FileTimeToVariantTime
InitPropVariantFromFileTimeEx
InitPropVariantFromSystemTimeEx
VariantTimeToFileTime
_ConvertTimeHelper
Static task
static1
Behavioral task
behavioral1
Sample
CustomShellHost.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
CustomShellHost.exe
Resource
win10v2004-20231215-en
Target
CustomShellHost.exe
Size
1.2MB
MD5
f0a4bbcba8a673cbd8ff69281e8cab05
SHA1
e9ea302d51b3b194dbd69f5b821437ed3a23062b
SHA256
11c2bf126546b5f0a42cb34dd3f02263b6504dde2033ad3f037f9b30c10f8460
SHA512
3ebc15b22d0dd6beb19212f70c5099947e7be0ea33940b1c7944b8c85df28bb508a6738a07f6eb1f4b6d8f8dfdf8917b153d839f1b478a715d5a2b5d761ed29c
SSDEEP
24576:9uLkClkp3JHorp8P3CbVRqtaEsJavAc4QFr6WsGqRdCxYRINTXYXD+K3kLBFweDh:8LkClkp+p8P3CmtdsJavAAlqTdaXkJ3S
Checks for missing Authenticode signature.
resource |
---|
CustomShellHost.exe |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetTokenInformation
EventUnregister
RegGetValueW
EventSetInformation
EventRegister
EventWriteTransfer
QueryServiceStatus
EventWrite
EventEnabled
GetSecurityDescriptorDacl
ConvertSecurityDescriptorToStringSecurityDescriptorW
CloseServiceHandle
NotifyServiceStatusChangeW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
TraceMessage
SetNamedSecurityInfoW
SetEntriesInAclW
RegDeleteKeyExW
AddAce
InitializeAcl
SetSecurityInfo
DeleteAce
GetAce
GetAclInformation
GetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegEnumValueW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW
EqualSid
GetNamedSecurityInfoW
LsaLookupNames2
LsaClose
LsaFreeMemory
LsaOpenPolicy
CheckTokenMembership
DuplicateToken
EventActivityIdControl
IsValidSid
GetLengthSid
CopySid
OpenThreadToken
OpenProcessToken
CreateWellKnownSid
ConvertSidToStringSidW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegSetKeyValueW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
AcquireSRWLockShared
LocalFree
CreateProcessW
GetModuleHandleW
DebugBreak
IsDebuggerPresent
CreateMutexExW
GetProcAddress
HeapAlloc
CreateThreadpoolTimer
RaiseException
ReleaseSRWLockShared
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitOnceComplete
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
Sleep
ReleaseMutex
GetCurrentThreadId
LocalAlloc
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
LeaveCriticalSection
K32GetModuleFileNameExW
GetModuleFileNameW
GetModuleHandleExW
ReleaseSemaphore
EnterCriticalSection
SetLastError
SetPriorityClass
CreateEventExW
SetProcessShutdownParameters
SetErrorMode
CreateEventW
SetEvent
RegisterApplicationRestart
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetTickCount
GetTimeZoneInformationForYear
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
TrySubmitThreadpoolCallback
GetModuleHandleExA
GetProcessMitigationPolicy
FindResourceExW
LoadResource
WaitForMultipleObjectsEx
OpenEventW
GetCurrentThread
LoadLibraryExW
GetPackagesByPackageFamily
OpenStateExplicit
CloseState
CreateMutexW
InterlockedPushEntrySList
FreeLibrary
LoadLibraryW
PowerCreateRequest
PowerSetRequest
CompareStringOrdinal
CreateFileW
WideCharToMultiByte
FindStringOrdinal
DeleteFileW
GetFileAttributesW
GetTickCount64
OpenProcess
LocalReAlloc
MultiByteToWideChar
InitializeCriticalSection
SizeofResource
CreateThread
lstrcmpiW
InitOnceBeginInitialize
GetSystemAppDataKey
DelayLoadFailureHook
ResolveDelayLoadedAPI
AssignProcessToJobObject
CreateJobObjectW
SetInformationJobObject
CreateIoCompletionPort
GetQueuedCompletionStatus
DeviceIoControl
GetNativeSystemInfo
GetSystemDirectoryW
GetVersionExW
ProcessIdToSessionId
ResetEvent
UnmapViewOfFile
GetProcessId
CreateFileMappingW
InitOnceExecuteOnce
GetUserDefaultGeoName
GetExitCodeProcess
SleepEx
ResumeThread
SetThreadPriorityBoost
SetThreadPriority
CopyFileW
WriteFile
FindPackagesByPackageFamily
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetGeoInfoW
CompareFileTime
GetWindowsDirectoryW
CompareStringW
ExpandEnvironmentStringsW
InitializeSRWLock
VerifyVersionInfoW
VerSetConditionMask
GetSystemTime
GetProductInfo
OpenFileMappingW
MapViewOfFile
OOBEComplete
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Cnd_do_broadcast_at_thread_exit
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Thrd_detach
_Thrd_yield
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_wait
_Mtx_unlock
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Xout_of_range@std@@YAXPEBD@Z
_register_thread_local_exe_atexit_callback
_initterm
_initterm_e
_c_exit
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_errno
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o_abort
_o_exit
_o_free
_o_iswspace
_o_lround
_o_malloc
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstoll
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
_o__get_errno
_o__exit
_o__errno
wcschr
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__itow_s
_o__itoa_s
_o__purecall
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcsrchr
__std_terminate
wcsstr
__CxxFrameHandler4
__C_specific_handler_noexcept
memcmp
memcpy
memmove
wcscmp
memset
strncmp
wcscspn
CoSetProxyBlanket
CLSIDFromString
StringFromIID
CoGetApartmentType
CoWaitForMultipleHandles
CoRegisterClassObject
CoGetMalloc
StringFromGUID2
PropVariantClear
CoRevokeClassObject
CoTaskMemRealloc
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoGetObjectContext
WindowsCreateString
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsDeleteStringBuffer
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsSubstringWithSpecifiedLength
WindowsDuplicateString
VariantInit
SysAllocString
SysFreeString
SystemTimeToVariantTime
VariantTimeToSystemTime
SysStringLen
VarUI4FromStr
VariantClear
GetErrorInfo
SetErrorInfo
RoInitialize
RoUninitialize
RoActivateInstance
RoGetActivationFactory
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
SHDeleteValueW
SHUnicodeToAnsi
SHSetValueW
SHGetValueW
SHDeleteKeyW
IsOS
SHRegGetValueW
ord191
SHTaskPoolQueueTask
SetCurrentProcessExplicitAppUserModelID
SHQueryInfoKeyW
ord190
ord184
ord186
SHSetThreadRef
SHCreateThreadRef
SHGetThreadRef
IUnknown_Set
IUnknown_QueryService
IUnknown_SetSite
PropVariantToUInt32
PSPropertyBag_WriteInt
PropVariantToStringAlloc
InitVariantFromBuffer
PSCreateMemoryPropertyStore
PSPropertyBag_WriteDWORD
PSPropertyBag_ReadDWORD
NtPowerInformation
RtlInitUnicodeString
RtlNtStatusToDosError
RtlPublishWnfStateData
RtlQueryUnbiasedInterruptTime
NtQuerySystemInformation
NtQueryInformationProcess
RtlGetNtSystemRoot
NtSetThreadExecutionState
NtOpenKey
RtlRunOnceExecuteOnce
NtDeviceIoControlFile
NtClose
RtlGetSuiteMask
NtCreateFile
NtQueryValueKey
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtOpenThreadToken
NtQueryInformationToken
NtOpenProcessToken
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
OleUninitialize
CoGetStdMarshalEx
CoCreateFreeThreadedMarshaler
CoAllowSetForegroundWindow
OleInitialize
RevokeDragDrop
RoGetAgileReference
CreateBindCtx
CoGetCallContext
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
ord244
ord899
ord938
SHChangeNotifyRegisterThread
ord188
ord904
ord100
SHGetKnownFolderItem
ord155
ord68
SHGetKnownFolderIDList
SHGetIDListFromObject
SHBindToObject
SHCreateItemInKnownFolder
ord172
ord680
ord723
ord885
SHEvaluateSystemCommandTemplate
SHParseDisplayName
SHBindToParent
ord152
SHGetKnownFolderPath
ord544
ord260
ord256
ord212
ord515
ord158
ord240
ord219
ord197
StrChrW
UnhookWindowsHookEx
GetAsyncKeyState
CallNextHookEx
UnregisterClassA
PostThreadMessageW
GetProcessWindowStation
TranslateMessage
CreateWindowInBand
SetWindowsHookExW
PeekMessageW
EnableMouseInPointer
DispatchMessageW
WaitMessage
GetSystemMetrics
PostMessageW
DestroyMenu
GetMenuDefaultItem
CreatePopupMenu
IsCharAlphaNumericW
CharLowerW
UnregisterClassW
GetMessageW
LockWorkStation
CloseDesktop
GetUserObjectInformationW
GetThreadDesktop
SetWinEventHook
MonitorFromPoint
ExitWindowsEx
FindWindowW
SetRectEmpty
CharLowerBuffW
CharNextW
GetWindowThreadProcessId
UnhookWinEvent
MsgWaitForMultipleObjectsEx
SetCursor
GetPropW
EnumDisplayMonitors
GetMonitorInfoW
CopyRect
SetGestureConfig
SetFocus
TranslateAcceleratorW
GetClassNameW
PostQuitMessage
SetShellWindowEx
UpdateWindow
SetWindowPos
EnumChildWindows
SendMessageW
RemovePropW
ShowWindow
GetSysColor
SetPropW
SetShellWindow
GetClientRect
KillTimer
InvalidateRect
BeginPaint
EndPaint
GetDC
ReleaseDC
UnregisterHotKey
RegisterShellHookWindow
DeregisterShellHookWindow
SetTaskmanWindow
GetTaskmanWindow
SystemParametersInfoW
RegisterWindowMessageW
GetShellWindow
DefWindowProcW
DestroyWindow
SetWindowLongPtrW
CreateWindowExW
GetWindowLongPtrW
RegisterClassExW
IsWindow
LoadCursorW
GetStockObject
GetDeviceCaps
GetUserNameExW
LsaLookupUserAccountType
RoTransformError
RoOriginateError
DeriveAppContainerSidFromAppContainerName
GetProfileType
PathCchAppend
PathCchCombine
GetPwrCapabilities
CallNtPowerInformation
InitializeCriticalSectionAndSpinCount
GetTraceLoggerHandle
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
StartServiceW
PathIsFileSpecW
PathQuoteSpacesW
PathFileExistsW
SHExpandEnvironmentStringsW
PathFindFileNameW
PathGetArgsW
SetTermsrvAppInstallMode
ord334
ord328
ord329
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcBindingFree
I_RpcExceptionFilter
RpcStringBindingComposeW
NdrClientCall3
ApiSetQueryApiSetPresence
ReleaseIdentityProviderEnumContext
GetDefaultIdentityProvider
EnumerateIdentityProviders
GetIdentityProviderInfoByGUID
FileTimeToVariantTime
InitPropVariantFromFileTimeEx
InitPropVariantFromSystemTimeEx
VariantTimeToFileTime
_ConvertTimeHelper
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ