els.pdb
Static task
static1
Behavioral task
behavioral1
Sample
els.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
els.dll
Resource
win10v2004-20240802-en
General
-
Target
ded2f768e6464936ba3adbc8e2d9b7095e72948acba84b63700ca7376189c686N
-
Size
78KB
-
MD5
ef9c721102ed287533aca63f8887f9d0
-
SHA1
36abddc532ec366e7718e10b4afad41b1e52a846
-
SHA256
ded2f768e6464936ba3adbc8e2d9b7095e72948acba84b63700ca7376189c686
-
SHA512
3765d8bb024dd326072242c22b4d37e55c92b3811e121f3bdf7edea69bfb11cd55d6722b81928b52deb828230b3515edc27d5be5eb982e648c58df03d56c3150
-
SSDEEP
1536:VoWUzlo3FXgauDliHjxi4oFGiXEhlK8rwkD7SmfZBnFHM+zZn6WaMxbg0XznV5fc:WUFXgJqWkiUhl7rwkKmfDndV69m86zjE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/els.dll
Files
-
ded2f768e6464936ba3adbc8e2d9b7095e72948acba84b63700ca7376189c686N.cab
-
els.dll.dll regsvr32 windows:5 windows x86 arch:x86
be9b20e74fe2ff054dfc1a85ae8770d1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_wcslwr
??2@YAPAXI@Z
__CxxFrameHandler
wcscpy
_except_handler3
_wcsicmp
_wcsupr
wcschr
_wcsnicmp
wcscat
wcsstr
wcslen
wcspbrk
wcsncmp
?terminate@@YAXXZ
_onexit
__dllonexit
_adjust_fdiv
_initterm
_vsnwprintf
towlower
wcsspn
??3@YAXPAX@Z
qsort
wcsncpy
_ultow
_itow
wcsrchr
_snwprintf
malloc
free
wcstoul
memmove
msvcp60
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPAGII@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?_Xran@std@@YAXXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGPAG@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGIABV?$allocator@G@1@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIIG@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z
?_Xlen@std@@YAXXZ
ntdll
RtlSecondsSince1970ToTime
RtlTimeToSecondsSince1970
RtlLengthSid
advapi32
RegConnectRegistryW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
IsValidSid
ClearEventLogW
ReadEventLogW
OpenBackupEventLogW
OpenEventLogW
GetOldestEventLogRecord
GetNumberOfEventLogRecords
CloseEventLog
BackupEventLogW
ConvertStringSidToSidW
LookupAccountSidW
GetLengthSid
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegGetValueW
EqualSid
kernel32
GetFileAttributesExW
DeleteFileW
GetCommandLineW
CreateThread
CloseHandle
GetLocalTime
GetTimeZoneInformation
GetProcessHeap
HeapAlloc
FileTimeToLocalFileTime
GetWindowsDirectoryW
WideCharToMultiByte
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTickCount
GetLocaleInfoW
IsBadStringPtrW
LocalAlloc
IsBadReadPtr
WriteFile
GlobalLock
GlobalUnlock
GlobalFree
OutputDebugStringA
GetModuleFileNameW
SetLastError
lstrcpynW
LocalFileTimeToFileTime
SystemTimeToFileTime
GetComputerNameW
GetDriveTypeW
GetCurrentThreadId
LoadLibraryExW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetFileSize
CreateFileW
GetDateFormatW
GetTimeFormatW
lstrcatW
GlobalAlloc
FileTimeToSystemTime
HeapFree
GetUserDefaultLCID
InterlockedIncrement
GetLastError
InterlockedDecrement
LocalFree
lstrcmpiW
lstrcmpW
FreeLibrary
FormatMessageW
ExpandEnvironmentStringsW
lstrcpyW
lstrlenW
LoadLibraryA
LoadLibraryW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetSystemWindowsDirectoryW
user32
IsWindowEnabled
EnumThreadWindows
GetClassNameW
WinHelpW
DefWindowProcW
CreateWindowExW
RegisterClassW
LoadStringW
GetDlgItemInt
LoadIconW
LoadImageW
LoadBitmapW
SetCursor
LoadCursorW
wsprintfW
SendMessageW
GetDlgItemTextW
GetParent
RegisterClipboardFormatW
SetWindowTextW
GetDlgItem
SetWindowLongW
FindWindowExW
SetWindowPos
SetDlgItemInt
SetForegroundWindow
DestroyIcon
MessageBoxW
GetSysColor
EnableWindow
CloseClipboard
SetClipboardData
IsDlgButtonChecked
EmptyClipboard
OpenClipboard
ShowWindow
SetDlgItemTextW
SetFocus
GetFocus
GetSystemMetrics
ReleaseDC
GetDC
GetWindowRect
CheckRadioButton
PostMessageW
DestroyWindow
GetWindowLongW
CreateDialogParamW
DialogBoxParamW
EndDialog
GetClientRect
CharLowerBuffW
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
PostQuitMessage
GetWindow
CheckDlgButton
GetWindowTextLengthW
GetWindowTextW
gdi32
CreateFontIndirectW
GetMapMode
SetMapMode
GetTextMetricsW
DeleteObject
GetObjectW
ole32
CoTaskMemAlloc
CoMarshalInterThreadInterfaceInStream
CreateStreamOnHGlobal
CoGetInterfaceAndReleaseStream
IIDFromString
CoUninitialize
CoInitialize
ReleaseStgMedium
CoCreateInstance
rpcrt4
NdrOleFree
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_CountRefs
IUnknown_AddRef_Proxy
CStdStubBuffer_Disconnect
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
NdrDllGetClassObject
NdrCStdStubBuffer_Release
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_DebugServerQueryInterface
IUnknown_QueryInterface_Proxy
NdrOleAllocate
netapi32
NetApiBufferFree
I_NetNameValidate
NetShareGetInfo
DsRoleGetPrimaryDomainInformation
DsGetDcNameW
I_NetNameCanonicalize
DsRoleFreeMemory
NetWkstaGetInfo
shlwapi
PathRemoveBlanksW
PathCombineW
wnsprintfW
shell32
ShellExecuteW
CommandLineToArgvW
ntdsapi
DsMapSchemaGuidsW
DsBindW
DsFreeNameResultW
DsCrackNamesW
DsFreeSchemaGuidMapW
DsUnBindW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
activeds
ord9
ord20
ord15
mpr
WNetGetUniversalNameW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ