allert
load
windows
Behavioral task
behavioral1
Sample
21ab69c0ec13e01076e160f44f9b5d8a.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
21ab69c0ec13e01076e160f44f9b5d8a.dll
Resource
win10v2004-20231222-en
Target
21ab69c0ec13e01076e160f44f9b5d8a
Size
25KB
MD5
21ab69c0ec13e01076e160f44f9b5d8a
SHA1
7fb264ee24d51a49bba0b2c30d92ab50cd5712fe
SHA256
df7cea925e635cf09644459c3ee956c767f24751070b07f0d6503cf64d3272d2
SHA512
e472039c7ac1a457504cb30725b05911039a0a356a9e91fc1f6abaad9e0d72cd27953f261113e39b291471f18a034698600e42eabcaebbdf3a7c6548ce5ede79
SSDEEP
384:IAIuI4oOaD+M7i7Vrqbbn+ujzll2ki4Z:TIuI42ajmX+El5i4Z
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
21ab69c0ec13e01076e160f44f9b5d8a |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrcpynA
TerminateProcess
RtlZeroMemory
LoadLibraryA
GetVersionExA
GetTempPathA
GetTempFileNameA
GetProcAddress
GetModuleFileNameA
CloseHandle
CreateThread
DeleteFileA
GetLongPathNameA
WaitForSingleObject
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
strlen
strcpy
strcat
fwrite
fseek
fread
fopen
fclose
atoi
_strlwr
Shell_NotifyIconA
PathFileExistsA
StrStrA
RegisterClassExA
SetTimer
PostQuitMessage
TranslateAcceleratorA
TranslateMessage
LoadIconA
LoadAcceleratorsA
BeginPaint
LoadCursorA
SetWindowPos
KillTimer
GetMessageA
EndPaint
DispatchMessageA
DefWindowProcA
CreateWindowExA
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
allert
load
windows
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE