CreatePrivateObjectSecurity
CreatePrivateObjectSecurityEx
CreatePrivateObjectSecurityWithMultipleInheritance
CreateProcessA
CreateProcessAsUserA
CreateProcessAsUserW
CreateProcessW
CreateProcessWithLogonW
CreateProcessWithTokenW
CreateRemoteThread
CreateRestrictedToken
CreateSemaphoreA
CreateSemaphoreExW
CreateSemaphoreW
CreateServiceA
CreateServiceW
CreateSymbolicLinkA
CreateSymbolicLinkW
CreateTapePartition
CreateThread
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
CreateTimerQueue
CreateTimerQueueTimer
CreateToolhelp32Snapshot
CreateTraceInstanceId
CreateWaitableTimerA
CreateWaitableTimerExW
CreateWaitableTimerW
CreateWellKnownSid
CredDeleteA
CredDeleteW
CredEnumerateA
CredEnumerateW
CredFree
CredGetSessionTypes
CredGetTargetInfoA
CredGetTargetInfoW
CredIsMarshaledCredentialA
CredIsMarshaledCredentialW
CredMarshalCredentialA
CredMarshalCredentialW
CredReadA
CredReadDomainCredentialsA
CredReadDomainCredentialsW
CredReadW
CredRenameA
CredRenameW
CredUnmarshalCredentialA
CredUnmarshalCredentialW
CredWriteA
CredWriteDomainCredentialsA
CredWriteDomainCredentialsW
CredWriteW
CryptAcquireContextA
CryptAcquireContextW
CryptContextAddRef
CryptCreateHash
CryptDecrypt
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptDuplicateHash
CryptDuplicateKey
CryptEncrypt
CryptEnumProviderTypesA
CryptEnumProviderTypesW
CryptEnumProvidersA
CryptEnumProvidersW
CryptExportKey
CryptGenKey
CryptGenRandom
CryptGetDefaultProviderA
CryptGetDefaultProviderW
CryptGetHashParam
CryptGetKeyParam
CryptGetProvParam
CryptGetUserKey
CryptHashData
CryptHashSessionKey
CryptImportKey
CryptReleaseContext
CryptSetHashParam
CryptSetKeyParam
CryptSetProvParam
CryptSetProviderA
CryptSetProviderExA
CryptSetProviderExW
CryptSetProviderW
CryptSignHashA
CryptSignHashW
CryptVerifySignatureA
CryptVerifySignatureW
CtrlRoutine
DeactivateActCtx
DebugActiveProcess
DebugActiveProcessStop
DebugBreak
DebugBreakProcess
DebugSetProcessKillOnExit
DecodePointer
DecodeSystemPointer
DecryptFileA
DecryptFileW
DefineDosDeviceA
DefineDosDeviceW
DelayLoadFailureHook
DeleteAce
DeleteAtom
DeleteCriticalSection
DeleteFiber
DeleteFileA
DeleteFileW
DeleteProcThreadAttributeList
DeleteService
DeleteSynchronizationBarrier
DeleteTimerQueue
DeleteTimerQueueEx
DeleteTimerQueueTimer
DeleteVolumeMountPointA
DeleteVolumeMountPointW
DeregisterEventSource
DestroyPrivateObjectSecurity
DeviceIoControl
DisableThreadLibraryCalls
DiscardVirtualMemory
DisconnectNamedPipe
DnsHostnameToComputerNameA
DnsHostnameToComputerNameW
DosDateTimeToFileTime
DosPathToSessionPathW
DuplicateEncryptionInfoFile
DuplicateHandle
DuplicateToken
DuplicateTokenEx
EnableTrace
EncodePointer
EncodeSystemPointer
EncryptFileA
EncryptFileW
EncryptedFileKeyInfo
EncryptionDisable
EndUpdateResourceA
EndUpdateResourceW
EnterCriticalSection
EnterSynchronizationBarrier
EnumCalendarInfoA
EnumCalendarInfoExA
EnumCalendarInfoExEx
EnumCalendarInfoExW
EnumCalendarInfoW
EnumDateFormatsA
EnumDateFormatsExA
EnumDateFormatsExEx
EnumDateFormatsExW
EnumDateFormatsW
EnumDependentServicesA
EnumDependentServicesW
EnumLanguageGroupLocalesA
EnumLanguageGroupLocalesW
EnumResourceLanguagesA
EnumResourceLanguagesExA
EnumResourceLanguagesExW
EnumResourceLanguagesW
EnumResourceNamesA
EnumResourceNamesW
EnumResourceTypesA
EnumResourceTypesW
EnumServiceGroupW
EnumServicesStatusA
EnumServicesStatusExA
EnumServicesStatusExW
EnumServicesStatusW
EnumSystemCodePagesA
EnumSystemCodePagesW
EnumSystemFirmwareTables
EnumSystemGeoID
EnumSystemLanguageGroupsA
EnumSystemLanguageGroupsW
EnumSystemLocalesA
EnumSystemLocalesEx
EnumSystemLocalesW
EnumTimeFormatsA
EnumTimeFormatsEx
EnumTimeFormatsW
EnumUILanguagesA
EnumUILanguagesW
EnumerateLocalComputerNamesA
EnumerateLocalComputerNamesW
EnumerateTraceGuids
EnumerateTraceGuidsEx
EqualDomainSid
EqualPrefixSid
EqualSid
EraseTape
EscapeCommFunction
EventActivityIdControl
EventEnabled
EventRegister
EventSetInformation
EventUnregister
EventWrite
EventWriteEx
EventWriteString
EventWriteTransfer
ExitProcess
ExitThread
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FatalAppExitA
FatalAppExitW
FatalExit
FileEncryptionStatusA
FileEncryptionStatusW
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FillConsoleOutputCharacterW
FindActCtxSectionGuid
FindActCtxSectionStringA
FindActCtxSectionStringW
FindAtomA
FindAtomW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstFreeAce
FindFirstStreamW
FindFirstVolumeA
FindFirstVolumeMountPointA
FindFirstVolumeMountPointW
FindFirstVolumeW
FindNextChangeNotification
FindNextFileA
FindNextFileW
FindNextStreamW
FindNextVolumeA
FindNextVolumeMountPointA
FindNextVolumeMountPointW
FindNextVolumeW
FindResourceA
FindResourceExA
FindResourceExW
FindResourceW
FindStringOrdinal
FindVolumeClose
FindVolumeMountPointClose
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushConsoleInputBuffer
FlushFileBuffers
FlushInstructionCache
FlushProcessWriteBuffers
FlushTraceA
FlushTraceW
FlushViewOfFile
FoldStringA
FoldStringW
FormatMessageA
FormatMessageW
FreeConsole
FreeEncryptedFileKeyInfo
FreeEncryptionCertificateHashList
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeInheritedFromArray
FreeLibrary
FreeLibraryAndExitThread
FreeLibraryWhenCallbackReturns
FreeResource
FreeSid
FreeUserPhysicalPages
GenerateConsoleCtrlEvent
GetACP
GetAccessPermissionsForObjectA
GetAccessPermissionsForObjectW
GetAce
GetAclInformation
GetActiveProcessorCount
GetActiveProcessorGroupCount
GetAtomNameA
GetAtomNameW
GetAuditedPermissionsFromAclA
GetAuditedPermissionsFromAclW
GetBinaryType
GetBinaryTypeA
GetBinaryTypeW
GetCPInfo
GetCPInfoExA
GetCPInfoExW
GetCalendarInfoA
GetCalendarInfoEx
GetCalendarInfoW
GetCommConfig
GetCommMask
Sections
.text Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ