DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.498a93e4a3fe4cc84ea7382c7386a000_JC.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.498a93e4a3fe4cc84ea7382c7386a000_JC.dll
Resource
win10v2004-20230915-en
Target
NEAS.498a93e4a3fe4cc84ea7382c7386a000_JC.exe
Size
1.6MB
MD5
498a93e4a3fe4cc84ea7382c7386a000
SHA1
4c202a0248d22d944120b57e5a86654f01d84717
SHA256
f0f7667b42c2158285ccf29b84731df1efe5ed4afa0bfc6f8111f47df67246a1
SHA512
6a74723c0f5efffe4dcd2f41ca8ebc06068cc20d12633b952152db334d2f86a3c62cf89eb295d4892abfbd14152a0f835228aabf545d4a02b01c89d50225a98b
SSDEEP
49152:Rf4z2AUn/KjyTITCdwTk46Qis9hmi3kr:Ro6TdyPTor
Checks for missing Authenticode signature.
resource |
---|
NEAS.498a93e4a3fe4cc84ea7382c7386a000_JC.exe |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WaitForSingleObjectEx
CancelIoEx
FlushFileBuffers
GetFileSizeEx
ResetEvent
CreateEventExW
GetOverlappedResult
CreateEventW
DeviceIoControl
FreeLibrary
GetFileInformationByHandleEx
GetModuleHandleW
GetProcAddress
GetLongPathNameW
GetSystemTimeAsFileTime
WriteFile
SetFilePointerEx
SetEndOfFile
CreateFileW
GetFileType
RaiseException
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
FlsFree
TlsFree
InterlockedPopEntrySList
GetTempPathW
GetStringTypeExW
GetSystemTime
WideCharToMultiByte
SetLastError
IsValidCodePage
MultiByteToWideChar
CreateDirectoryW
ReadFile
RemoveDirectoryW
ReleaseSemaphore
GetFileAttributesExW
CreateSemaphoreExW
CloseHandle
Sleep
SwitchToThread
GetCurrentThreadId
TryEnterCriticalSection
GetTickCount64
SystemTimeToFileTime
FileTimeToSystemTime
WaitForMultipleObjectsEx
CreateWaitableTimerW
QueryDepthSList
InitializeSRWLock
InitializeSListHead
InterlockedPushEntrySList
MulDiv
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetFileAttributesW
DeleteFileW
ReplaceFileW
GetLastError
CopyFileExW
GetTempFileNameW
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
QueryPerformanceCounter
GetCurrentProcessId
IsDebuggerPresent
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
LeaveCriticalSection
InitializeCriticalSectionEx
TlsAlloc
DeleteCriticalSection
HeapFree
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryW
HeapAlloc
GetProcessHeap
IsWow64Process
GetModuleFileNameA
GetShortPathNameA
SetFileInformationByHandle
IsProcessorFeaturePresent
CoCreateGuid
ReadClassStg
StgCreateDocfileOnILockBytes
StringFromGUID2
CreateStreamOnHGlobal
GetConvertStg
WriteFmtUserTypeStg
CreateILockBytesOnHGlobal
CoTaskMemFree
PropVariantClear
CoTaskMemAlloc
PropVariantCopy
CoCreateInstance
StgOpenStorageOnILockBytes
CoGetMalloc
CLSIDFromString
InitPropVariantFromStringAsVector
PropVariantChangeType
PropVariantToStringWithDefault
PropVariantToStringAlloc
PSCreateMemoryPropertyStore
PSGetPropertyDescription
strchr
_purecall
__std_exception_copy
__std_exception_destroy
__std_terminate
__CxxFrameHandler3
wcschr
__std_type_info_compare
wcsstr
_except_handler4_common
__std_type_info_destroy_list
wcsrchr
memset
_CxxThrowException
memcmp
memcpy
memmove
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Xbad_alloc@std@@YAXXZ
_Thrd_id
?_Xlength_error@std@@YAXPBD@Z
_Thrd_sleep
_Xtime_get_ticks
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
_Query_perf_frequency
_Query_perf_counter
?_Xout_of_range@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@F@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xbad_function_call@std@@YAXXZ
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?__ExceptionPtrCreate@@YAXPAX@Z
free
realloc
malloc
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_errno
_register_onexit_function
_crt_atexit
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_initterm_e
_initterm
strnlen
wcsncpy_s
wcscmp
_stricmp
strcmp
strncpy_s
wcsncat_s
wcsnlen
wcscpy_s
isdigit
__stdio_common_vswprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__stdio_common_vsnprintf_s
srand
rand
__initialize_lconv_for_unsigned_char
RegisterEventSourceW
ReportEventW
RegCreateKeyExW
RegOpenKeyExW
RegGetValueW
RegEnumValueW
RegQueryValueExW
RegCloseKey
EventWriteTransfer
DeregisterEventSource
CreateCompatibleBitmap
SelectObject
ExtFloodFill
DeleteObject
DeleteDC
CreateCompatibleDC
SysAllocString
VariantClear
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayCopy
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
VariantChangeTypeEx
SysStringLen
SysAllocStringLen
VariantChangeType
VariantTimeToSystemTime
SystemTimeToVariantTime
SysFreeString
SysStringByteLen
VariantInit
GdiplusStartup
GdiplusShutdown
GdipGetImageHeight
GdipLoadImageFromStream
GdipDrawImageRectI
GdipSetInterpolationMode
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ