Qy001DoMainWssk
Qy001Service
ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
0d40a392eade4bc1bd49789aba12c4ea.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0d40a392eade4bc1bd49789aba12c4ea.dll
Resource
win10v2004-20231215-en
Target
0d40a392eade4bc1bd49789aba12c4ea
Size
151KB
MD5
0d40a392eade4bc1bd49789aba12c4ea
SHA1
b43dcd9ca3382a0d04f98a42507d29e991472bf0
SHA256
7a9fbb69389bb505489be5772bcaed8bf291c953747b5fe352aebf2bc7a74fba
SHA512
b078afd513e88c10cb49625836c2668f3d5d4dafb1f5c4f7cf5981653829d103c0fc4c2b713e2fa8ed7e5683e43f248ccf4b4e956942856c54bbf197cb3dc749
SSDEEP
3072:VzfvFlWyPzIhQnpBvIOAqXN1fV2J5Icoh0a03Egd97MezsiW7zz:VzLWydIOAiN5Vm58h0jQEsiWT
Checks for missing Authenticode signature.
resource |
---|
0d40a392eade4bc1bd49789aba12c4ea |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ExitWindowsEx
GetDIBits
RegCloseKey
ShellExecuteA
CreateStreamOnHGlobal
listen
StrRChrA
GetModuleFileNameExA
ImmReleaseContext
capCreateCaptureWindowA
waveInUnprepareHeader
strrchr
OpenProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
Qy001DoMainWssk
Qy001Service
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ