DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.b29a7dde2434f3c4d3f7d68903535010_JC.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.b29a7dde2434f3c4d3f7d68903535010_JC.dll
Resource
win10v2004-20231020-en
Target
NEAS.b29a7dde2434f3c4d3f7d68903535010_JC.exe
Size
618KB
MD5
b29a7dde2434f3c4d3f7d68903535010
SHA1
50a5565516610d320d6f2cf2eff632102c847466
SHA256
f944cd0e63c8f81f966303bc6680812fb8ff83619ad9fe9cbe7efd4afcb958bc
SHA512
c8438701b89e643b9ddf39a197f3f8517518d373623cb55d67b9dfe6c3deba5d08df68ed6cce3272cde1cdd767652e381be9c3e75c3c84f169b0080899d4f599
SSDEEP
12288:fGJvQ2NxdgGL/CoaA0dF+7EkD9hQE+Thx82PQqpYbkZ7f/:fG627dgGbuF+YkD9+E+TYCYYT
Checks for missing Authenticode signature.
resource |
---|
NEAS.b29a7dde2434f3c4d3f7d68903535010_JC.exe |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetVersionExA
lstrcatW
lstrcpyW
lstrlenW
InitializeCriticalSection
FlushInstructionCache
GetCurrentProcess
SetLastError
GetModuleFileNameW
GlobalAlloc
GlobalLock
GlobalUnlock
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryExW
RaiseException
LeaveCriticalSection
EnterCriticalSection
GetLastError
ShowWindow
GetWindowTextW
UnregisterClassA
SetWindowPos
GetDC
DrawTextW
ReleaseDC
MoveWindow
SendMessageW
SetWindowTextW
IntersectRect
SetWindowRgn
DrawFocusRect
GetWindowTextLengthW
GetSystemMetrics
PostMessageW
ScreenToClient
ChildWindowFromPoint
SetRect
SetScrollInfo
ShowScrollBar
SetCursor
GetSysColor
GetKeyState
ClientToScreen
IsRectEmpty
EqualRect
LockWindowUpdate
OffsetRect
CopyRect
SetRectEmpty
MessageBeep
GetWindowLongW
SetWindowLongW
DefWindowProcW
InvalidateRect
CreateWindowExW
CallWindowProcW
GetClientRect
IsWindow
DestroyWindow
UnionRect
PtInRect
IsChild
BeginPaint
EndPaint
ReleaseCapture
SetCapture
GetFocus
GetParent
IsWindowVisible
LoadCursorW
GetClassInfoExW
RegisterClassExW
SetFocus
UpdateWindow
ScrollWindow
CloseMetaFile
SetWindowExtEx
SetTextColor
SetBkColor
GetTextColor
CreateMetaFileW
SelectObject
RestoreDC
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
GetClipBox
CreateBrushIndirect
ExcludeClipRect
MoveToEx
LineTo
ExtTextOutW
CreateRectRgnIndirect
CreatePen
DeleteObject
DeleteMetaFile
GetBkColor
CoTaskMemFree
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
OleRegGetMiscStatus
CreateDataAdviseHolder
RegisterDragDrop
RevokeDragDrop
CoTaskMemAlloc
CoCreateInstance
StringFromCLSID
LoadRegTypeLi
SysFreeString
SysStringLen
VariantChangeType
VariantClear
VariantInit
SysStringByteLen
OleCreatePropertyFrame
SysAllocString
LoadTypeLi
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
memmove_s
abs
floor
labs
memcpy_s
memcmp
free
_itow_s
_purecall
memset
swprintf_s
_recalloc
wcslen
__CxxFrameHandler3
_CxxThrowException
?GrooveNew@@YAPAXI@Z
?GrooveDelete@@YAXPAX@Z
?SetFromResource@GCStr@@QAEXKQAUHINSTANCE__@@@Z
?HandleAllIfMethodCatch@@YGJPBU_GUID@@@Z
?OpenCopy@raw_GCStr@@SGPA_WPB_W@Z
?Trim_Helper@raw_GCStr@@CG?AVGCStrRetVal@@PB_W_N11PAVGCStackStrBase@@@Z
?EndsWith_Helper@raw_GCStr@@CG_NPB_W0_N@Z
?First@raw_GCStr@@SG?AVGCStrRetVal@@PB_WK@Z
?Length@raw_GCStr@@SGKABVGCStr@@@Z
?Last@raw_GCStr@@SG?AVGCStrRetVal@@PB_WK@Z
?InterfaceSupportsErrorInfoHelper@GCoSupportErrorInfoTearOffBase@@AAEJPBXPAUIUnknown@@ABU_GUID@@@Z
?IGrooveDispatchImplHelper_FindMultiDispatchEntry@@YGPBUGrooveMultiDispatchEntry@@PBU1@ABU_GUID@@PB_W@Z
?IGrooveDispatchImplHelper_SetObjectReturnValue@@YGXPAVGCoScriptDispatchTearoff@@PAUtagVARIANT@@@Z
?CreateScriptDispatchTearoff@@YG?AV?$GCIPtrRetVal@UIDispatch@@$1?_GUID_00020400_0000_0000_c000_000000000046@@3U__s_GUID@@B@@PBUGrooveMultiDispatchEntry@@PAUIUnknown@@_N@Z
?IGrooveDispatchImplHelper_FindMultiDispatchEntry@@YGPBUGrooveMultiDispatchEntry@@PBU1@ABU_GUID@@J@Z
??1GCLocale@@QAE@XZ
?BaseAddChild@GCControlContainerHelper@@IAEXPAUIUnknown@@PAUHWND__@@PAUtagRECT@@HH0AAU4@0_N4@Z
?DrawChildren@GCControlContainerHelper@@IAEJAAUATL_DRAWINFO@@PAUtagRECT@@@Z
??0GCDateFormat@@QAE@W4STYLE@0@0ABVGCLocale@@@Z
?GetDefault@GCLocale@@SG?BV1@XZ
?SelectObject@GCDCObjectSelector@@QAE_NPAX@Z
??0GCStr@@QAE@ABV0@@Z
?CompareNoCase@raw_GCStr@@SGJPB_W0@Z
?Append@GCStr@@QAEXPB_W@Z
?DoubleToString@raw_GCStr@@SG?AVGCStrRetVal@@NK@Z
?int_ITFError@GCError@@CG?AV1@KQAUHINSTANCE__@@ABU_GUID@@GKPB_WKPAUIErrorInfo@@PAD@Z
??4GCAtom@@QAEABV0@AAVGCStrRetVal@@@Z
?EqualsNoCase@GCStr@@QBE_NPB_W@Z
?CreateInstance@GCoUnknownEnum@@SG?AV?$GCIPtrRetVal@UIGrooveUnknownEnumCreate@@$1?IID_IGrooveUnknownEnumCreate@@3U_GUID@@B@@ABU_GUID@@0_N@Z
?Set@GCVariant@@QAEXABUtagVARIANT@@_N@Z
?Equals@GCStr@@QBE_NPB_W@Z
?ms_GlobalPointersInitializationSemaphore@GCUtilDLL@@2VGCReentrantSemaphore@@A
?CreateScriptDispatchTearoff@@YG?AV?$GCIPtrRetVal@UIDispatch@@$1?_GUID_00020400_0000_0000_c000_000000000046@@3U__s_GUID@@B@@PAUIUnknown@@_N@Z
?int_Inst@GCError@@CGPAUHINSTANCE__@@XZ
?int_RawError@GCError@@CG?AV1@KQAUHINSTANCE__@@JPB_W1KPAUIErrorInfo@@PAD@Z
?GOutputDebugString@@YGXPB_W@Z
?Append@GCStackStrBase@@QAEXQB_WK@Z
?LongToString@raw_GCStr@@SGXJPAVGCStackStrBase@@J@Z
?GetValue@GCRegistryKey@@QBEJAAKPB_WPAK@Z
?Open@GCRegistryKey@@QAEJK@Z
??1GCRegistryKey@@UAE@XZ
??0GCRegistryKey@@QAE@W4KEY_ROOT@0@PB_W_N@Z
?IGrooveDispatchImplHelper_IsSafeForScripting@@YG_NPBUGrooveSafeForScriptingEntry@@PAUITypeInfo@@ABU_GUID@@JG@Z
?ms_MainSTAThreadId@GCGrooveThreadId@@0KA
?hr_LoadTypeLib@GCTypeLibLoader@@SGJABU_GUID@@GGKPAPAUITypeLib@@@Z
?FindInterface@GCIPtrBase@@IAE_NABU_GUID@@PAUIUnknown@@@Z
?QueryInterfaceNoReleaseNoThrow@GCIPtrBase@@IAEJABU_GUID@@PAUIUnknown@@@Z
?ProvideIMarshal@GCFTMIMarshalProvider@@QAGJPAUIUnknown@@PAPAX@Z
?int_FromLastErrorInfo@GCError@@CG?AV1@KJ_N@Z
?StartErrorBlock@GCCriticalErrorInfo@@SGX_N@Z
?EndErrorBlock@GCCriticalErrorInfo@@SGXXZ
?HandleAllNoUIErrorCatch@@YGXXZ
?RemoveAllChildren@GCControlContainerHelper@@IAEXXZ
?OnSetCursor@GCControlContainerHelper@@IAEJIIJAAH@Z
?OnMouseMsg@GCControlContainerHelper@@IAEJIIJAAH@Z
?OnKeyMsg@GCControlContainerHelper@@IAEJIIJAAH@Z
?OnSetFocus@GCControlContainerHelper@@IAEJIIJAAH@Z
?OnKillFocus@GCControlContainerHelper@@IAEJIIJAAH@Z
?OnCancelMode@GCControlContainerHelper@@IAEJIIJAAH@Z
?MakeTheDispatchCallsBase@GCEventSourceBase@@QAEXP6G_NPAXAAVGCFireCtx@@@Z0JKG0PBD0@Z
?MakeTheCallsBase@GCEventSourceBase@@QAEXP6G_NPAXAAVGCFireCtx@@@Z0K0ABU_GUID@@@Z
?Init@GCFireCtx@@QAEXAAVGCDynamicUnkArray@@@Z
?InvokeHelper@GCDispatchDriver@@QAA_NJGGPAX_NPBDZZ
?Set@GCVariant@@QAEXABV1@@Z
??1GCFireCtx@@QAE@XZ
?StopSharing@GCVariant@@AAEXXZ
?Equals@raw_GCStr@@SG_NPB_W0@Z
?raw_ProcessMnemonicsNested@GCControlContainerHelper@@UAGJPAUtagMSG@@JVGCVARIANT_BOOL@@@Z
?raw_ProcessMnemonics@GCControlContainerHelper@@UAGJPAUtagMSG@@J@Z
?raw_FindDefaultButton@GCControlContainerHelper@@UAGJPAPAUIUnknown@@PAVGCVARIANT_BOOL@@@Z
?get_ParentControlContainer@GCControlContainerHelper@@UAGJPAPAUIUnknown@@@Z
?raw_FindUIActiveObject@GCControlContainerHelper@@UAGJPAU_GUID@@PAPAUIUnknown@@PAVGCVARIANT_BOOL@@@Z
?raw_ClientSiteHasFocus@GCControlContainerHelper@@UAGJPAUIGrooveClientSite@@PAVGCVARIANT_BOOL@@@Z
?raw_OnRestoreFocus@GCControlContainerHelper@@UAGJXZ
?raw_OnSaveFocus@GCControlContainerHelper@@UAGJXZ
?raw_SetFocusToDefaultComponent@GCControlContainerHelper@@UAGJXZ
?raw_OpenClientSiteEnum@GCControlContainerHelper@@UAGJVGCVARIANT_BOOL@@PAPAUIGrooveUnknownEnum@@@Z
?raw_OnClientSiteFocus@GCControlContainerHelper@@UAGJVGCVARIANT_BOOL@@PAUIGrooveClientSite@@@Z
?raw_SetFocus@GCControlContainerHelper@@UAGJVGCVARIANT_BOOL@@PAUIGrooveClientSite@@@Z
?raw_SetCapture@GCControlContainerHelper@@UAGJVGCVARIANT_BOOL@@PAUIGrooveClientSite@@@Z
?Drop@GCControlContainerHelper@@UAGJPAUIDataObject@@KU_POINTL@@PAK@Z
?DragLeave@GCControlContainerHelper@@UAGJXZ
?DragOver@GCControlContainerHelper@@UAGJKU_POINTL@@PAK@Z
?DragEnter@GCControlContainerHelper@@UAGJPAUIDataObject@@KU_POINTL@@PAK@Z
?Compare@raw_GCStr@@SGJPB_W0@Z
??4GCAtom@@QAEABV0@PB_W@Z
?EnumConnectionsBase@IConnectionPointImplBase@@QAEJPAPAUIEnumConnections@@@Z
??1GCEventSourceBase@@QAE@XZ
?HideChildren@GCControlContainerHelper@@IAEJXZ
?ShowChildren@GCControlContainerHelper@@IAEJXZ
?GrooveHandleShipAssert@@YGXPBDK0K@Z
?ms_RunningProcessChecked@GCSafeScriptingSupport@@0_NA
?ms_RunningInGrooveProcess@GCSafeScriptingSupport@@0_NA
?int_IsRunningInGrooveProcess@GCSafeScriptingSupport@@CG_NXZ
?UnlockCP@GCSharedStaticSemCPLockModel@@SGXXZ
?LockCP@GCSharedStaticSemCPLockModel@@SGXXZ
?RemoveSinkBase@GCEventSourceBase@@IAEJK@Z
?AddSinkBase@IConnectionPointImplBase@@QAEJABU_GUID@@PAUIUnknown@@PAK@Z
?BaseOnPaint@GCControlContainerHelper@@IAEXPAVGCControlContainerWindow@@PAUIViewObjectEx@@PAUHWND__@@@Z
?DisableDropTarget@GCControlContainerHelper@@IAEXPAUHWND__@@@Z
?EnableDropTarget@GCControlContainerHelper@@IAEXPAUHWND__@@@Z
?QIBase@IConnectionPointImplBase@@QAEJABU_GUID@@PAPAX@Z
?FindConnectionPointBase@IConnectionPointContainerGrooveBase@@QAEJPBU_ATL_CONNMAP_ENTRY@ATL@@ABU_GUID@@PAPAUIConnectionPoint@@@Z
?EnumConnectionPointsBase@IConnectionPointContainerGrooveBase@@QAEJPBU_ATL_CONNMAP_ENTRY@ATL@@HPAPAUIEnumConnectionPoints@@@Z
?int_ErrorBase@GCError@@CG?AV1@KJPB_W00PAUIErrorInfo@@JABU_GUID@@0K@Z
_UIThreadProxyDelegatorQIHook@12
?ScriptHasInterfaceMethod@@YGJPAXPBXJGPAUtagDISPPARAMS@@PAUtagVARIANT@@@Z
?_Release@GCVariant@@AAEXXZ
?Find@raw_GCStr@@SG_NPB_W0AAK@Z
?int_ITFError@GCError@@CG?AV1@KQAUHINSTANCE__@@ABU_GUID@@GPB_W2KPAUIErrorInfo@@PAD@Z
?ReportErrorCSM@GCCSM@@SGXABVGCError@@@Z
??4GCError@@QAEAAV0@ABV0@@Z
?Report@GCError@@QBEX_N@Z
?int_FromCurrentWin32Error@GCError@@CG?AV1@K@Z
??1GCAtom@@QAE@XZ
?OnCaptureChanged@GCControlContainerHelper@@IAEJIIJAAH@Z
?HandleMessageMapErrorCatch@@YGXKIJ@Z
?Format@GCDateFormat@@QBE?AVGCStrRetVal@@ABVGCDate@@@Z
??1GCAnyIPtr@@QAE@XZ
?Empty@GCIPtrBase@@QAEXXZ
??0GCStr@@QAE@PB_W@Z
?int_DeallocateBufferIfNecessary@GCStackStrBase@@AAEXAAPA_W@Z
?Set@GCStackStrBase@@QAEXQB_WK@Z
?Set@GCVariant@@QAEXPB_W@Z
?int_Win32Error@GCError@@CG?AV1@KK@Z
?_Release@GCStr@@AAEXXZ
?LongToString@raw_GCStr@@SG?AVGCStrRetVal@@JJ@Z
?Format@GCStr@@QAAJPB_WZZ
??1GCDate@@QAE@XZ
?StringToLong@raw_GCStr@@SGJPB_WJ@Z
?Set@GCVariant@@QAEXPAUIDispatch@@@Z
?int_COMError@GCError@@CG?AV1@JPAUIUnknown@@ABU_GUID@@11@Z
?QueryInterfaceNoRelease@GCIPtrBase@@IAEXABU_GUID@@PAUIUnknown@@@Z
?CreateInstanceNoRelease@GCIPtrBase@@IAEXABU_GUID@@0K@Z
??1GCError@@QAE@XZ
?int_RawError@GCError@@CG?AV1@KJ@Z
?Throw@GCError@@QBEXXZ
?DeallocateHashTable@@YGXPAXK@Z
?Set@GCStr@@QAEXPB_W@Z
?Hash@@YGKPBEKK@Z
?Compare@GCStr@@QBEJPB_W@Z
?ToPowerOf2@@YGKK@Z
?AllocateHashTable@@YGPAXK@Z
?GetHandle@GCGrooveResourceModule@@SGPAUHINSTANCE__@@XZ
?SAFE_EMPTY_STRING_CBSTR@raw_GCStr@@2PB_WB
?Find@raw_GCStr@@SG_NPB_W_WAAK@Z
?First@raw_GCStr@@SGXPB_WKPAVGCStackStrBase@@@Z
??0GCError@@QAE@XZ
ord30
ord43
ord50
ord53
ord27
ord26
ord10
ord64
ord22
ord18
ord15
ord19
ord55
ord61
ord23
ord11
ord44
ord31
ord58
ord32
ord51
ord52
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ