DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
0cc4894810ee85a694aed13b6d32d9ff.dll
Resource
win7-20231215-en
Target
0cc4894810ee85a694aed13b6d32d9ff
Size
64KB
MD5
0cc4894810ee85a694aed13b6d32d9ff
SHA1
fcab9cd26f664b145a9132406422229f8202a9ce
SHA256
dc00ae5b32869f23dcd0038503cc027199b909b1e114b1b17fd1a99de6c0a1d0
SHA512
427c1eb0cb5b11065fb2af21c12df75404b527a0626faeaad8d1172ad14e64343ecc161184ee7c05fe485c0a7bbfb52e1b66b0af85b6f58d0f7981294f3640ea
SSDEEP
1536:tXybDPUtn+UXykrDIp+PPZBuiIWWyhnwPQNBdMJpucc:t2mzDPOipnrMJpucc
Checks for missing Authenticode signature.
resource |
---|
0cc4894810ee85a694aed13b6d32d9ff |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleFileNameA
GetSystemDirectoryA
GetExitCodeProcess
WaitForSingleObject
LocalFree
RemoveDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
lstrlenW
CreateProcessA
GetModuleHandleA
MoveFileA
GetCommandLineW
WideCharToMultiByte
Sleep
WritePrivateProfileStringA
CreateDirectoryA
GetCurrentProcessId
FreeLibrary
Process32First
Process32Next
CloseHandle
ExitProcess
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
FindNextFileA
LoadLibraryA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
lstrlenA
CreateThread
MultiByteToWideChar
GetShortPathNameA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoMarshalInterThreadInterfaceInStream
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
ftell
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
strncmp
strncpy
strchr
atoi
strcmp
strlen
memcmp
sprintf
??3@YAXPAX@Z
strstr
memset
strrchr
strcat
strcpy
fclose
fread
??2@YAPAXI@Z
_stricmp
fseek
fopen
_access
memcpy
_purecall
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ