GetProcAddressFake
UberPsyX
Static task
static1
Behavioral task
behavioral1
Sample
Redirector.dll
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Redirector.dll
Resource
win10v2004-20230621-en
Target
Redirector.dll
Size
96KB
MD5
d5ea1153a746d0c2c13d3068c5cb03b4
SHA1
8d21f5fbbc5af3c1bc673f7ce0212adef400771d
SHA256
03ba2cb37c7f40c6a8d5361fdf5b4ae6e5344dbfaf47b6a0ef5bd397a34edc25
SHA512
d5b86f486ae14a9e8959bc20a5e6d50d096c2bdc410718be8112ba50a844002c50bd23b89df11fd4c719c0ce11bf769726a4134b1ad53e8dfd171be7e373a14a
SSDEEP
1536:Ug0OQBKfi9DAxv2mNIK09r3aCny6sW8cdg0s8nBs4vUK3vUKc6rfXjJ:UM7eDouM5CaAZgJnKMKTrfX1
Checks for missing Authenticode signature.
resource |
---|
Redirector.dll |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
VirtualProtect
GetPrivateProfileIntW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
GetFileAttributesW
MultiByteToWideChar
GetPrivateProfileStringW
GetLastError
RaiseException
LoadLibraryW
GetCurrentDirectoryW
DecodePointer
GetProcAddress
DeleteCriticalSection
ExitProcess
GetModuleHandleW
CreateRemoteThread
lstrcmpiA
WriteConsoleW
CloseHandle
SetFilePointerEx
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA
WideCharToMultiByte
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
CreateFileW
MessageBoxW
wsprintfW
ImageDirectoryEntryToData
GetProcAddressFake
UberPsyX
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ