Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
DllHijacking/AliIM.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
DllHijacking/AliIM.exe
Resource
win10v2004-20230703-en
Target
DllHijacking.rar
Size
541KB
MD5
b04523a7ca9229acf1fa91d3ce466064
SHA1
1a6368faaf4d504f137336a278a0bc77cd0c0121
SHA256
fc1a679d9c378e50f683449cc6c35c2ad34b4c9d502884b7ee456587f04b707f
SHA512
1b1eb894a7a5edb6b50171a1147bfd1e656bff193143d98ee44646ad36d4cadaa1b399d94b7a440e8dd3513d9e4b658a26a5d82707095bfe06cb49e18fd30c6c
SSDEEP
12288:7etIQkA1Yes+QxvMIDi09ssTtBSmFLFoAEQcH:7etIQkA1xRQpV8sRwmRFoTPH
Checks for missing Authenticode signature.
resource |
---|
unpack001/DllHijacking/UpdateAssist.dll |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
LocalFree
GetPrivateProfileStringW
CreateFileW
ReadFile
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FlushFileBuffers
GetFileAttributesW
GetFileSize
SetFilePointer
WriteFile
WaitForSingleObject
Sleep
GetCurrentProcessId
CreateProcessW
OpenProcess
GetLocalTime
FindResourceExW
GetModuleHandleW
GlobalAlloc
GlobalFree
LocalAlloc
lstrcmpA
CopyFileW
MoveFileExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32EnumProcesses
K32GetModuleFileNameExW
GetConsoleMode
GetConsoleCP
SetFilePointerEx
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCommandLineA
GetProcessHeap
HeapSize
HeapFree
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
SetCurrentDirectoryW
GetCommandLineW
FreeLibrary
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
OutputDebugStringW
RtlUnwind
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
IsValidLocale
WriteConsoleW
ShellExecuteExW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHFileOperationW
SystemTimeToVariantTime
VariantTimeToSystemTime
VarUdateFromDate
GetTokenInformation
CheckTokenMembership
FreeSid
OpenProcessToken
DuplicateTokenEx
LookupAccountSidW
GetUserNameW
AllocateAndInitializeSid
PathAppendW
PathCanonicalizeW
PathFileExistsW
WinVerifyTrust
CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptDecodeObject
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
??0BindStateBase@internal@base@@AAE@P6AXXZP6AXPBV012@@Z@Z
??0CallbackBase@internal@base@@QAE@$$QAVCallbackBaseCopyable@12@@Z
??0CallbackBase@internal@base@@IAE@PAVBindStateBase@12@@Z
?ReadFile@base@@YAHABVFilePath@1@PADH@Z
?AsWStringUnsafe@FilePath@base@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?LoadNativeLibrary@base@@YAPAUHINSTANCE__@@ABVFilePath@1@PAUNativeLibraryLoadError@1@@Z
?ToString@NativeLibraryLoadError@base@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetInstance@OSInfo@win@base@@SAPAV123@XZ
?WideToUTF8@base@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
?AsUTF8Unsafe@FilePath@base@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Append@FilePath@base@@QBE?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Append@FilePath@base@@QBE?AV12@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@Z
??4FilePath@base@@QAEAAV01@$$QAV01@@Z
??1FilePath@base@@QAE@XZ
??0FilePath@base@@QAE@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@1@@Z
??0FilePath@base@@QAE@XZ
?Get@PathService@base@@SA_NHPAVFilePath@2@@Z
?Stop@Thread@base@@QAEXXZ
?StartWithOptions@Thread@base@@QAE_NABUOptions@12@@Z
??1Thread@base@@UAE@XZ
??0Thread@base@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1Options@Thread@base@@QAE@XZ
??0Options@Thread@base@@QAE@XZ
?GetUIMessageLoop@base@@YAPAVMessageLoop@1@XZ
?CompleteLazyInstance@internal@base@@YAXPAHHP6AXPAX@Z1@Z
?NeedsLazyInstance@internal@base@@YA_NPAH@Z
?Destruct@TaskRunnerTraits@base@@SAXPBVTaskRunner@2@@Z
?PostTask@TaskRunner@base@@QAE_NABVLocation@2@V?$OnceCallback@$$A6AXXZ@2@@Z
?CreateFromHere@Location@base@@SA?AV12@PBD0H@Z
?ToString@Location@base@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??0Location@base@@QAE@ABV01@@Z
?Set@DictionaryValue@base@@QAEPAVValue@2@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$unique_ptr@VValue@base@@U?$default_delete@VValue@base@@@std@@@std@@@Z
??0DictionaryValue@base@@QAE@XZ
?GetAsDictionary@Value@base@@QAE_NPAPAVDictionaryValue@2@@Z
??1Value@base@@QAE@XZ
??0Value@base@@QAE@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@@Z
??0Value@base@@QAE@_N@Z
??0Value@base@@QAE@XZ
??0Value@base@@QAE@$$QAV01@@Z
?SysWideToUTF8@base@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
?UTF8ToWide@base@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@@Z
??0CallbackBaseCopyable@internal@base@@QAE@ABV012@@Z
??1CallbackBase@internal@base@@IAE@XZ
??1LogMessage@logging@@QAE@XZ
?GetPrgCOM@@YAJPAPAVIPrgCOM@prg@@@Z
?Init@PrgFramework@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?UnInit@PrgFramework@@YAXXZ
?refreshruntime@PrgFramework@@YAXXZ
?Unregister@UIApplication@@QAEXXZ
??0UIApplication@@QAE@AAHPAPADABVQString@@222@Z
??1UIApplication@@UAE@XZ
?GetAppDataDir@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?Utf8ToWide@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?GetModuleDir@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?GetMachineID@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?GetCrashDumpUser@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?setHighDpiScaleFactorRoundingPolicy@QGuiApplication@@SAXW4HighDpiScaleFactorRoundingPolicy@Qt@@@Z
?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z
??1QString@@QAE@XZ
?addLibraryPath@QCoreApplication@@SAXABVQString@@@Z
?fromAscii_helper@QString@@CAPAU?$QTypedArrayData@G@@PBDH@Z
?setAttribute@QCoreApplication@@SAXW4ApplicationAttribute@Qt@@_N@Z
?fromStdString@QString@@SA?AV1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?InitializeGateway@gw@@YAXXZ
GetArphaCrashDump
GetArphaService
GetArphaApp
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
HeapSize
HeapFree
HeapReAlloc
IsDebuggerPresent
HeapDestroy
RaiseException
GetLastError
GetModuleHandleA
CloseHandle
SetLastError
GetCurrentProcess
GetCurrentThread
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
TerminateProcess
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
OutputDebugStringW
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
HeapAlloc
GetLocalTime
FindResourceExW
LoadResource
LockResource
SizeofResource
SystemTimeToFileTime
FileTimeToSystemTime
LocalFree
FindResourceW
SetCurrentDirectoryW
ShellExecuteExW
CoInitializeSecurity
CoCreateInstance
CoTaskMemFree
CoInitialize
CoUninitialize
CoInitializeEx
VariantClear
VariantInit
SysAllocString
SysFreeString
GetTokenInformation
OpenThreadToken
AddAce
AllocateAndInitializeSid
CheckTokenMembership
CopySid
EqualSid
FreeSid
GetAce
GetAclInformation
GetLengthSid
InitializeAcl
IsValidSid
GetNamedSecurityInfoW
SetNamedSecurityInfoW
OpenProcessToken
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
_Mtx_lock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
UnloadUserProfile
__CxxFrameHandler3
_purecall
_CxxThrowException
memcpy
memchr
memset
_except_handler4_common
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_destroy_list
memmove
_callnewh
calloc
malloc
free
_execute_onexit_table
_crt_atexit
_cexit
_initialize_onexit_table
_initterm
_initterm_e
_initialize_narrow_environment
_register_onexit_function
_errno
_invalid_parameter_noinfo
_configure_narrow_argv
_seh_filter_dll
terminate
_invalid_parameter_noinfo_noreturn
_resetstkoflw
__stdio_common_vsprintf
wmemcpy_s
wcscpy_s
isspace
wcsnlen
_wcsicmp
_time64
rand
srand
?GetLifeCycleManager@@YA?AV?$shared_ptr@VIAliwangwangLifeCycleManager@@@std@@XZ
AliwangwangAppEntry
GetPrgCOMFactory
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
RtlUnwind
RaiseException
HeapSize
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
GetThreadLocale
GlobalFindAtomW
LoadLibraryA
GetVersionExA
InterlockedIncrement
FormatMessageW
GetModuleHandleA
GlobalFlags
WritePrivateProfileStringW
SetErrorMode
lstrlenW
TlsFree
GlobalFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalUnlock
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalFree
LocalAlloc
InterlockedDecrement
GetCurrentProcessId
GetLastError
SetLastError
GlobalAddAtomW
CloseHandle
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
GetModuleFileNameW
GetVersion
EnumResourceLanguagesW
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedExchange
GlobalLock
lstrcmpW
GlobalAlloc
FreeLibrary
GlobalDeleteAtom
GetModuleHandleW
LoadLibraryW
GetProcAddress
ExitProcess
ReadFile
GetFileSize
CreateFileA
GetEnvironmentStringsW
GetModuleFileNameA
LoadCursorW
GetSysColorBrush
ShowWindow
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
CopyRect
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetMenuItemID
GetSubMenu
GetSysColor
ReleaseDC
GetDC
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameW
PtInRect
GetWindowTextW
SetWindowTextW
GetMenuItemCount
UnregisterClassW
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindowLongW
GetLastActivePopup
DestroyMenu
GetClassInfoExW
IsWindowEnabled
EnableWindow
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
SendMessageW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
PostMessageW
PostQuitMessage
MessageBoxA
MessageBoxW
GetSystemMetrics
UnregisterClassA
DeleteDC
GetStockObject
GetDeviceCaps
TextOutW
RectVisible
PtVisible
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
CreateBitmap
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
DeleteObject
ExtTextOutW
ClosePrinter
DocumentPropertiesW
OpenPrinterW
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
PathFindExtensionW
PathRemoveFileSpecA
PathFindFileNameW
VariantClear
VariantChangeType
VariantInit
CancelUpdate
CheckUpdate
CloseUpdate
GetProgress
IsServiceRunning
RunServiceEx
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ