PluginRegisterCallbacks
VncStartServer
VncStopServer
Static task
static1
Behavioral task
behavioral1
Sample
7fe6c2028f8d53ce4f2bd5252d7d5f97226fc92231b07e6d55e9b1a12b3c55c3.dll
Resource
win7-20220718-en
Target
7fe6c2028f8d53ce4f2bd5252d7d5f97226fc92231b07e6d55e9b1a12b3c55c3
Size
206KB
MD5
1d6c784c236b7bb569f473f2d875d2ed
SHA1
45a131931d171a66184a7194b095f3e25f3b851c
SHA256
7fe6c2028f8d53ce4f2bd5252d7d5f97226fc92231b07e6d55e9b1a12b3c55c3
SHA512
e60fd6c4c530472fad613daec2c5f5d21c74b86dc921b5752ac3e935046dc138d61d8ef4f86198c84c507ca9fd4278012a7dd4966626a2045cedbde47b56a277
SSDEEP
3072:B15nr2ekaJZ/xvwLHhfN3WTTiUBDew8PXA18CxwAgkYaXvXRQ/tnw5gKpfJgv:B1RZ/xvYkKUBaBPVCTfYaXvX6wbVO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
RtlEqualUnicodeString
memcmp
_strupr
strcpy
memset
ZwQueryInformationProcess
ZwQueryKey
NtResumeProcess
NtGetContextThread
NtSuspendProcess
NtSetContextThread
RtlNtStatusToDosError
_wcsnicmp
LdrFindEntryForAddress
ZwClose
NtMapViewOfSection
NtCreateSection
NtUnmapViewOfSection
NtQuerySystemInformation
RtlInitUnicodeString
NtQueryInformationFile
NtQueryInformationProcess
NtQueryObject
NtQueryDirectoryFile
memmove
ZwQueryInformationToken
ZwOpenProcessToken
ZwOpenProcess
_strnicmp
NtSetInformationProcess
memcpy
_alldiv
_aulldiv
_chkstk
RtlUnwind
NtQueryVirtualMemory
GetModuleFileNameA
CreateIoCompletionPort
PostQueuedCompletionStatus
InterlockedExchange
GetQueuedCompletionStatus
GetSystemInfo
LocalAlloc
OpenThread
HeapFree
HeapReAlloc
GetLastError
GetCurrentThreadId
RemoveVectoredExceptionHandler
CreateEventA
GetVersion
SetEvent
HeapDestroy
HeapCreate
SwitchToThread
AddVectoredExceptionHandler
HeapAlloc
SetLastError
lstrcmpiW
WideCharToMultiByte
lstrcatW
lstrcatA
lstrlenA
lstrcpyW
lstrcpyA
MultiByteToWideChar
lstrlenW
InitializeCriticalSection
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
CloseHandle
CreateThread
WaitForSingleObject
EnterCriticalSection
GetComputerNameW
CreateMutexA
GetCurrentProcessId
LocalFree
lstrcmpiA
lstrcpynA
lstrcpynW
SetEnvironmentVariableW
OpenProcess
WaitForMultipleObjects
Sleep
TerminateProcess
SetErrorMode
SetUnhandledExceptionFilter
GetProcAddress
LoadLibraryA
CreateDirectoryW
ReleaseMutex
InterlockedIncrement
InterlockedDecrement
GlobalDeleteAtom
GlobalAddAtomA
IsBadStringPtrA
VirtualProtect
lstrcmpA
VirtualQuery
GetCurrentProcess
FreeLibrary
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
GetVersionExW
ReadFile
CreateFileA
CreateFileW
GetFileSize
SetFilePointer
GetTempPathW
SetEndOfFile
GetLongPathNameW
WriteFile
VirtualAlloc
VirtualAllocEx
VirtualFree
ResetEvent
ReadProcessMemory
WriteProcessMemory
GetThreadContext
SuspendThread
ResumeThread
VirtualProtectEx
lstrcmpW
FindFirstFileW
FindClose
FindNextFileW
GetEnvironmentVariableW
GetFileAttributesExW
CopyFileW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
GlobalUnlock
GlobalLock
GlobalFree
OpenEventA
GlobalAlloc
GetSystemTime
SystemTimeToFileTime
GetSystemWindowsDirectoryA
SetFilePointerEx
GetFileInformationByHandleEx
SetFileInformationByHandle
GetProcessId
RemoveDirectoryW
DuplicateHandle
DeleteFileW
MulDiv
GetTickCount
GetSystemTimeAsFileTime
GetProcessTimes
GetLocaleInfoW
VerLanguageNameW
SetWaitableTimer
CreateWaitableTimerA
CancelWaitableTimer
WaitForSingleObjectEx
RaiseException
AcceptEx
GetAcceptExSockaddrs
PluginRegisterCallbacks
VncStartServer
VncStopServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ