??0EXPORTS@@QAE@XZ
??4EXPORTS@@QAEAAV0@$$QAV0@@Z
??4EXPORTS@@QAEAAV0@ABV0@@Z
?exportf@@3HA
?exportmodule@@YAHXZ
Static task
static1
Behavioral task
behavioral1
Sample
onetapv4.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
onetapv4.dll
Resource
win10v2004-20230220-en
Target
onetapv4.dll
Size
6.4MB
MD5
78046636664fe3318428dcdcd93d59c6
SHA1
711c2e944db1326b87460b6f773c3607c5b5c328
SHA256
90c8198dab4aaa5b28ecee4352667e2ed86fc0760dff49550817addd6e4d014d
SHA512
d58a4bb75f3d16b8dd592b838f180d3ef203942574d852737b9cfda4fa1b460d09e5727792ce976e4b29a87386a34a8562c543aa49097174a6a9fd6258a087c8
SSDEEP
98304:/GJVrhpfx9SU3cb9sziNqzS07at8+iWhJW8lIWLu+S1H8wtMHs0FbJ0Y8Gty9IJ9:WfLSUMZIiNqzS048+iAzKc4P4/DtUIJ
Checks for missing Authenticode signature.
resource |
---|
onetapv4.dll |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
RegSetValueExW
ioctlsocket
CertFreeCertificateContext
ord143
GetDateFormatW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetWindowLongW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
HttpOpenRequestW
ImmReleaseContext
WTSSendMessageW
??0EXPORTS@@QAE@XZ
??4EXPORTS@@QAEAAV0@$$QAV0@@Z
??4EXPORTS@@QAEAAV0@ABV0@@Z
?exportf@@3HA
?exportmodule@@YAHXZ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ