ServiceMain
SvchostPushServiceGlobals
Behavioral task
behavioral1
Sample
8385aa79c0e400d316ca4a418a026558d2fa88e314541900b698d8294b84ca0c.dll
Resource
win10-20230220-en
Target
8385aa79c0e400d316ca4a418a026558d2fa88e314541900b698d8294b84ca0c
Size
134KB
MD5
58b8d65e848176eb583a88e8d48f413e
SHA1
9ebb541dcb24d564448a6f5e00c613b73eba7148
SHA256
8385aa79c0e400d316ca4a418a026558d2fa88e314541900b698d8294b84ca0c
SHA512
8546e6333040f600051221657d5d345e2a203bda6284537c9d1130c301f0ec6289bda0c85b8bffa9941075eaca429dcef2f8b0811c751b5e7cc980b1b771d92f
SSDEEP
3072:rw9SF4O9OLLkWE6tAfyZhhJjL18TSOz0FrES:gSj4LLkitAadJjn56S
Sample triggered yara rules associated with the AnchorDNS malware family.
resource | yara_rule |
---|---|
sample | family_anchor_dns |
Checks for missing Authenticode signature.
resource |
---|
8385aa79c0e400d316ca4a418a026558d2fa88e314541900b698d8294b84ca0c |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
__WSAFDIsSet
select
ntohs
inet_ntoa
recvfrom
sendto
WSACleanup
closesocket
shutdown
WSAStartup
inet_addr
socket
htons
RegOpenKeyExW
RegQueryValueExW
SetServiceStatus
RegisterServiceCtrlHandlerW
RegCloseKey
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
SetStdHandle
GetProcessHeap
SetFilePointerEx
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FlushFileBuffers
DecodePointer
WriteConsoleW
FreeEnvironmentStringsW
IsProcessorFeaturePresent
GetComputerNameExW
GetProcAddress
FreeLibrary
WideCharToMultiByte
GetTickCount
WaitForSingleObject
CreateEventW
SetEvent
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetShortPathNameA
ReadFile
lstrlenW
WriteFile
CreateFileW
GetSystemWindowsDirectoryA
MultiByteToWideChar
GetTempPathA
GetLastError
CreateFileA
TerminateThread
DeleteFileA
DeleteFileW
CreateProcessW
GetTempFileNameA
GetSystemWindowsDirectoryW
LoadLibraryW
ResetEvent
WaitForSingleObjectEx
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
InterlockedFlushSList
SetLastError
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
HeapFree
HeapAlloc
GetACP
GetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
FindClose
ServiceMain
SvchostPushServiceGlobals
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ