DllGetClassObject
DllRegisterServer
DllUnregisterServer
Run
Static task
static1
Behavioral task
behavioral1
Sample
payload.dll
Resource
win7-20230831-en
Target
payload.dll
Size
285KB
MD5
704636cf4f04bf9a1babe999eac3d183
SHA1
db18eca045fdbd8159f50bff04b1bdb6be43ebb0
SHA256
a21c2b6912772143895aa9ac106b3d0f31dee43fb8167c43f8f54aafda5783a3
SHA512
e82942e4559297c4084b44ddd49584a00892a13fffe3e73661e684cbc545c73e26437d7eb7f2fed724e41e070eed8469b59d42ab29bbb8afb2c758270bf740c0
SSDEEP
6144:2khvALPwc7CxiPQ6gQ4f2IyT6kKCS1FZ:2kE5Gooxhf/tCq
Checks for missing Authenticode signature.
resource |
---|
payload.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
RtlNtStatusToDosError
NtWriteFile
NtReadVirtualMemory
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtWaitForSingleObject
NtCreateThreadEx
NtProtectVirtualMemory
NtWriteVirtualMemory
NtAllocateVirtualMemory
IsDebuggerPresent
DisableThreadLibraryCalls
GetCurrentThreadId
UnhandledExceptionFilter
InitializeSListHead
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetConsoleWindow
CreateProcessA
WriteProcessMemory
CreateFileW
CreateFileMappingW
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
GetProcAddress
ReleaseSRWLockExclusive
ReleaseMutex
ReleaseSRWLockShared
GetLastError
AcquireSRWLockExclusive
GetCurrentThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetStdHandle
GetCurrentProcessId
WaitForSingleObject
TryAcquireSRWLockExclusive
QueryPerformanceCounter
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
GetConsoleMode
IsProcessorFeaturePresent
GetModuleHandleW
FormatMessageW
ExitProcess
MultiByteToWideChar
WriteConsoleW
TlsGetValue
TlsSetValue
GetModuleBaseNameW
EnumProcessModulesEx
ShowWindow
SetWindowPos
__CxxFrameHandler3
memcmp
__std_type_info_destroy_list
memmove
_CxxThrowException
__C_specific_handler
memset
memcpy
_cexit
_execute_onexit_table
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
free
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Run
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ