TTPnpins.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd.dll
Resource
win10v2004-20241007-en
General
-
Target
a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd
-
Size
676KB
-
MD5
3a326af7f81639f667ee14de69537a21
-
SHA1
66c8fed72543d4c155411dc08dd21e615e2dec8d
-
SHA256
a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd
-
SHA512
15c4efe13cfedba6e9def41216acb062cae4ae59338c1878ce97507c980b771c2b332d34885ece2444e0210e7f21e79cbbb57ecf1a111e3e0f8939749c27de4f
-
SSDEEP
6144:R34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTa:RIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd
Files
-
a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd.dll windows:5 windows x64 arch:x64
6bd45a7f6736c7032f1cc8ae9fa751af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
comdlg32
GetSaveFileNameW
wininet
GetUrlCacheEntryInfoW
setupapi
CM_Get_Sibling_Ex
advapi32
RegEnumValueW
SaferCreateLevel
Exports
Exports
CopyPropVariant
CreatePropVariant
CreatePropertyStore
DestroyPropVariant
FormatTagFromWfx
GetAMSubtypeFromD3DFormat
GetD3DFormatFromMFSubtype
MFAddPeriodicCallback
MFAllocateSerialWorkQueue
MFAllocateWorkQueue
MFAllocateWorkQueueEx
MFAppendCollection
MFAverageTimePerFrameToFrameRate
MFBeginCreateFile
MFBeginGetHostByName
MFBeginRegisterWorkQueueWithMMCSS
MFBeginRegisterWorkQueueWithMMCSSEx
MFBeginUnregisterWorkQueueWithMMCSS
MFCalculateBitmapImageSize
MFCalculateImageSize
MFCallStackTracingClearSnapshot
MFCallStackTracingLogSessionErrors
MFCallStackTracingRestoreSnapshot
MFCallStackTracingTakeSnapshot
MFCancelCreateFile
MFCancelWorkItem
MFCheckEnabledViaAppService
MFClearLocalMFTs
MFCombineSamples
MFCompareFullToPartialMediaType
MFCompareSockaddrAddresses
MFConvertColorInfoFromDXVA
MFConvertColorInfoToDXVA
MFConvertFromFP16Array
MFConvertToFP16Array
MFCopyImage
MFCreate2DMediaBuffer
MFCreate2DMediaBufferOn1DMediaBuffer
MFCreateAMMediaTypeFromMFMediaType
MFCreateAlignedMemoryBuffer
MFCreateAlignedSharedMemoryBuffer
MFCreateAsyncResult
MFCreateAttributes
MFCreateAudioMediaType
MFCreateByteStreamHandlerAppServiceActivate
MFCreateCollection
MFCreateContentDecryptorContext
MFCreateContentProtectionDevice
MFCreateD3D12SynchronizationObject
MFCreateDXGIDeviceManager
MFCreateDXGISurfaceBuffer
MFCreateDXSurfaceBuffer
MFCreateEMEStoreObject
MFCreateEventQueue
MFCreateFile
MFCreateFileFromHandle
MFCreateLegacyMediaBufferOnMFMediaBuffer
MFCreateMFByteStreamOnIStreamWithFlags
MFCreateMFByteStreamOnStream
MFCreateMFByteStreamOnStreamEx
MFCreateMFByteStreamWrapper
MFCreateMFVideoFormatFromMFMediaType
MFCreateMediaBufferFromMediaType
MFCreateMediaBufferWrapper
MFCreateMediaEvent
MFCreateMediaEventResult
MFCreateMediaExtensionActivate
MFCreateMediaExtensionActivateNoInit
MFCreateMediaExtensionAppServiceActivate
MFCreateMediaExtensionInprocActivate
MFCreateMediaType
MFCreateMediaTypeFromProperties
MFCreateMediaTypeFromRepresentation
MFCreateMemoryBuffer
MFCreateMemoryBufferFromRawBuffer
MFCreateMemoryStream
MFCreateMuxStreamAttributes
MFCreateMuxStreamMediaType
MFCreateMuxStreamSample
MFCreateOOPMFTProxy
MFCreateOOPMFTRemote
MFCreatePathFromURL
MFCreatePresentationDescriptor
MFCreatePropertiesFromMediaType
MFCreateReusableByteStream
MFCreateReusableByteStreamWithSharedLock
MFCreateSample
MFCreateSecureBufferAllocator
MFCreateSharedMemoryMediaBufferFromMediaType
MFCreateSocket
MFCreateSocketListener
MFCreateSourceResolver
MFCreateSourceResolverInternal
MFCreateStagingSurfaceWrapper
MFCreateStreamDescriptor
MFCreateStreamOnMFByteStream
MFCreateStreamOnMFByteStreamEx
MFCreateSystemTimeSource
MFCreateTelemetrySession
MFCreateTempFile
MFCreateTrackedSample
MFCreateTransformActivate
MFCreateURLFromPath
MFCreateUdpSockets
MFCreateVideoDecryptorContext
MFCreateVideoMediaType
MFCreateVideoMediaTypeFromBitMapInfoHeader
MFCreateVideoMediaTypeFromBitMapInfoHeaderEx
MFCreateVideoMediaTypeFromSubtype
MFCreateVideoMediaTypeFromVideoInfoHeader
MFCreateVideoMediaTypeFromVideoInfoHeader2
MFCreateVideoSampleAllocatorEx
MFCreateWICBitmapBuffer
MFCreateWICDecoderProxy
MFCreateWaveFormatExFromMFMediaType
MFDeserializeAttributesFromStream
MFDeserializeEvent
MFDeserializeMediaTypeFromStream
MFDeserializePresentationDescriptor
MFEndCreateFile
MFEndGetHostByName
MFEndRegisterWorkQueueWithMMCSS
MFEndUnregisterWorkQueueWithMMCSS
MFEnumLocalMFTRegistrations
MFFrameRateToAverageTimePerFrame
MFFreeAdaptersAddresses
MFGetAdaptersAddresses
MFGetAttributesAsBlob
MFGetAttributesAsBlobSize
MFGetCallStackTracingWeakReference
MFGetConfigurationDWORD
MFGetConfigurationPolicy
MFGetConfigurationStore
MFGetConfigurationString
MFGetContentProtectionSystemCLSID
MFGetMFTMerit
MFGetNumericNameFromSockaddr
MFGetPlaneSize
MFGetPlatformFlags
MFGetPlatformVersion
MFGetPluginControl
MFGetRandomNumber
MFGetSockaddrFromNumericName
MFGetStrideForBitmapInfoHeader
MFGetSupportedMimeTypes
MFGetSupportedSchemes
MFGetSystemTime
MFGetTimerPeriodicity
MFGetUncompressedVideoFormat
MFGetWorkQueueMMCSSClass
MFGetWorkQueueMMCSSPriority
MFGetWorkQueueMMCSSTaskId
MFHasLocallyRegisteredByteStreamHandlers
MFHasLocallyRegisteredSchemeHandlers
MFHeapAlloc
MFHeapFree
MFInitAMMediaTypeFromMFMediaType
MFInitAttributesFromBlob
MFInitMediaTypeFromAMMediaType
MFInitMediaTypeFromMFVideoFormat
MFInitMediaTypeFromMPEG1VideoInfo
MFInitMediaTypeFromMPEG2VideoInfo
MFInitMediaTypeFromVideoInfoHeader
MFInitMediaTypeFromVideoInfoHeader2
MFInitMediaTypeFromWaveFormatEx
MFInitVideoFormat
MFInitVideoFormat_RGB
MFInvalidateMFTEnumCache
MFInvokeCallback
MFIsBottomUpFormat
MFIsContentProtectionDeviceSupported
MFIsFeatureEnabled
MFIsLocallyRegisteredMimeType
MFIsLocallyRegisteredSchemeHandler
MFJoinWorkQueue
MFLockDXGIDeviceManager
MFLockPlatform
MFLockSharedWorkQueue
MFLockWorkQueue
MFMapDX9FormatToDXGIFormat
MFMapDXGIFormatToDX9Format
MFPlatformBigEndian
MFPlatformLittleEndian
MFPutWaitingWorkItem
MFPutWorkItem
MFPutWorkItem2
MFPutWorkItemEx
MFPutWorkItemEx2
MFRegisterLocalByteStreamHandler
MFRegisterLocalSchemeHandler
MFRegisterPlatformWithMMCSS
MFRemovePeriodicCallback
MFScheduleWorkItem
MFScheduleWorkItemEx
MFSerializeAttributesToStream
MFSerializeEvent
MFSerializeMediaTypeToStream
MFSerializePresentationDescriptor
MFSetMinimumMemoryAlignment
MFSetSockaddrAny
MFSetWindowForContentProtection
MFShutdown
MFSplitSample
MFStartup
MFStreamDescriptorProtectMediaType
MFTEnum
MFTEnum2
MFTEnumEx
MFTGetInfo
MFTRegister
MFTRegisterLocal
MFTRegisterLocalByCLSID
MFTUnregister
MFTUnregisterLocal
MFTUnregisterLocalByCLSID
MFTraceError
MFTraceFuncEnter
MFUnjoinWorkQueue
MFUnlockDXGIDeviceManager
MFUnlockPlatform
MFUnlockWorkQueue
MFUnregisterPlatformFromMMCSS
MFUnwrapMediaType
MFValidateMediaTypeSize
MFWrapMediaType
MFWrapSocket
MFllMulDiv
PropVariantFromStream
PropVariantToStream
ValidateWaveFormat
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 524KB - Virtual size: 520KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 312B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.rsrc Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 905B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 318B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ