CORLockDownProvider
CORPolicyEE
CORPolicyProvider
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
GetPublisher
GetUnsignedPermissions
Behavioral task
behavioral1
Sample
3d78abe43cb64f65aa76011ad302fe354527530c23b4ba1d2d93fa986e4f4630.dll
Resource
win7-20221111-en
Target
3d78abe43cb64f65aa76011ad302fe354527530c23b4ba1d2d93fa986e4f4630
Size
152KB
MD5
d87d21df965ab71fb293153e6a88c570
SHA1
87167a2cbcebd768e5e4e9d2162c56974d503d65
SHA256
3d78abe43cb64f65aa76011ad302fe354527530c23b4ba1d2d93fa986e4f4630
SHA512
4821ffb47d02d18802cfc53545ad7c70a90bdf7eee219bf2c871675ca4eca48d4c84e2626d42b579b57d924fb1425ebbba9cfb00ce3a1227d4adc8610be55273
SSDEEP
3072:/N/HcLC4JmNr5WMcQMbKEu1lD6eRDTBftwO0N6OOEF:1W3gNr1RMbKF1lFRDTBlwzT
resource | yara_rule |
---|---|
sample | family_gh0strat |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
SysFreeString
LoadLibraryA
RaiseException
GetTickCount
lstrlenA
LocalFree
GetProcAddress
GetModuleHandleA
GetLastError
lstrcmpiA
lstrcpyA
LocalReAlloc
LocalSize
LocalAlloc
CloseHandle
Sleep
InterlockedDecrement
InterlockedIncrement
lstrcatA
GetVersionExA
GetCurrentThreadId
ExitProcess
GetSystemDirectoryA
GetExitCodeProcess
GetModuleFileNameA
SetUnhandledExceptionFilter
GetLocalTime
FormatMessageA
VirtualQuery
IsBadWritePtr
GlobalUnlock
GlobalLock
GlobalSize
HeapFree
GetProcessHeap
MapViewOfFile
CreateFileMappingA
GetShortPathNameA
HeapAlloc
GetTempFileNameA
InterlockedExchange
ExpandEnvironmentStringsA
GetCurrentProcessId
lstrcmpA
VirtualProtect
MultiByteToWideChar
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
GetSystemInfo
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
FreeLibrary
GlobalFree
GlobalAlloc
DeleteFileA
RemoveDirectoryA
ExitThread
IsBadReadPtr
IsBadStringPtrW
InitializeCriticalSection
VirtualFree
LeaveCriticalSection
VirtualAlloc
WideCharToMultiByte
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetCursorInfo
wsprintfA
wvsprintfA
GetClassNameA
GetWindow
DestroyCursor
GetWindowRect
CloseWindowStation
CreateWindowExA
DestroyWindow
ShowWindow
LoadCursorA
MessageBoxA
StrStrIA
GetProfilesDirectoryA
GetUserProfileDirectoryA
WSACleanup
WSAStartup
gethostbyname
closesocket
bind
socket
connect
accept
send
ioctlsocket
__WSAFDIsSet
select
recv
shutdown
getsockname
gethostname
setsockopt
listen
WSAIoctl
GetAdaptersInfo
wcstombs
_adjust_fdiv
rand
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_wcsicmp
_strupr
_strlwr
_memicmp
wcsrchr
wcslen
_CxxThrowException
ceil
memmove
??3@YAXPAX@Z
atoi
realloc
strstr
strrchr
malloc
free
strncpy
_beginthreadex
_except_handler3
strncat
strchr
_ftol
__CxxFrameHandler
??2@YAPAXI@Z
srand
CORLockDownProvider
CORPolicyEE
CORPolicyProvider
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
GetPublisher
GetUnsignedPermissions
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ