hKOgtkmCis
SetPath
Behavioral task
behavioral1
Sample
dd3ba736_7876e8dc0a06ab3ffd61d0b040327ac960d33543beafa2761b69b7b6c7935cec.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dd3ba736_7876e8dc0a06ab3ffd61d0b040327ac960d33543beafa2761b69b7b6c7935cec.dll
Resource
win10v2004-20230220-en
Target
dd3ba736_7876e8dc0a06ab3ffd61d0b040327ac960d33543beafa2761b69b7b6c7935cec
Size
1.1MB
MD5
dd3ba73653522deb7b7bd760147b86ff
SHA1
0166238f406ec79fb27eafc093d193fc85a0c32f
SHA256
7876e8dc0a06ab3ffd61d0b040327ac960d33543beafa2761b69b7b6c7935cec
SHA512
65861772604f2d5627ca8aff64c456aa09bc0835d7b60d560e228319464c42e9e75d2241a96a7f4e45feb305d476457f10a8659317f5ab0a6e39264e7d7d02b3
SSDEEP
24576:J3U9FU5g/dAFCeycmdopdEfrVDN6kBDLQ9:k/OpycmYUpDN6kBv
bumblebee
146l
141.98.168.70:443
103.175.16.107:443
146.70.124.77:443
154.56.0.100:443
194.135.33.16:443
185.62.58.209:443
Checks for missing Authenticode signature.
resource |
---|
dd3ba736_7876e8dc0a06ab3ffd61d0b040327ac960d33543beafa2761b69b7b6c7935cec |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertCreateCertificateChainEngine
InitSecurityInterfaceA
SetEvent
TerminateThread
GetCurrentProcessId
CreateEventA
SetWaitableTimer
TlsSetValue
VerifyVersionInfoA
SetLastError
EnterCriticalSection
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateEventW
FormatMessageW
TlsAlloc
QueueUserAPC
CreateWaitableTimerA
LocalFree
DeleteCriticalSection
VerSetConditionMask
WideCharToMultiByte
SleepEx
TlsGetValue
TlsFree
FormatMessageA
CreateIoCompletionPort
AreFileApisANSI
ReadFile
SetHandleInformation
CreateNamedPipeA
WriteFile
TerminateProcess
GetCurrentThreadId
GetSystemDirectoryW
MultiByteToWideChar
CreateFileA
GetEnvironmentStrings
CreateProcessA
FreeEnvironmentStringsA
GetExitCodeProcess
FileTimeToSystemTime
LoadLibraryW
GetLocalTime
GetProcAddress
SystemTimeToFileTime
GetModuleHandleW
GetCurrentProcess
Thread32Next
Thread32First
GetModuleHandleA
LoadLibraryA
VirtualProtectEx
OpenThread
GetModuleFileNameW
SetFilePointer
lstrlenA
CreateFileW
lstrcmpA
VirtualAlloc
HeapFree
GetLastError
HeapAlloc
GetProcessHeap
VirtualQuery
lstrcpyA
Wow64DisableWow64FsRedirection
ExpandEnvironmentStringsW
Wow64RevertWow64FsRedirection
GetWindowsDirectoryW
GetCurrentDirectoryW
GlobalMemoryStatusEx
VerifyVersionInfoW
GetFileAttributesW
Process32NextW
Process32FirstW
GetStdHandle
RtlCaptureContext
WaitForSingleObjectEx
ResetEvent
SetFilePointerEx
HeapSize
GetConsoleMode
Sleep
lstrcatA
GetFileAttributesA
OpenProcess
GetModuleFileNameA
CloseHandle
CreateToolhelp32Snapshot
WaitForSingleObject
GetCPInfo
GetConsoleCP
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileA
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
RaiseException
DecodePointer
EncodePointer
RtlPcToFileHeader
RtlVirtualUnwind
HeapReAlloc
FindFirstFileExA
FindClose
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
OutputDebugStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ExitProcess
GetACP
WriteConsoleW
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
RtlUnwindEx
InterlockedFlushSList
InitializeSListHead
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
wsprintfW
FindWindowW
LookupPrivilegeValueA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetUserNameW
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoUninitialize
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
SysAllocString
VariantClear
VariantInit
WNetGetProviderNameW
GetAdaptersInfo
getaddrinfo
WSASocketW
WSASetLastError
select
WSAStartup
WSAGetLastError
setsockopt
connect
ioctlsocket
freeaddrinfo
getsockopt
WSASend
closesocket
WSACleanup
WSARecv
PathCombineW
StrCmpIW
StrChrA
StrStrIW
StrToIntA
hKOgtkmCis
SetPath
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ