replprov.pdb
Static task
static1
Behavioral task
behavioral1
Sample
replprov.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
replprov.dll
Resource
win10v2004-20240802-en
General
-
Target
678c3ed10ddbda6a9b2f60453d9e5f4c7461456e3f938d8e0da9cacbd72fda0bN
-
Size
20KB
-
MD5
c9738bb5a3ff359ad1a2796bb48fef10
-
SHA1
8828635dee30c59d14ed33f912499a80df67bed0
-
SHA256
678c3ed10ddbda6a9b2f60453d9e5f4c7461456e3f938d8e0da9cacbd72fda0b
-
SHA512
c343ae164f17e132f7bb96e89b4cb1423b5ecdc39d69f71a5ee71a7a3c5f0624c24c25f7002369fd8f1399876e7d42c632451bfa7c92c865455362a44b954e3c
-
SSDEEP
384:pIrchrt/1dTaGASN9uMOEJVeACXgYx0grzdJ7Wq72B4+j8LzBWd3n:pICrp1dGGASNYMOEKyy0wXWqW4JzBQ3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/replprov.dll
Files
-
678c3ed10ddbda6a9b2f60453d9e5f4c7461456e3f938d8e0da9cacbd72fda0bN.cab
-
replprov.dll.dll regsvr32 windows:5 windows x86 arch:x86
ed002f2f661244610448b0ce6314517f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_ui64tow
swprintf
_wcsicmp
_purecall
??2@YAPAXI@Z
_initterm
malloc
_adjust_fdiv
??3@YAXPAX@Z
free
_except_handler3
wcslen
wcscpy
wcscat
_wtol
_wcsnicmp
wcsstr
atl
ord15
ord32
ord23
ord57
ord18
ord21
ord16
ord30
kernel32
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
Sleep
GetCurrentThreadId
UnhandledExceptionFilter
LoadLibraryA
GetSystemDirectoryA
GetLastError
GetComputerNameExW
IsBadWritePtr
IsBadReadPtr
IsBadStringPtrW
lstrcmpiW
FreeLibrary
FileTimeToSystemTime
FileTimeToLocalFileTime
GetProcAddress
lstrlenW
lstrcmpW
GetSystemWindowsDirectoryW
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
DisableThreadLibraryCalls
GetModuleFileNameW
QueryPerformanceCounter
GetTickCount
user32
wsprintfW
advapi32
RegSetValueExW
RegCreateKeyExW
ReportEventW
DeregisterEventSource
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegisterEventSourceW
ole32
CoImpersonateClient
CoCreateInstance
CoUninitialize
CoInitialize
CoRevertToSelf
oleaut32
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SysAllocStringLen
SysStringLen
VariantInit
SafeArrayGetElement
SafeArrayGetUBound
SysFreeString
SysAllocString
activeds
ord15
ord9
ord14
netapi32
I_NetLogonControl2
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
DsGetDcNameW
NetApiBufferFree
rpcrt4
UuidFromStringW
UuidToStringW
RpcStringFreeW
ntdsapi
DsReplicaSyncW
DsReplicaFreeInfo
DsUnBindA
DsBindW
DsReplicaGetInfoW
DsFreeNameResultW
DsCrackNamesW
DsUnBindW
DsReplicaConsistencyCheck
secur32
GetComputerObjectNameW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DoMofComp
Sections
.text Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ