SHGetFolderPathW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Static task
static1
Behavioral task
behavioral1
Sample
shfolder.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
shfolder.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
vmnat.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
vmnat.exe
Resource
win10v2004-20221111-en
Target
modulo.zip
Size
20.1MB
MD5
407c99a70c52cd97d6b52221e0ef510f
SHA1
1765e9efc4c1a2d33573edb0ce417ca307fb8f54
SHA256
1f3b025d1455263b6a4a9b9d3c4624de23ae432b84d43e963fc5790de57d9cab
SHA512
774c91869265253c2ed19736294b447ec6257bc2ed6a6e1a432d31c2543d236dd93d7e82d6cf57df92952e2ac1ff792e55e14a7c688e8319cd2a99e0f58df7f0
SSDEEP
393216:ek79udFAsqKxIjX4v33NsNsW55HJ/2AR4ZqPuVHRHjbU9NXjm2DYXASmJ1C1:ekpudFA4IjIfesW5B0ARabHjbeNXbDYT
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
DocumentPropertiesW
ImageList_GetImageInfo
SHGetFolderPathW
MoveWindow
CharUpperBuffW
GetFileVersionInfoSizeW
GetErrorInfo
RegSetValueExW
NetWkstaGetInfo
memcpy
GetVersion
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
gethostbyaddr
IsEqualGUID
Pie
MagSetWindowSource
SHGetFolderPathW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
__p__commode
_wfopen
__stdio_common_vsprintf
__stdio_common_vsscanf
rewind
ftell
fseek
clearerr
_set_fmode
__stdio_common_vfprintf
fgets
fclose
__acrt_iob_func
free
_set_new_mode
realloc
calloc
malloc
terminate
_controlfp_s
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
__p___argc
_c_exit
exit
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
__p___wargv
_get_wide_winmain_command_line
_initterm
_initterm_e
_exit
_register_thread_local_exe_atexit_callback
_cexit
abort
rand
srand
_ecvt_s
wcrtomb
strtoul
atoi
_fcvt_s
isdigit
_strnicmp
_stricmp
strncmp
strncat
islower
_strlwr
_strupr
isalnum
tolower
_strdup
strncpy
wcsncmp
isspace
_configthreadlocale
localeconv
__setusermatherr
_waccess
_wunlink
_wstat64
getenv
memmove
wcsrchr
strstr
strrchr
__current_exception
__current_exception_context
memset
_except_handler4_common
memcpy
strchr
memchr
SHGetFolderPathW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentProcessId
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateFileA
VerifyVersionInfoW
GetProductInfo
GetNativeSystemInfo
VerSetConditionMask
GetModuleHandleExW
GetCurrentProcess
DeleteCriticalSection
ReadFile
WriteFile
CloseHandle
GetLastError
DeviceIoControl
ResetEvent
CreateEventA
WaitForMultipleObjects
GetSystemTimeAsFileTime
WaitForSingleObject
CreateThread
GetCurrentThreadId
TerminateThread
CreatePipe
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
CreateFileW
GetFileAttributesA
OutputDebugStringW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
CreateFileMappingA
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
GetACP
Sleep
QueryPerformanceCounter
SetLastError
FormatMessageW
GetModuleHandleW
CreateDirectoryW
DeleteFileW
CreateWindowExW
DispatchMessageA
GetMessageA
DestroyWindow
PeekMessageA
MsgWaitForMultipleObjects
PostMessageA
PostThreadMessageA
RegisterEventSourceA
RegCloseKey
CloseServiceHandle
RegisterServiceCtrlHandlerA
SetServiceStatus
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ReportEventW
DeregisterEventSource
RegSetValueExW
OpenServiceW
OpenSCManagerW
RegQueryValueExW
RegOpenKeyExW
StartServiceCtrlDispatcherA
WSAGetLastError
WSAAsyncSelect
socket
connect
closesocket
inet_addr
inet_pton
WSAStartup
htons
ntohs
bind
htonl
inet_ntop
getsockname
accept
getsockopt
recvfrom
sendto
recv
listen
setsockopt
select
send
ioctlsocket
shutdown
WSAIoctl
getpeername
ntohl
WSACreateEvent
GetAdaptersAddresses
NotifyAddrChange
GetAdaptersInfo
CancelIPChangeNotify
DnsFree
DnsQuery_A
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ