CanUnload
RMACreateInstance
Static task
static1
Behavioral task
behavioral1
Sample
2933376b0e35ddd13b1fd0c85bedf710.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2933376b0e35ddd13b1fd0c85bedf710.dll
Resource
win10v2004-20231215-en
Target
2933376b0e35ddd13b1fd0c85bedf710
Size
378KB
MD5
2933376b0e35ddd13b1fd0c85bedf710
SHA1
c75a07837693a56f167f3b14c81c567f75985b55
SHA256
53ed0eca643611bf32f4338e886ef9960bdb0f2a80ddb742ea4bacf027c7c0d5
SHA512
fc1d32cb1dd440941df7b94e1fd271b0f95d5ccf613ef3fe722446ae6a80c25cd02a13b73de3960007cafa3ac592726d8988f41343abe698ba5c231caa6d9412
SSDEEP
6144:5GN26TlfnK8JyiOteDxXQqxBpwhO4HV+JOOs2QbqvExTDTEGfp:QN7TlfnAOtXFBp6O4BOwpXEGh
Checks for missing Authenticode signature.
resource |
---|
2933376b0e35ddd13b1fd0c85bedf710 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SetErrorMode
LocalFree
ExitProcess
LoadLibraryA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetProcAddress
LocalAlloc
FreeLibrary
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
QueryPerformanceFrequency
memmove
_vsnprintf
rand
srand
malloc
free
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
strrchr
atol
memcpy
_stricmp
memset
??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
CanUnload
RMACreateInstance
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ