DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
utshellext.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
utshellext.dll
Resource
win10v2004-20230220-en
Target
utshellext.dll
Size
14.4MB
MD5
83fbfd496b772a20c9907e8fb89cfbed
SHA1
ea057b141b9ed10152e13b2e827b68ecc0f60133
SHA256
ef92b68a76a6292782a6499a9be0fed93e8162aa6fe949d33c7d4875949bbf0a
SHA512
2d2a2ffe205d085d2c5ddc13a4a6e06fee951f52ed3bd419e61b8267b387ee67576a1c167c4b579321fccf7ac2f6c9dd813ad2c12471f78d9e10773d889b2ffe
SSDEEP
393216:DMq2DYvzN7SeamsWKPzGRMEIel87BGlRbb:4XDYvAWvzXjOol
AutoIT scripts compiled to PE executables.
resource | yara_rule |
---|---|
sample | autoit_exe |
Checks for missing Authenticode signature.
resource |
---|
utshellext.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
CreateFileW
ReadFile
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryW
lstrlenW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
WriteFile
LoadResource
LockResource
SizeofResource
FindResourceW
GetUserDefaultUILanguage
WideCharToMultiByte
FreeLibrary
ExpandEnvironmentStringsW
GetCommandLineW
MulDiv
GetStringTypeW
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
HeapReAlloc
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW
HeapSize
SetEndOfFile
MultiByteToWideChar
VerifyVersionInfoW
VerSetConditionMask
RtlUnwind
GetLastError
DrawIconEx
LoadImageW
DestroyIcon
GetIconInfo
PostMessageW
InsertMenuW
GetMenuItemCount
SetRect
ReleaseDC
GetDC
GetSystemMetrics
SetLayeredWindowAttributes
ShowWindow
CreateWindowExW
RegisterClassExW
GetParent
GetActiveWindow
MessageBoxW
DefWindowProcW
InsertMenuItemW
GetMessageW
DeleteDC
DeleteObject
GetDeviceCaps
CreateDIBSection
GetDIBits
SelectObject
CreateCompatibleDC
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
SHChangeNotify
ShellExecuteW
SHGetSpecialFolderPathW
DragQueryFileW
ReleaseStgMedium
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ