?ExtractServices@@YAHPAD@Z
?InitSQLConnectOff@@YAHPAD@Z
InitSQLConnect
SQLAlloc
SQLClose
SQLExecute
SQLFree
SQLQuery
Uninstall
Behavioral task
behavioral1
Sample
fe3c4bb3b4d39f50db6f807e1e73a09f23863cde2de6fb2e614bfda3ec22c9a9.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fe3c4bb3b4d39f50db6f807e1e73a09f23863cde2de6fb2e614bfda3ec22c9a9.dll
Resource
win10v2004-20221111-en
Target
fe3c4bb3b4d39f50db6f807e1e73a09f23863cde2de6fb2e614bfda3ec22c9a9
Size
104KB
MD5
6a59537fb6bb62ae6ff3d7fe92f8a29d
SHA1
9e582eb368269389909dae3ff44f0c1fd52596b8
SHA256
fe3c4bb3b4d39f50db6f807e1e73a09f23863cde2de6fb2e614bfda3ec22c9a9
SHA512
9107c7ae810784b23a73d86cd0bfe35ddb923c3c26c284222bd1be013e8bdf106e6c560bb027ab9ca3ea391f6f7984ca90f3c12ba8689081986dbc34f412e1a8
SSDEEP
1536:lO0Uu9TgBmO0lY+7IlUDZ+Fz09NmPPTTwJ:l3O0h7uKD9EAJ
resource | yara_rule |
---|---|
sample | upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
CreateToolhelp32Snapshot
GetVersionExA
GetLastError
GetCurrentProcess
GetTickCount
SetFileAttributesA
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
GetDriveTypeA
GetLogicalDriveStringsA
MoveFileW
CreateDirectoryW
GlobalFree
DeviceIoControl
CreateFileA
GlobalAlloc
lstrcpyA
ExitProcess
CreateProcessA
MoveFileA
GetTempFileNameA
GetCurrentThreadId
GetWindowsDirectoryA
ReadProcessMemory
TerminateProcess
ReadFile
CreatePipe
WriteFile
GetPrivateProfileStringA
GetModuleFileNameA
CreateMutexA
GlobalMemoryStatus
GetSystemDefaultLangID
lstrcmpiA
RtlUnwind
LCMapStringW
LCMapStringA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
SetFilePointer
GetFileSize
GetSystemTime
Thread32First
TerminateThread
Thread32Next
GetCurrentThread
GetCurrentProcessId
GetModuleHandleA
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
CreateRemoteThread
GetExitCodeThread
OpenThread
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
GetComputerNameA
RemoveDirectoryA
FindFirstFileA
FindNextFileA
GetFileAttributesA
CreateDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
OpenProcess
CopyFileA
GetSystemDirectoryA
WritePrivateProfileStringA
Sleep
WinExec
CreateEventA
HeapAlloc
CreateThread
WaitForSingleObject
CloseHandle
SetEvent
GetProcessHeap
HeapFree
ExitThread
GetLocalTime
GetTempPathA
lstrcatA
RegCreateKeyA
DuplicateTokenEx
GetTokenInformation
LookupAccountSidA
QueryServiceConfigA
EnumServicesStatusA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyA
RegCreateKeyExA
RegDeleteValueA
RegSetValueExA
LogonUserA
DeleteService
RegDeleteKeyA
ControlService
LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceA
OpenSCManagerA
OpenServiceA
CreateServiceA
CloseServiceHandle
ChangeServiceConfigA
ChangeServiceConfig2A
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenEventLogA
ClearEventLogA
CloseEventLog
OpenProcessToken
CreateProcessAsUserA
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
CreateDCA
GetDIBits
GetObjectA
BitBlt
DeleteObject
__CxxFrameHandler
sprintf
sscanf
strncpy
rand
srand
atoi
atol
free
malloc
_vsnprintf
_ftol
wcslen
_stricmp
_close
_read
_eof
_lseeki64
_filelengthi64
_wopen
_findclose
_wfindnext
wcscat
wcscpy
wcscmp
_wfindfirst
swprintf
strftime
localtime
_i64toa
_write
_wfindnexti64
_wfindfirsti64
_atoi64
realloc
__dllonexit
_onexit
_initterm
_adjust_fdiv
strncmp
??2@YAPAXI@Z
??3@YAXPAX@Z
GetMappedFileNameA
GetProcessMemoryInfo
GetModuleFileNameExA
URLDownloadToFileA
GetDC
keybd_event
SetCursorPos
mouse_event
wsprintfA
ExitWindowsEx
GetSystemMetrics
CloseWindowStation
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetThreadDesktop
GetProcessWindowStation
GetUserObjectInformationA
CloseDesktop
PostMessageA
OpenInputDesktop
LoadUserProfileA
InternetConnectA
HttpOpenRequestA
InternetCrackUrlA
HttpQueryInfoA
InternetQueryDataAvailable
InternetReadFile
HttpSendRequestA
InternetOpenA
InternetCloseHandle
?ExtractServices@@YAHPAD@Z
?InitSQLConnectOff@@YAHPAD@Z
InitSQLConnect
SQLAlloc
SQLClose
SQLExecute
SQLFree
SQLQuery
Uninstall
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE