IkeServiceMain
SvchostPushServiceGlobals
Static task
static1
Behavioral task
behavioral1
Sample
IKEEXT.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
IKEEXT.dll
Resource
win10v2004-20230915-en
Target
IKEEXT.DLL
Size
1.0MB
MD5
56129985c2c2afcdb4861fd14cc3f728
SHA1
de6baf521d033c064294360f8aedfe281aca6285
SHA256
647b2b95b26e3027eafec51bcab5d4e84d9c888a273c42116ba893df655882c3
SHA512
90fa665a5263b36c42a5b0c7f40f1eea31b7b8d1c7afae17432cd920b8a1c399fa074486a655a696416754da63a2ce446dd6f0cefd3c7944189cc990166bf570
SSDEEP
24576:/td4ynf+sTkQVCtrnvJ7pBr0u4vUA2QRVGtGI9GDZIvHVMO2ti2qJP+:/td4ynfLTkQVCtrnvJ7r0u4vUA2QRVGj
Checks for missing Authenticode signature.
resource |
---|
IKEEXT.DLL |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
memcpy
memcmp
_vsnprintf
_vsnwprintf
wcstok_s
time
bsearch
memcpy_s
sprintf_s
_ultow_s
_XcptFilter
strcmp
__C_specific_handler
_initterm
malloc
free
_amsg_exit
memset
wcscmp
FreeLibrary
GetModuleHandleExW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
DisableThreadLibraryCalls
Sleep
QueryPerformanceCounter
TlsAlloc
OpenThreadToken
GetCurrentProcessId
GetCurrentThreadId
OpenProcessToken
TlsGetValue
GetCurrentThread
TerminateProcess
TlsFree
GetCurrentProcess
TlsSetValue
SetThreadPriority
GetThreadPriority
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
GetComputerNameExW
GetSystemTime
RtlCaptureContext
RtlCompareMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
RtlAllocateHeap
RtlValidRelativeSecurityDescriptor
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlInitString
WinSqmEndSession
WinSqmStartSession
WinSqmSetDWORD
RtlLengthSecurityDescriptor
RtlIpv4AddressToStringA
RtlIpv6StringToAddressW
RtlApplicationVerifierStop
EtwEventEnabled
EtwEventWriteTransfer
EtwEventWrite
EtwEventActivityIdControl
EtwEventUnregister
EtwEventRegister
RtlNtStatusToDosError
EtwTraceMessage
RtlIpv4StringToAddressW
EtwUnregisterTraceGuids
RtlCreateHashTable
RtlDeleteHashTable
RtlInsertEntryHashTable
RtlRemoveEntryHashTable
RtlLookupEntryHashTable
RtlGetNextEntryHashTable
RtlInitEnumerationHashTable
RtlEnumerateEntryHashTable
RtlEndEnumerationHashTable
RtlExpandHashTable
RtlContractHashTable
RtlTimeToTimeFields
RtlIntegerToUnicodeString
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
RtlAdjustPrivilege
RtlInitializeSListHead
RtlInterlockedPushEntrySList
RtlInterlockedPopEntrySList
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlIpv6AddressToStringA
AuthzFreeAuditEvent
AuthzInitializeResourceManager
AuthzAccessCheck
AuthziInitializeAuditParamsFromArray
AuthziFreeAuditEventType
AuthziInitializeAuditEventType
AuthziInitializeAuditEvent
AuthziLogAuditEvent
AuthzFreeResourceManager
IkeextGetConfigParameters0
FwpmEngineClose0
IPsecKeyModuleUpdateAcquire0
FwpmEventProviderDestroy0
FwpmProviderContextUnsubscribeChanges0
IPsecSaContextExpire0
IPsecKeyModuleDelete0
FwpmEngineOpen0
IPsecKeyModuleAdd0
FwpsQueryIPsecDosFWUsed0
FwpsLayerReleaseInProcReplica0
FwpmEventProviderIsNetEventTypeEnabled0
FwpsClassifyUser0
FwpmProviderContextSubscribeChanges0
FwpmFilterSubscribeChanges0
FwpmEventProviderCreate0
FwpmEventProviderFireNetEvent0
FwpmFreeMemory0
FwpmFilterGetById0
FwpmFilterCreateEnumHandle0
FwpsLayerCreateInProcReplica0
IPsecSaContextUpdate0
FwpmFilterDestroyEnumHandle0
IPsecKeyDictationCheck0
IPsecGetKeyFromDictator0
IPsecKeyNotification0
FwppIPsecSaContextCreate
FwpmFilterAdd0
FwpsOpenToken0
FwppConnectionGetByIPsecInfo
IPsecSaContextAddOutboundAndTrackConnection
IPsecSaContextAddInboundAndTrackConnection
IPsecSaContextGetSpi1
FwpsQueryIPsecOffloadDone0
FwpmProviderContextGetByKey3
FwpmFilterUnsubscribeChanges0
FwpsAleExplicitCredentialsQuery0
FwpmFilterEnum0
ASN1_CreateDecoder
ASN1_CreateModule
ASN1_FreeDecoded
ASN1_CloseDecoder
ASN1BERDecPeekTag
ASN1BERDecExplicitTag
ASN1DecSetError
ASN1_Decode
ASN1Free
ASN1BERDecOpenType2
ASN1DecRealloc
ASN1BERDecEndOfContents
ASN1BERDecNotEndOfContents
ASN1_CloseModule
TryAcquireSRWLockExclusive
SetEvent
AcquireSRWLockShared
CreateEventW
ReleaseSRWLockShared
CreateEventA
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
InitializeSRWLock
CreateSemaphoreExW
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
ReleaseSRWLockExclusive
DuplicateHandle
CloseHandle
EncodePointer
DecodePointer
WideCharToMultiByte
CompareStringEx
CompareStringW
HeapReAlloc
HeapAlloc
HeapSize
HeapFree
HeapDestroy
HeapCreate
GetProcessHeap
ControlTraceW
StartTraceW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegNotifyChangeKeyValue
SetThreadpoolThreadMaximum
CloseThreadpool
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpool
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
CloseThreadpoolTimer
SetThreadpoolTimer
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
SetThreadpoolThreadMinimum
PowerSettingUnregisterNotification
PowerSettingRegisterNotification
SetPrivateObjectSecurityEx
RevertToSelf
GetPrivateObjectSecurity
EqualSid
GetTokenInformation
DestroyPrivateObjectSecurity
CreatePrivateObjectSecurityEx
DuplicateToken
MapGenericMask
ImpersonateLoggedOnUser
ImpersonateAnonymousToken
CopySid
GetLengthSid
EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister
DebugBreak
OutputDebugStringA
GetAddrInfoW
ntohl
ntohs
htons
htonl
FreeAddrInfoW
WSAGetLastError
WSACleanup
WSAStartup
WSCEnumProtocols
WSASocketW
bind
setsockopt
closesocket
WSAEventSelect
WSASocketA
WSAIoctl
RpcServerInqBindings
RpcEpRegisterW
RpcEpUnregister
RpcImpersonateClient
MesEncodeDynBufferHandleCreate
MesHandleFree
I_RpcExceptionFilter
MesDecodeBufferHandleCreate
RpcServerUseProtseqW
RpcAsyncCompleteCall
NdrServerCall2
NdrMesTypeEncode3
NdrMesTypeDecode3
NdrMesTypeFree3
RpcBindingVectorFree
RpcServerUnregisterIfEx
RpcServerInqCallAttributesW
RpcRaiseException
RpcGetAuthorizationContextForClient
NdrAsyncServerCall
RpcFreeAuthorizationContext
NdrServerCallAll
Ndr64AsyncServerCallAll
RpcStringFreeW
UuidCreate
RpcRevertToSelf
RpcServerRegisterIfEx
UuidToStringW
LocalFree
LocalAlloc
CompareFileTime
FormatMessageW
SystemTimeToFileTime
UnregisterWaitEx
RegisterWaitForSingleObjectEx
NsiGetParameter
NsiSetParameter
PerfStopProvider
PerfSetULongCounterValue
PerfSetCounterRefValue
PerfCreateInstance
PerfStartProvider
PerfSetCounterSetInfo
DsBindWithSpnExW
DsCrackNamesW
DsUnBindW
DsFreeNameResultW
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientActivate
Pdcv2ActivationClientRenewActivation
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientRegister
GetPersistedRegistryLocationW
ApiSetQueryApiSetPresence
GetProcessMitigationPolicy
ResolveDelayLoadedAPI
DelayLoadFailureHook
IkeServiceMain
SvchostPushServiceGlobals
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ