J:\TeamsVDI\out\vxme-win\WebexTeams\citrixplugin\x86\release\bin\CiscoTeamsVirtualChannel.dll.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ff5bef5bc6a37af813010fbf65b9f470N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ff5bef5bc6a37af813010fbf65b9f470N.dll
Resource
win10v2004-20240802-en
General
-
Target
ff5bef5bc6a37af813010fbf65b9f470N.exe
-
Size
1.5MB
-
MD5
ff5bef5bc6a37af813010fbf65b9f470
-
SHA1
92a81390c6fc694b48364afcc8a9898e3600bc16
-
SHA256
766d45108b453a7efb1c63a80bdfcd2784bbfb730fe5c0971ab68ebf3e345109
-
SHA512
79991d76123f7f3f458c905e01e8fbb7cc621892b389fe97d7df0b7d804c16626404479e4422cebd7fa8fd0e25b7784884c38250e304327da643613620b4e064
-
SSDEEP
24576:/8DpJCGFXLxo15Xyfsf+fee5p184Pr1HLOkVyLP7E8Lr19Ei+sh/7mFJ3ckEJ8:1TWfee5kerZLOkALP7fiiHhDisW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ff5bef5bc6a37af813010fbf65b9f470N.exe
Files
-
ff5bef5bc6a37af813010fbf65b9f470N.exe.dll windows:6 windows x86 arch:x86
53512c318284717d24e486934433964b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetStringTypeW
GetCPInfo
ResetEvent
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
QueryPerformanceCounter
GetExitCodeThread
GetCurrentThread
SwitchToThread
GetCurrentProcess
WaitForSingleObjectEx
DuplicateHandle
GetCurrentThreadId
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
Sleep
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetLastError
GetCurrentProcessId
GetTickCount
CreateEventA
WaitForSingleObject
SetEvent
CloseHandle
CreateFileW
WriteConsoleW
MultiByteToWideChar
GetLocaleInfoW
RaiseException
RtlUnwind
ExitThread
GetModuleHandleExW
ExitProcess
HeapAlloc
HeapFree
GetStdHandle
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetStdHandle
HeapSize
Exports
Exports
AlphaBlend
_ChannelActive@4
_GetClientWindowHandleFromServerWindowHandle_@4
_GetICAWindowInfo_@0
_InitialiseChannel@12
_IsSeamlessMode_@0
_LogMessage_VDI@8
_MutexCreate@0
_MutexDestroy@4
_MutexLock@4
_MutexTryLock@4
_MutexUnlock@4
_PluginThreadCreate@4
_PluginThreadDestroy@0
_ReceiveData@8
_SetGetClientWindowHandleFromServerWindowHandleFunc@4
_SetGetWindowInfoFunc@4
_SetIsSeamlessModeFunc@4
_Shutdown@0
_getChannelName@0
Sections
.text Size: 554KB - Virtual size: 556KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 137KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 869KB - Virtual size: 869KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ