StartHook2
StopHook2
Behavioral task
behavioral1
Sample
0c072a1dc3e2f0bfb154ded7a9aaf192.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0c072a1dc3e2f0bfb154ded7a9aaf192.dll
Resource
win10v2004-20231215-en
Target
0c072a1dc3e2f0bfb154ded7a9aaf192
Size
65KB
MD5
0c072a1dc3e2f0bfb154ded7a9aaf192
SHA1
e18f7781935c3c4a4927eda41dc56cb57e162018
SHA256
768faddbf8fb092dddd3ba9c4059d163a0723de970df292ce50e15e6e63c4748
SHA512
22a9a8fba5316cdb46255cce50656c21a1579d57f7eb61ce9863fc5749ee1ecb7767cfde48dfb2a9e1fe6c7f796099b401aedc7add967b86fe04efee34bc05af
SSDEEP
768:AElzIk28eCnKs0xuMZ84UFwFb1nxfUT1vrW5GOqMWgM:blz+8dOMwBUFwFRn6Zvro1M
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0c072a1dc3e2f0bfb154ded7a9aaf192 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
WriteProcessMemory
VirtualFree
VirtualAlloc
UnmapViewOfFile
TerminateProcess
Sleep
SetSystemTime
SetFilePointer
ReadProcessMemory
ReadFile
OpenProcess
OpenMutexA
OpenFileMappingA
MoveFileExA
MapViewOfFile
LoadLibraryA
GetWindowsDirectoryA
GetTickCount
GetSystemTime
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetCurrentProcess
GetComputerNameA
GetCommandLineA
FindFirstFileA
FindClose
DeleteFileA
CreateThread
CreateProcessA
CreateMutexA
CreateFileMappingA
CreateFileA
CompareStringA
CloseHandle
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
ExitProcess
UnhandledExceptionFilter
RtlUnwind
RaiseException
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
RegSetValueExA
RegSaveKeyA
RegRestoreKeyA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
CloseEventLog
AdjustTokenPrivileges
GetDeviceCaps
GetBkColor
SysFreeString
SysAllocStringLen
mouse_event
UnhookWindowsHookEx
ShowWindow
SetWindowsHookExA
SetThreadDesktop
SendMessageA
PostThreadMessageA
PostMessageA
IsWindowUnicode
IsWindowEnabled
IsWindow
IsMenu
IsDlgButtonChecked
GetWindowThreadProcessId
GetWindowTextLengthA
GetWindowTextA
GetTopWindow
GetWindow
GetMessageA
GetMenuItemID
GetKeyboardType
GetForegroundWindow
GetDlgItemTextA
GetDlgItem
GetClassNameA
GetClassLongA
GetActiveWindow
FindWindowExA
FindWindowA
EnableWindow
CreateDesktopA
CloseDesktop
CheckDlgButton
CallNextHookEx
BringWindowToTop
WSACleanup
WSAStartup
gethostbyname
socket
send
recv
inet_ntoa
htons
connect
closesocket
StartHook2
StopHook2
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE