iismap.pdb
Static task
static1
Behavioral task
behavioral1
Sample
iismap.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
iismap.dll
Resource
win10v2004-20240802-en
General
-
Target
1140c59b7ccdef6c0df15851f6faaa2da39486c1eea0304102c35862a487e900N
-
Size
24KB
-
MD5
851aa5e21daf28d83ef038591f0aa6b0
-
SHA1
0e60d9b1361fa5d3ba9fa3dffdb7259d14925a6f
-
SHA256
1140c59b7ccdef6c0df15851f6faaa2da39486c1eea0304102c35862a487e900
-
SHA512
a375e70badae08e07f824a70976df3d22e5108115460b8760776eb9554cb5ba7359584ab4bda663eea73e92e6afc461f883e2bd5f2bfba4d313542318bb82271
-
SSDEEP
768:RcLRT6opr/dAiYUICrF7y7ZWDyIKkRHZhKAyJU:uLR+QPYUIIyro5hl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/iismap.dll
Files
-
1140c59b7ccdef6c0df15851f6faaa2da39486c1eea0304102c35862a487e900N.cab
-
iismap.dll.dll windows:5 windows x86 arch:x86
651f4c9a4e8bf8ad311318edff60c8c2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
malloc
??3@YAXPAX@Z
fclose
fwrite
fopen
_adjust_fdiv
_initterm
free
_stricmp
strncpy
_memicmp
memchr
_itoa
??2@YAPAXI@Z
strchr
fread
bsearch
qsort
_ultoa
memmove
fgetc
fputs
fputc
wcslen
iisrtl
?ReadLock@CReaderWriterLock3@@QAEXXZ
?ReallocStorage@BUFFER@@AAEHI@Z
IISInitializeCriticalSection
PuDeleteDebugPrintsObject
PuCreateDebugPrintsObject
??1STRAU@@QAE@XZ
?QueryStrW@STRAU@@QAEPAGXZ
?AuxAppend@STRAU@@AAEHPBGIH@Z
?Copy@STRAU@@QAEHPBG@Z
?AuxAppend@STRAU@@AAEHPBDIH@Z
?Reset@STRAU@@QAEXXZ
??0BUFFER@@QAE@I@Z
??0STRAU@@QAE@XZ
PuDbgPrint
?WriteLock@CReaderWriterLock3@@QAEXXZ
?WriteUnlock@CReaderWriterLock3@@QAEXXZ
kernel32
FreeLibrary
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
LoadLibraryA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetVersionExA
GetCurrentThread
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
LocalReAlloc
GetFileSize
ReadFile
WriteFile
OutputDebugStringA
DeleteFileA
CreateFileA
CloseHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LocalAlloc
GetLastError
LocalFree
GetSystemTimeAsFileTime
SetLastError
advapi32
CryptDestroyHash
CryptCreateHash
CryptSetProvParam
CryptReleaseContext
CryptAcquireContextA
CryptDecrypt
CryptEncrypt
CryptGetUserKey
CryptVerifySignatureA
CryptImportKey
CryptExportKey
CryptHashData
CryptSignHashA
CryptDestroyKey
CryptGenKey
RegisterEventSourceA
ReportEventA
DeregisterEventSource
MD5Init
SetThreadToken
OpenThreadToken
MD5Update
MD5Final
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
ReportEventW
user32
wsprintfA
LoadStringA
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
crypt32
CertFreeCertificateContext
CertCreateCertificateContext
CertGetCertificateContextProperty
Exports
Exports
??0CAllocString@@QAE@XZ
??0CBlob@@QAE@XZ
??0CBlobXBF@@QAE@XZ
??0CCert11Mapping@@QAE@PAVCIisAcctMapper@@@Z
??0CCertGlobalRuleInfo@@QAE@XZ
??0CCertMapRule@@QAE@XZ
??0CDecodedCert@@QAE@PAU_CERT_CONTEXT@@@Z
??0CIisAcctMapper@@QAE@XZ
??0CIisCert11Mapper@@QAE@XZ
??0CIisRuleMapper@@QAE@XZ
??0CIssuerStore@@QAE@XZ
??0CPtrDwordXBF@@QAE@XZ
??0CPtrXBF@@QAE@XZ
??0CStoreXBF@@QAE@I@Z
??1CAllocString@@QAE@XZ
??1CBlob@@QAE@XZ
??1CBlobXBF@@QAE@XZ
??1CCert11Mapping@@QAE@XZ
??1CCertGlobalRuleInfo@@QAE@XZ
??1CCertMapRule@@QAE@XZ
??1CDecodedCert@@QAE@XZ
??1CIisAcctMapper@@QAE@XZ
??1CIisCert11Mapper@@QAE@XZ
??1CIisRuleMapper@@QAE@XZ
??1CIssuerStore@@QAE@XZ
??1CStoreXBF@@QAE@XZ
??1CStrPtrXBF@@QAE@XZ
??_FCStoreXBF@@QAEXXZ
?Add@CIisAcctMapper@@UAEHPAVCIisMapping@@H@Z
?AddEntry@CBlobXBF@@QAEKPAEK@Z
?AddEntry@CStrPtrXBF@@QAEKPAD@Z
?AddEx@CIisAcctMapper@@UAEKPAVCIisMapping@@@Z
?AddIssuerEntry@CCertMapRule@@QAEHPADH@Z
?AddPtr@CPtrDwordXBF@@QAEKK@Z
?AddPtr@CPtrXBF@@QAEKPAX@Z
?AddRule@CIisRuleMapper@@QAEKPAVCCertMapRule@@@Z
?AddRule@CIisRuleMapper@@QAEKXZ
?AddRuleElem@CCertMapRule@@QAEKKW4CERT_FIELD_ID@@PADPAEKK@Z
?AddRuleOrder@CCertGlobalRuleInfo@@QAEHXZ
?Append@CAllocString@@QAEHPAD@Z
?Append@CStoreXBF@@QAEHK@Z
?Append@CStoreXBF@@QAEHPAD@Z
?Append@CStoreXBF@@QAEHPAEK@Z
?AppendZ@CStoreXBF@@QAEHPAD@Z
?BinaryToMatchRequest@@YGHPAEKPAPAD@Z
?Clear@CStoreXBF@@QAEXXZ
?Clone@CIisMapping@@UAEHPAPAV1@@Z
?CloneEx@CIisMapping@@QAEHPAPAV1@PAPAD1PAK2I@Z
?Copy@CIisMapping@@QAEHPAV1@@Z
?Create@CIisAcctMapper@@QAEHXZ
?CreateNewMapping@CIisAcctMapper@@UAEPAVCIisMapping@@XZ
?CreateNewMapping@CIisCert11Mapper@@QAEPAVCIisMapping@@PAEK@Z
?CreateNewMapping@CIisCert11Mapper@@UAEPAVCIisMapping@@XZ
?DecreaseUse@CStoreXBF@@QAEHK@Z
?Delete@CIisAcctMapper@@QAEHKH@Z
?Delete@CIisAcctMapper@@QAEHXZ
?DeleteEntry@CBlobXBF@@QAEHK@Z
?DeleteEntry@CStrPtrXBF@@QAEHK@Z
?DeleteIssuerEntry@CCertMapRule@@QAEHK@Z
?DeletePtr@CPtrDwordXBF@@QAEHK@Z
?DeletePtr@CPtrXBF@@QAEHK@Z
?DeleteRule@CIisRuleMapper@@QAEHK@Z
?DeleteRuleById@CCertGlobalRuleInfo@@QAEHKH@Z
?DeleteRuleElem@CCertMapRule@@QAEHK@Z
?DeleteRuleElemsByField@CCertMapRule@@QAEHW4CERT_FIELD_ID@@@Z
?Deserialize@CIisMapping@@UAEHPAU_iobuf@@PAX1@Z
?EnumerateKnownSubFields@@YGPADK@Z
?FindMatch@CIisAcctMapper@@QAEHPAVCIisMapping@@PAPAV2@PAK@Z
?FlushAlternate@CIisAcctMapper@@QAEHH@Z
?FreeMatchConversion@@YGXPAX@Z
?Get@CAllocString@@QAEPADXZ
?Get@CBlob@@QAEPAEPAK@Z
?GetBlob@CBlobXBF@@QAEPAVCBlob@@K@Z
?GetBuff@CStoreXBF@@QAEPAEXZ
?GetEntry@CBlobXBF@@QAEHKPAPAEPAK@Z
?GetEntry@CStrPtrXBF@@QAEPADK@Z
?GetGlobalRulesInfo@CIisRuleMapper@@QAEPAVCCertGlobalRuleInfo@@XZ
?GetHierarchy@CIisAcctMapper@@QAEPAU_IISMDB_HEntry@@PAK@Z
?GetIdFlags@@YGKW4CERT_FIELD_ID@@@Z
?GetIssuer@CDecodedCert@@QAEHPAPAXPAK@Z
?GetIssuerCount@CCertMapRule@@QAEKXZ
?GetIssuerEntry@CCertMapRule@@QAEHKPAHPAPAD@Z
?GetIssuerEntryByName@CCertMapRule@@QAEHPADPAH@Z
?GetMapping@CIisAcctMapper@@QAEHKPAPAVCIisMapping@@HH@Z
?GetMappingCount@CIisAcctMapper@@QAEKXZ
?GetMatchAllIssuer@CCertMapRule@@QAEHXZ
?GetNbEntry@CBlobXBF@@QAEKXZ
?GetNbEntry@CStrPtrXBF@@QAEKXZ
?GetNbField@CIisMapping@@UAEIPAPAPAD@Z
?GetNbField@CIisMapping@@UAEIPAPAPADPAPAK@Z
?GetNbIssuers@CIssuerStore@@QAEKXZ
?GetNbMapping@CIisAcctMapper@@QAEKH@Z
?GetNbPtr@CPtrDwordXBF@@QAEKXZ
?GetNbPtr@CPtrXBF@@QAEKXZ
?GetOptions@CIisAcctMapper@@QAEKXZ
?GetPtr@CPtrDwordXBF@@QAEPAKK@Z
?GetPtr@CPtrXBF@@QAEPAXK@Z
?GetPtrAddr@CPtrXBF@@QAEPAXK@Z
?GetRule@CIisRuleMapper@@QAEPAVCCertMapRule@@K@Z
?GetRuleAccount@CCertMapRule@@QAEPADXZ
?GetRuleCount@CIisRuleMapper@@QAEKXZ
?GetRuleDenyAccess@CCertMapRule@@QAEHXZ
?GetRuleElem@CCertMapRule@@QAEHKPAW4CERT_FIELD_ID@@PAPADPAK12@Z
?GetRuleElemCount@CCertMapRule@@QAEKXZ
?GetRuleEnabled@CCertMapRule@@QAEHXZ
?GetRuleName@CCertMapRule@@QAEPADXZ
?GetRuleOrderArray@CCertGlobalRuleInfo@@QAEPAKXZ
?GetRuleOrderCount@CCertGlobalRuleInfo@@QAEKXZ
?GetRulePassword@CCertMapRule@@QAEPADXZ
?GetRulesEnabled@CCertGlobalRuleInfo@@QAEHXZ
?GetSubField@CDecodedCert@@QAEPAPAU_CERT_RDN_ATTR@@W4CERT_FIELD_ID@@PADPAK@Z
?GetUsed@CStoreXBF@@QAEKXZ
?IISuudecode@@YGHPADPAEPAKH@Z
?IISuuencode@@YGHPAEK0H@Z
?ImportIISCertMappingsToIIS6@@YGXXZ
?InitSet@CBlob@@QAEHPAEK@Z
?InsertEntry@CBlobXBF@@QAEKKPADK@Z
?InsertEntry@CStrPtrXBF@@QAEKKPAD@Z
?InsertPtr@CPtrDwordXBF@@QAEKKK@Z
?InsertPtr@CPtrXBF@@QAEKKPAX@Z
?IsValid@CCertGlobalRuleInfo@@QAEHXZ
?IsValid@CCertMapRule@@QAEHXZ
?IsValid@CIisRuleMapper@@QAEHXZ
?Load@CIisAcctMapper@@QAEHXZ
?Load@CStoreXBF@@QAEHPAX@Z
?Lock@CIisAcctMapper@@QAEXXZ
?MapAsn1ToSubField@@YGPADPAD@Z
?MapFieldToId@@YG?AW4CERT_FIELD_ID@@PAD@Z
?MapIdToField@@YGPADW4CERT_FIELD_ID@@@Z
?MapSubFieldToAsn1@@YGPADPAD@Z
?MappingGetField@CIisMapping@@UAEHKPAPAD@Z
?MappingGetField@CIisMapping@@UAEHKPAPAEPAKH@Z
?MappingGetFieldList@CIisAcctMapper@@QAEHPAPAU_IISMDB_Fields@@PAK@Z
?MappingSetField@CIisMapping@@UAEHKPAD@Z
?MappingSetField@CIisMapping@@UAEHKPAEKH@Z
?Match@CCertMapRule@@QAEHPAVCDecodedCert@@0PAD1PAH@Z
?Match@CIisRuleMapper@@QAEHPAU_CERT_CONTEXT@@0PAG1@Z
?MatchRequestToBinary@@YGHPADPAPAEPAK@Z
?Need@CStoreXBF@@QAEHK@Z
?ReadLockRules@CIisRuleMapper@@QAEXXZ
?ReadUnlockRules@CIisRuleMapper@@QAEXXZ
?ReportIisMapEvent@@YGHGKGPAPBD@Z
?ReportIisMapEventW@@YGHGKGPAPBG@Z
?Reset@CAllocString@@QAEXXZ
?Reset@CBlob@@QAEXXZ
?Reset@CBlobXBF@@QAEXXZ
?Reset@CCertGlobalRuleInfo@@QAEHXZ
?Reset@CCertMapRule@@QAEXXZ
?Reset@CIisAcctMapper@@QAEHXZ
?Reset@CIisRuleMapper@@QAEHXZ
?Reset@CIssuerStore@@QAEXXZ
?Reset@CStoreXBF@@QAEXXZ
?Save@CIisAcctMapper@@QAEHXZ
?Save@CStoreXBF@@QAEHPAX@Z
?Serialize@CAllocString@@QAEHPAVCStoreXBF@@@Z
?Serialize@CBlob@@QAEHPAVCStoreXBF@@@Z
?Serialize@CBlobXBF@@QAEHPAVCStoreXBF@@@Z
?Serialize@CCertMapRule@@QAEHPAVCStoreXBF@@@Z
?Serialize@CIisAcctMapper@@QAEHPAVCStoreXBF@@@Z
?Serialize@CIisAcctMapper@@QAEHXZ
?Serialize@CIisMapping@@UAEHPAU_iobuf@@PAX1@Z
?Serialize@CIisRuleMapper@@QAEHPAVCStoreXBF@@@Z
?Serialize@CIssuerStore@@QAEHPAVCStoreXBF@@@Z
?Serialize@CPtrDwordXBF@@QAEHPAVCStoreXBF@@@Z
?Serialize@CPtrXBF@@QAEHPAVCStoreXBF@@@Z
?Serialize@CStrPtrXBF@@QAEHPAVCStoreXBF@@@Z
?SerializeGlobalRuleInfo@CCertGlobalRuleInfo@@QAEHPAVCStoreXBF@@@Z
?Set@CAllocString@@QAEHPAD@Z
?Set@CBlob@@QAEHPAEK@Z
?SetEntry@CBlobXBF@@QAEHKPAEK@Z
?SetEntry@CStrPtrXBF@@QAEHKPAD@Z
?SetIssuerEntryAcceptStatus@CCertMapRule@@QAEHKH@Z
?SetMatchAllIssuer@CCertMapRule@@QAEXH@Z
?SetPtr@CPtrDwordXBF@@QAEHKK@Z
?SetPtr@CPtrXBF@@QAEHKPAX@Z
?SetRuleAccount@CCertMapRule@@QAEHPAD@Z
?SetRuleDenyAccess@CCertMapRule@@QAEXH@Z
?SetRuleEnabled@CCertMapRule@@QAEXH@Z
?SetRuleName@CCertMapRule@@QAEHPAD@Z
?SetRulePassword@CCertMapRule@@QAEHPAD@Z
?SetRulesEnabled@CCertGlobalRuleInfo@@QAEXH@Z
?Unlock@CIisAcctMapper@@QAEXXZ
?Unserialize@CAllocString@@QAEHPAPAEPAK@Z
?Unserialize@CBlob@@QAEHPAPAEPAK@Z
?Unserialize@CBlobXBF@@QAEHPAPAEPAKK@Z
?Unserialize@CCertMapRule@@QAEHPAPAEPAK@Z
?Unserialize@CCertMapRule@@QAEHPAVCStoreXBF@@@Z
?Unserialize@CIisAcctMapper@@QAEHPAPAEPAK@Z
?Unserialize@CIisAcctMapper@@QAEHPAVCStoreXBF@@@Z
?Unserialize@CIisAcctMapper@@QAEHXZ
?Unserialize@CIisRuleMapper@@QAEHPAPAEPAK@Z
?Unserialize@CIisRuleMapper@@QAEHPAVCStoreXBF@@@Z
?Unserialize@CIssuerStore@@QAEHPAPAEPAK@Z
?Unserialize@CIssuerStore@@QAEHPAVCStoreXBF@@@Z
?Unserialize@CPtrDwordXBF@@QAEHPAPAEPAKK@Z
?Unserialize@CPtrXBF@@QAEHPAPAEPAKK@Z
?Unserialize@CStrPtrXBF@@QAEHPAPAEPAKK@Z
?UnserializeGlobalRuleInfo@CCertGlobalRuleInfo@@QAEHPAPAEPAK@Z
?Update@CIisAcctMapper@@QAEHK@Z
?Update@CIisAcctMapper@@QAEHKPAVCIisMapping@@@Z
?UpdateClasses@CIisAcctMapper@@QAEHH@Z
?UpdateHierarchy@CIisAcctMapper@@QAEHXZ
?UpdateMask@CIisMapping@@QAEHPAU_IISMDB_HEntry@@K@Z
?WriteLockRules@CIisRuleMapper@@QAEXXZ
?WriteUnlockRules@CIisRuleMapper@@QAEXXZ
Sections
.text Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ