CloseIt
FoxDoCmd
FoxEval
GetLastErr
SetErrMode
SetOleObject
Static task
static1
Behavioral task
behavioral1
Sample
1d3bc1380443138aec76d70ca4a1cba8.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1d3bc1380443138aec76d70ca4a1cba8.dll
Resource
win10v2004-20231215-en
Target
1d3bc1380443138aec76d70ca4a1cba8
Size
210KB
MD5
1d3bc1380443138aec76d70ca4a1cba8
SHA1
45ad1b99c182f835d9337e3b5959b11602b022dd
SHA256
fdff8a7814e8ee022e63abc2e50c1548a6f9c96563ee28a11bc28815978bee92
SHA512
7d22747dca9b5b29ac2e5d86bedbbc9b14cabffea04439e0f3c776010158d33b6b49bbbe20bbf76976f0e3d14d53ff5d5fd70d9a69633baf3bcd612d735e92d6
SSDEEP
3072:qWbnc7bVFsgO+sCuYc/nqd+iNu3joiWIwZd+dcwb6sIUeKRbuoXEdh61lMvuQ:Hjc1F++s5Yc/0+53jGnZJGIV8vXEdhF
Checks for missing Authenticode signature.
resource |
---|
1d3bc1380443138aec76d70ca4a1cba8 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
WideCharToMultiByte
lstrlenW
DebugBreak
ExitProcess
TerminateProcess
MultiByteToWideChar
VirtualAlloc
GetModuleHandleA
GetEnvironmentStringsW
GetEnvironmentStrings
LoadLibraryA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCurrentProcess
FreeEnvironmentStringsA
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
FreeEnvironmentStringsW
WriteFile
HeapCreate
VirtualFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
MessageBoxA
SetForegroundWindow
FindWindowA
CharLowerA
wsprintfA
LoadStringA
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CLSIDFromProgID
CoCreateInstance
VariantClear
SysStringLen
SysAllocString
VariantInit
GetActiveObject
CloseIt
FoxDoCmd
FoxEval
GetLastErr
SetErrMode
SetOleObject
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ