D:\pub_a3lj\rc_bug_mas_v12_2407\Build\Release\WPSOffice\office6\qingshellext.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5e32aa95c424f74cdcf5d9d1e7cfcc0d19b5162fe1efe4430b20f7fb447fb1fe.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5e32aa95c424f74cdcf5d9d1e7cfcc0d19b5162fe1efe4430b20f7fb447fb1fe.dll
Resource
win10v2004-20240802-en
General
-
Target
5e32aa95c424f74cdcf5d9d1e7cfcc0d19b5162fe1efe4430b20f7fb447fb1fe
-
Size
637KB
-
MD5
fd0e9ec60c0238781bf8c5d6f79acd3f
-
SHA1
44abfba42b195f0c2d64f2b009ad7c29211a07be
-
SHA256
5e32aa95c424f74cdcf5d9d1e7cfcc0d19b5162fe1efe4430b20f7fb447fb1fe
-
SHA512
76c322348b46873740f84bdb53579da9acb8418e5359d8a175702e5986138c3fb2de160a383b00570ba4ef72052a931d635415f07012a74e7fa92912e63bae8f
-
SSDEEP
12288:axbhkZwhsyehO5Z/eqNqtGGUvGrRPQCFrYvmri9g7AioMK:1hVHqwoGri9y/oM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e32aa95c424f74cdcf5d9d1e7cfcc0d19b5162fe1efe4430b20f7fb447fb1fe
Files
-
5e32aa95c424f74cdcf5d9d1e7cfcc0d19b5162fe1efe4430b20f7fb447fb1fe.dll regsvr32 windows:5 windows x86 arch:x86
bb5836228ce287d20a0df5290de388ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DisableThreadLibraryCalls
OutputDebugStringW
EncodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
FindResourceExW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
CreateFileW
ReadFile
WriteFile
CloseHandle
SetNamedPipeHandleState
WaitNamedPipeW
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
lstrcmpiW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetTempFileNameW
SetFileAttributesW
SetFilePointer
GetTempPathW
OpenMutexW
GetProcessId
LocalFree
Sleep
InitializeCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
TerminateThread
GetCurrentThreadId
GetSystemWow64DirectoryW
GlobalUnlock
GlobalLock
VerSetConditionMask
GetFileAttributesW
VerifyVersionInfoW
FreeResource
GlobalAlloc
GlobalFree
MulDiv
GetDriveTypeW
DeviceIoControl
GetModuleHandleExW
LoadLibraryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ReleaseMutex
CreateMutexW
VirtualQuery
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GetSystemInfo
VirtualProtect
LoadLibraryExA
GetCommandLineW
GetSystemDirectoryW
lstrlenW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetUserDefaultUILanguage
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
ProcessIdToSessionId
OpenProcess
GetLongPathNameW
CreateFileA
CreateThread
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
LCMapStringEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCPInfo
IsDebuggerPresent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitThread
FreeLibraryAndExitThread
VirtualAlloc
ExitProcess
GetStdHandle
GetFileType
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetConsoleCP
SetEndOfFile
WriteConsoleW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 434KB - Virtual size: 434KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ