AP1
AP2
AP3
AP4
AP5
APS11
APS12
APS13
APS14
APS15
APS16
APS17
APS18
ServiceMain
Behavioral task
behavioral1
Sample
a64b541b1e30a3ec987321111aba3d3fe369e65a691d9e6d6d0d09d70dfa1895.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a64b541b1e30a3ec987321111aba3d3fe369e65a691d9e6d6d0d09d70dfa1895.dll
Resource
win10v2004-20220812-en
Target
a64b541b1e30a3ec987321111aba3d3fe369e65a691d9e6d6d0d09d70dfa1895
Size
99KB
MD5
145fe3c8e6ea12e7c6f4506f26956ba3
SHA1
5139a67615494bbcf04aeb59a47f1247ddb73207
SHA256
a64b541b1e30a3ec987321111aba3d3fe369e65a691d9e6d6d0d09d70dfa1895
SHA512
9653bec20206f9e5c64a8ed149b96ee9aace3e9baba6aef286de6c243f3bb4c60310f48e20d7e2bee00e8ef593cde209a81f92b73416be4fb61b204a0f5bb9ac
SSDEEP
3072:T1k356u2joS/17c5Br4DHxS9sUrA2t7owZpdgb:pk31goS/MBsFSWGA2t7TZp2b
resource | yara_rule |
---|---|
sample | family_gh0strat |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
ResetEvent
lstrcpyA
SetEvent
CancelIo
GetProcAddress
LoadLibraryA
Sleep
GetPrivateProfileSectionNamesA
lstrcatA
GetWindowsDirectoryA
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
DeleteFileA
GetLastError
CreateDirectoryA
GetFileAttributesA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
MoveFileA
GetModuleFileNameA
SetLastError
GetCurrentProcess
CreateRemoteThread
VirtualAllocEx
OpenProcess
TerminateThread
MoveFileExA
GetTickCount
GetLocalTime
HeapFree
GetProcessHeap
MapViewOfFile
CreateFileMappingA
HeapAlloc
UnmapViewOfFile
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
PeekNamedPipe
WaitForMultipleObjects
GetSystemInfo
GlobalMemoryStatusEx
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
LocalSize
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcmpiA
GetCurrentThreadId
RaiseException
InterlockedExchange
strrchr
strncpy
strncat
realloc
atoi
wcstombs
_except_handler3
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
free
malloc
strchr
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler
sprintf
strstr
_ftol
_beginthreadex
ceil
_strnicmp
??3@YAXPAX@Z
memmove
_strcmpi
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSendMessage
ICSeqCompressFrameStart
ICSeqCompressFrame
ICOpen
AP1
AP2
AP3
AP4
AP5
APS11
APS12
APS13
APS14
APS15
APS16
APS17
APS18
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ