DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
69bef6ad64b3e599303d1097f8ee791a6da116a63da5291ce88d79ae328d5575.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
69bef6ad64b3e599303d1097f8ee791a6da116a63da5291ce88d79ae328d5575.dll
Resource
win10v2004-20230915-en
Target
69bef6ad64b3e599303d1097f8ee791a6da116a63da5291ce88d79ae328d5575
Size
4.1MB
MD5
58079fb52987c5e66ab6ef8adc5b4005
SHA1
c023fbc054dd9fef9de048a543e897267bd08f35
SHA256
69bef6ad64b3e599303d1097f8ee791a6da116a63da5291ce88d79ae328d5575
SHA512
ef5848ed670dcac5c3f0694fa5769eb28ecfdad7e12850c87c01dd9412a122ce1d44d58f6d6570073f31e57becfeb488f0257caead5b738ae3de6ded1b73d068
SSDEEP
49152:cARPQLOeEmqp7c10J8hNXvYuos4A+BiheVS8dQJE8hyB4z7P6gab5liWDd8nq3LH:cAR9Nc10J8hNDsghkS8dQ6BJg4
Checks for missing Authenticode signature.
resource |
---|
69bef6ad64b3e599303d1097f8ee791a6da116a63da5291ce88d79ae328d5575 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
getpeername
inet_pton
__WSAFDIsSet
htonl
WSAIoctl
WSASetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
getaddrinfo
freeaddrinfo
recvfrom
sendto
WSACleanup
WSAStartup
ntohs
WSACloseEvent
select
ioctlsocket
getsockname
getsockopt
gethostbyname
WSAGetLastError
htons
inet_addr
inet_ntoa
gethostbyaddr
getservbyport
getservbyname
WSASetLastError
recv
send
accept
bind
closesocket
connect
listen
setsockopt
socket
shutdown
gethostname
WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSFreeMemory
WTSQueryUserToken
LeaveCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
VerSetConditionMask
SetLastError
SetEvent
SleepEx
CreateEventW
WaitForMultipleObjects
VerifyVersionInfoW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
ConnectNamedPipe
CreateNamedPipeW
FlushFileBuffers
WriteFile
DisconnectNamedPipe
PeekNamedPipe
GetNamedPipeClientProcessId
QueryPerformanceCounter
GetSystemTime
SystemTimeToFileTime
GetFileSize
LockFileEx
UnlockFile
HeapCompact
GetSystemInfo
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
InitOnceBeginInitialize
IsDebuggerPresent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
CreateThread
DeviceIoControl
GetVersionExW
GetNativeSystemInfo
QueryPerformanceFrequency
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetSystemDirectoryA
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
GetCurrentThreadId
GetFileSizeEx
FormatMessageA
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
WaitForSingleObject
Sleep
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetComputerNameExW
WTSGetActiveConsoleSessionId
FileTimeToSystemTime
SetFilePointer
ReadFile
CreateFileW
LocalFree
GetCurrentProcess
QueryDosDeviceW
GetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
GetLocalTime
InitOnceComplete
DeleteFileW
GetLastError
HeapDestroy
HeapAlloc
EnterCriticalSection
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FindResourceExW
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
WideCharToMultiByte
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
CloseHandle
FormatMessageW
OpenProcess
GetModuleHandleW
TerminateProcess
MultiByteToWideChar
GetCurrentProcessId
OpenMutexW
ProcessIdToSessionId
GetEnvironmentVariableA
CompareFileTime
MoveFileExA
GetModuleHandleA
InitializeCriticalSectionEx
ConvertThreadToFiberEx
ConvertFiberToThread
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
CreateFiberEx
DeleteFiber
SwitchToFiber
GetACP
GetFileType
GetStdHandle
VirtualFree
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
CoUninitialize
CoInitialize
ConvertSidToStringSidW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
OpenProcessToken
CopySid
GetLengthSid
GetTokenInformation
IsValidSid
CreateProcessAsUserW
GetUserNameW
CheckTokenMembership
DuplicateTokenEx
GetSidLengthRequired
GetSidSubAuthority
InitializeSid
SetTokenInformation
ChangeServiceConfigW
CloseServiceHandle
RegQueryValueExW
CryptHashData
CryptGetHashParam
CryptAcquireContextA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegDeleteValueW
SetSecurityDescriptorDacl
MakeSelfRelativeSD
MakeAbsoluteSD
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetAclInformation
AddAce
OpenSCManagerW
OpenServiceW
RegCloseKey
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
_Thrd_detach
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
??Bid@locale@std@@QAEIXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?uncaught_exception@std@@YA_NXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
_Query_perf_frequency
_Query_perf_counter
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Thrd_yield
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Xlength_error@std@@YAXPBD@Z
_Mtx_unlock
PathIsRelativeW
PathRemoveBackslashW
PathAddBackslashW
PathFileExistsW
PathRemoveFileSpecW
PathAppendW
PathCanonicalizeW
CreateEnvironmentBlock
UnloadUserProfile
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
GetModuleFileNameExW
GetProcessImageFileNameW
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
memcpy
memmove
memset
_purecall
wcschr
__std_terminate
strchr
strrchr
_CxxThrowException
strstr
wcsstr
_except_handler4_common
__current_exception
__current_exception_context
__std_type_info_destroy_list
memchr
_wassert
_errno
__sys_errlist
_crt_atexit
__sys_nerr
_initterm_e
_execute_onexit_table
_resetstkoflw
_invalid_parameter_noinfo_noreturn
terminate
_beginthreadex
_initterm
signal
_invalid_parameter_noinfo
_register_onexit_function
raise
_getpid
abort
_endthreadex
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_cexit
strerror_s
_exit
fread
fputc
fflush
fclose
fwrite
setvbuf
_lseeki64
_read
_write
fopen
fseek
ftell
ferror
fgets
_close
_open
__stdio_common_vswprintf_s
__stdio_common_vswprintf
fputs
__stdio_common_vsprintf_s
__stdio_common_vsprintf
feof
_fileno
_setmode
__stdio_common_vsscanf
__acrt_iob_func
__stdio_common_vfprintf
_wfopen
strspn
_strdup
strncpy_s
strcat_s
strcpy_s
strcspn
wcsncat_s
_wcslwr_s
_stricmp
isdigit
toupper
isspace
isupper
tolower
wcsncmp
strpbrk
_wcsnicmp
strnlen
strcmp
wmemcpy_s
strncpy
wcsspn
wcsncpy
wcsnlen
wcscspn
strncmp
_wcsicmp
_wtoi
strtod
strtol
strtoll
strtoull
wcstombs
strtoul
atoi
wcstol
_fdopen
ceil
_dsign
_dclass
localeconv
calloc
_recalloc
_callnewh
realloc
_msize
malloc
free
_stat64
_access
_fstat64
_unlink
_stat64i32
qsort
_gmtime64_s
_time64
strftime
_gmtime64
_localtime64_s
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertGetEnhancedKeyUsage
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertGetCertificateChain
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCreateCertificateChainEngine
RpcServerUseProtseqEpW
RpcObjectSetType
RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIfEx
RpcServerUnregisterIfEx
NdrServerCall2
getenv
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
BCryptGenRandom
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ