Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
顺丰2023年4月裁员名单/2023年4月裁员人员名单.doc.lnk
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
顺丰2023年4月裁员名单/2023年4月裁员人员名单.doc.lnk
Resource
win10v2004-20230220-en
Target
顺丰2023年4月裁员名单.rar
Size
3.4MB
MD5
d6f0cdd9395be68ff764dd2fc6618575
SHA1
4a423b7ba43622bf1be390509fd16f1c72317cd9
SHA256
eb04cb22cca9a31dbcc6495e692a0f5e2a50e7e6912182c3de01517d3b4a59a6
SHA512
4005e1f1e3ac753bd1fa975ea036033378115e6a7ba993b172099bd2038db20663f6f416ace6a216536e3f97fb403c03b6c4dbec720c79ef98c5abb10236a201
SSDEEP
98304:57S1EFvSrA7BiecrPoR965t2+WweP+74Xt:57S1EFvYIBdOY9650UePJt
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
__p___argc
__p___wargv
_cexit
_initterm
abort
_c_exit
_register_thread_local_exe_atexit_callback
_exit
exit
_initterm_e
_beginthreadex
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_invalid_parameter_noinfo
terminate
_invalid_parameter_noinfo_noreturn
_errno
_seh_filter_exe
_set_app_type
feof
fgetws
fclose
__stdio_common_vsnprintf_s
__stdio_common_vswprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsnwprintf_s
fputc
__stdio_common_vswprintf_s
_wfopen
_fsopen
__p__commode
_set_fmode
fseek
_wfsopen
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
setvbuf
fgetpos
fwrite
fgetc
fflush
calloc
malloc
_set_new_mode
_calloc_base
free
_malloc_base
_free_base
_callnewh
_recalloc
realloc
_i64toa_s
_ui64toa_s
_ui64tow_s
wcstoull
_wcstod_l
wcstoll
wcstod
_i64tow_s
strtof
strtoll
strtod
wcstol
_itow_s
strtol
isalpha
iswalpha
isdigit
iswdigit
iswxdigit
islower
iswlower
wcsncpy_s
strcspn
iswspace
towlower
towupper
iswupper
strncmp
strnlen
_wcsdup
isupper
__strncnt
wcsnlen
isspace
tolower
wcscmp
strcpy_s
_wcsicmp
_lock_locales
_configthreadlocale
localeconv
setlocale
___lc_codepage_func
__pctype_func
_create_locale
___lc_collate_cp_func
___lc_locale_name_func
_unlock_locales
___mb_cur_max_func
_free_locale
ldexp
ceilf
ceil
log2
pow
powf
frexp
OpenServiceW
OpenSCManagerW
CloseServiceHandle
StartServiceW
RegQueryValueExW
EventWriteTransfer
EventUnregister
EventRegister
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegSetKeyValueW
RegOpenCurrentUser
RegGetValueW
RegQueryInfoKeyW
RegCloseKey
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
ImpersonateLoggedOnUser
RevertToSelf
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CryptUnprotectMemory
CryptBinaryToStringW
CertFreeCertificateChain
CertFreeCertificateContext
GetSystemInfo
UnmapViewOfFile
GetSystemPreferredUILanguages
GetThreadPreferredUILanguages
GetVersionExW
GetModuleHandleA
QueryProcessCycleTime
GetLongPathNameW
GetProcessId
DuplicateHandle
CreateMutexW
LoadLibraryExA
DelayLoadFailureHook
OpenProcess
QueryFullProcessImageNameW
QueryUnbiasedInterruptTime
GlobalFree
VerifyVersionInfoW
GetUserPreferredUILanguages
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
MultiByteToWideChar
CloseThreadpool
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CreateThreadpool
SetThreadpoolThreadMaximum
CreateThreadpoolWork
SubmitThreadpoolWork
StartThreadpoolIo
SystemTimeToFileTime
RaiseException
FreeLibrary
LoadLibraryExW
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
HeapSetInformation
CreateEventW
SetEvent
TerminateProcess
GetCurrentProcess
SwitchToFiber
ConvertFiberToThread
IsThreadAFiber
ConvertThreadToFiber
CreateFiberEx
DeleteFiber
WideCharToMultiByte
GetSystemTimeAsFileTime
CreateFileW
SetErrorMode
QueryPerformanceFrequency
QueryPerformanceCounter
FormatMessageA
Sleep
SwitchToThread
InitializeSRWLock
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
RtlPcToFileHeader
GetStringTypeW
ReleaseSRWLockShared
AcquireSRWLockShared
LocalFree
InitOnceComplete
CreateDirectoryW
GetFileInformationByHandleEx
FindFirstFileExW
FindNextFileW
DeviceIoControl
FindClose
GetFileAttributesW
GetFileAttributesExW
SetFileInformationByHandle
MoveFileExW
CopyFileW
InitOnceBeginInitialize
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
InitializeSListHead
RtlUnwindEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetProcessTimes
CreateThreadpoolIo
WaitForThreadpoolIoCallbacks
CancelThreadpoolIo
CancelIoEx
CloseThreadpoolIo
GetSystemDirectoryW
GetSystemTime
InitializeCriticalSectionEx
CreateFileMappingW
MapViewOfFile
GetFileSizeEx
ExpandEnvironmentStringsW
CoUninitialize
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitializeEx
VarUI4FromStr
UnregisterClassA
CharNextW
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptGetProperty
BCryptOpenAlgorithmProvider
IdnToAscii
htonl
ntohs
htons
inet_ntop
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
VerSetConditionMask
WinHttpSetCredentials
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryAuthSchemes
WinHttpWriteData
WinHttpReceiveResponse
WinHttpOpen
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryOption
WinHttpGetDefaultProxyConfiguration
WinHttpGetProxyForUrl
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpSetOption
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
MpConfigGetValueAlloc
MpHandleClose
MpConfigClose
MpNotificationRegister
MpManagerOpen
MpFreeMemory
MpConfigUninitialize
MpUtilsExportFunctions
MpConfigInitialize
MpClientUtilExportFunctions
MpConfigOpen
_lock_file
_unlock_file
rand_s
SHGetKnownFolderPath
GetAdaptersAddresses
NetApiBufferFree
NetGetJoinInformation
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerA
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
PostQueuedCompletionStatus
QueryPerformanceCounter
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WriteConsoleW
WriteFile
__iob_func
_amsg_exit
_beginthread
_errno
_initterm
_lock
_unlock
abort
calloc
fprintf
free
fwrite
malloc
realloc
signal
strlen
strncmp
vfprintf
MpClientUtilExportFunctions
MpConfigClose
MpConfigGetValueAlloc
MpConfigInitialize
MpConfigOpen
MpConfigUninitialize
MpFreeMemory
MpHandleClose
MpManagerOpen
MpNotificationRegister
MpUtilsExportFunctions
OnProcessAttach
Test
_cgo_dummy_export
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ