bdechangepin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bdechangepin.exe
Resource
win10v2004-20240802-en
General
-
Target
bdechangepin.exe
-
Size
375KB
-
MD5
5e971d10cd2bd587f2668d8abba40e34
-
SHA1
99c30a2bb8c373d80f411cc94cea8987baaf0fe1
-
SHA256
fe9efa4156d8564d33bb96b2739f01b7a90a1de192b8721e8bef1486a8e00b42
-
SHA512
16bae76f23a9a53aef6fcb59014b92426b13dc9a5cf72339b91d99abf3ec36530c82564e26de9970768c4cb173cfe7822b4696ef7c706d7c5813102d7e81b6af
-
SSDEEP
6144:9uv3IHVxHEVHHHQVb1kHVqHVqHQQ9T8TXT5ThT2HVfkXTWT6TITQTMVyW176eIsy:qH+S+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bdechangepin.exe
Files
-
bdechangepin.exe.exe windows:10 windows x64 arch:x64
ba4b1fe51a18b04d0b300a89c7d36c5e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
Sleep
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemWindowsDirectoryW
VerSetConditionMask
GetFileAttributesW
CreateEventW
RtlCompareMemory
GetModuleFileNameA
LocalAlloc
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
HeapFree
HeapAlloc
GetProcessHeap
GetModuleHandleW
GetCommandLineW
CreateMutexW
CloseHandle
WaitForSingleObject
LocalFree
GetLastError
FormatMessageW
user32
GetActiveWindow
NotifyWinEvent
PostMessageW
SendMessageW
InvalidateRect
FindWindowW
LoadImageW
GetSystemMetrics
LoadStringW
SetForegroundWindow
msvcrt
free
towupper
iswalpha
_vsnwprintf
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_wcmdln
_fmode
toupper
__CxxFrameHandler3
??1type_info@@UEAA@XZ
_commode
memset
memmove
memcpy
_callnewh
wcscmp
malloc
?terminate@@YAXXZ
shell32
CommandLineToArgvW
ShellExecuteW
ShellExecuteExW
ole32
CoInitialize
CoCreateInstance
CoUninitialize
ntdll
RtlCheckPortableOperatingSystem
RtlVerifyVersionInfo
RtlNtStatusToDosError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
comctl32
ord344
dui70
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?OnPropertyChanged@Edit@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
??0HWNDElement@DirectUI@@QEAA@XZ
??1HWNDElement@DirectUI@@UEAA@XZ
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
StrToID
?Initialize@HWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
?Click@Button@DirectUI@@SA?AVUID@@XZ
?OnEvent@HWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnInput@HWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
InitProcessPriv
InitThread
?Create@NativeHWNDHost@DirectUI@@SAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHIPEAPEAV12@@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z
?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z
StartMessagePump
UnInitThread
UnInitProcessPriv
?Register@HWNDElement@DirectUI@@SAJXZ
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
??1CritSecLock@DirectUI@@QEAA@XZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?Register@Edit@DirectUI@@SAJXZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Initialize@Edit@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@Edit@DirectUI@@SAPEAUIClassInfo@2@XZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@_N@Z
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnNotify@Edit@DirectUI@@UEAA_NI_K_JPEA_J@Z
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?MessageCallback@Edit@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetContentSize@Edit@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnInput@Edit@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetContentStringAsDisplayed@Edit@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?IsContentProtected@Edit@DirectUI@@UEAA_NXZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
??1Edit@DirectUI@@UEAA@XZ
??0Edit@DirectUI@@QEAA@XZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z
?OnDestroy@HWNDElement@DirectUI@@UEAAXXZ
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?UpdateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z
?RemoveTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?GetClassInfoW@HWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ
?IsMSAAEnabled@HWNDElement@DirectUI@@UEAA_NXZ
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z
?WndProc@HWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z
?_OnUIStateChanged@HWNDElement@DirectUI@@MEAAXGG@Z
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
bdeui
??0BuiVolume@@QEAA@XZ
??1BuiVolume@@QEAA@XZ
?Init@BuiVolume@@QEAAJPEAG@Z
?IsCurrentPINEnhanced@BuiVolume@@QEAAJPEAH@Z
advapi32
RegGetValueW
RegCloseKey
RegOpenKeyExW
EventWriteTransfer
AllocateAndInitializeSid
FreeSid
EventProviderEnabled
RegUnLoadKeyW
RegLoadKeyW
EventSetInformation
EventRegister
EventUnregister
rpcrt4
NdrClientCall3
RpcBindingFromStringBindingW
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
Exports
Exports
??0VolumeFveStatus@@IEAA@XZ
??0VolumeFveStatus@@QEAA@K_KJW4_FVE_WIPING_STATE@@@Z
??4BuiVolume@@QEAAAEAV0@AEBV0@@Z
??4VolumeFveStatus@@QEAAAEAV0@$$QEAV0@@Z
??4VolumeFveStatus@@QEAAAEAV0@AEBV0@@Z
?FailedDryRun@VolumeFveStatus@@QEBA_NXZ
?GetExtendedFlags@VolumeFveStatus@@QEBA_KXZ
?GetLastConvertStatus@VolumeFveStatus@@QEBAJXZ
?GetStatusFlags@VolumeFveStatus@@QEBAKXZ
?HasExternalKey@VolumeFveStatus@@QEBA_NXZ
?HasPBKDF2RecoveryPassword@VolumeFveStatus@@QEBA_NXZ
?HasPassphraseProtector@VolumeFveStatus@@QEBA_NXZ
?HasPinProtector@VolumeFveStatus@@QEBA_NXZ
?HasRecoveryData@VolumeFveStatus@@QEBA_NXZ
?HasRecoveryPassword@VolumeFveStatus@@QEBA_NXZ
?HasSmartCardProtector@VolumeFveStatus@@QEBA_NXZ
?HasStartupKeyProtector@VolumeFveStatus@@QEBA_NXZ
?HasTpmProtector@VolumeFveStatus@@QEBA_NXZ
?IsConverting@VolumeFveStatus@@QEBA_NXZ
?IsCsvMetadataVolume@VolumeFveStatus@@QEBA_NXZ
?IsDEAutoProvisioned@VolumeFveStatus@@QEBA_NXZ
?IsDecrypted@VolumeFveStatus@@QEBA_NXZ
?IsDecrypting@VolumeFveStatus@@QEBA_NXZ
?IsDisabled@VolumeFveStatus@@QEBA_NXZ
?IsEDriveVolume@VolumeFveStatus@@QEBA_NXZ
?IsEncrypted@VolumeFveStatus@@QEBA_NXZ
?IsEncrypting@VolumeFveStatus@@QEBA_NXZ
?IsLocked@VolumeFveStatus@@QEBA_NXZ
?IsOn@VolumeFveStatus@@QEBA_NXZ
?IsOsCriticalVolume@VolumeFveStatus@@QEBA_NXZ
?IsOsVolume@VolumeFveStatus@@QEBA_NXZ
?IsPartiallyConverted@VolumeFveStatus@@QEBA_NXZ
?IsPaused@VolumeFveStatus@@QEBA_NXZ
?IsPreProvisioned@VolumeFveStatus@@QEBA_NXZ
?IsRoamingDevice@VolumeFveStatus@@QEBA_NXZ
?IsSecure@VolumeFveStatus@@QEBA_NXZ
?IsUnknownFveVersion@VolumeFveStatus@@QEBA_NXZ
?IsWiping@VolumeFveStatus@@QEBA_NXZ
?NO_DRIVE_LETTER@BuiVolume@@2IB
?NeedsRestart@VolumeFveStatus@@QEBA_NXZ
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 302KB - Virtual size: 302KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 964B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ