WLEventLogoff
WLEventLogon
WLEventShutdown
Static task
static1
Behavioral task
behavioral1
Sample
36d3884c9fac651e2b2f9a629981b690.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
36d3884c9fac651e2b2f9a629981b690.dll
Resource
win10v2004-20231222-en
Target
36d3884c9fac651e2b2f9a629981b690
Size
81KB
MD5
36d3884c9fac651e2b2f9a629981b690
SHA1
101d3c44ef7c08012c69cf15c279513439263c56
SHA256
4ae986082e4302a96af9767d58df92ae8b4adb18aafca73dd31217f463db18f1
SHA512
432ae77e30f5f3fab94d0c3c1c8a083354c3c5ba33148489563eddea6aaeac7ac73d73feabf161d8d274e223663ad0bd8c1a8815d51ba8f12dd2a8ca75f2fdb7
SSDEEP
1536:Xhz3emmyVyUYuWVUhU0HePceaTvlTKQarNnToIfLIO+YaD:cRQhU/6sQahTBf9+l
Checks for missing Authenticode signature.
resource |
---|
36d3884c9fac651e2b2f9a629981b690 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FindNextFileA
DeleteFileA
FindFirstFileA
GetVolumeInformationA
GetDriveTypeA
GetLogicalDrives
GetComputerNameA
LoadLibraryA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
FindClose
GetEnvironmentVariableA
LocalFree
LocalAlloc
GetLastError
Sleep
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetFileTime
ReadFile
GetFullPathNameA
GetTempFileNameA
SystemTimeToFileTime
GetLocalTime
GetSystemTime
GetDateFormatA
GetTimeFormatA
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreA
WinExec
GetTempPathA
ReleaseSemaphore
ResumeThread
SetThreadContext
VirtualFree
GetThreadContext
VirtualAlloc
VirtualAllocEx
CreateProcessA
FreeLibrary
GetProcAddress
GetVersion
MoveFileExA
MoveFileA
CopyFileA
GetSystemDirectoryA
GetTickCount
GetExitCodeProcess
PeekNamedPipe
GetStartupInfoA
CreatePipe
SetFilePointer
lstrcpyA
lstrcpynA
CreateDirectoryA
RemoveDirectoryA
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
WaitForSingleObject
SetEvent
CreateEventA
InitializeCriticalSection
CreateFileA
WriteFile
lstrcmpiA
VirtualProtect
GetCurrentProcess
OutputDebugStringA
WriteProcessMemory
GetFileAttributesA
GetSystemTimeAsFileTime
VirtualQuery
HeapFree
GetProcessHeap
HeapAlloc
lstrlenA
CreateThread
CloseHandle
GetCurrentThreadId
MessageBoxA
wvsprintfA
OpenProcessToken
RegCreateKeyA
RegNotifyChangeKeyValue
RegEnumValueA
RegDeleteValueA
RegSetValueExA
ImpersonateLoggedOnUser
RevertToSelf
GetTokenInformation
LookupAccountSidA
RegOpenKeyExA
RegEnumKeyA
RegQueryValueExA
RegCloseKey
CreateStreamOnHGlobal
NtOpenProcess
_strcmpi
strchr
NtFreeVirtualMemory
memmove
NtClose
_strlwr
strstr
memset
memcpy
RtlUnwind
NtQuerySystemInformation
NtAllocateVirtualMemory
htonl
gethostbyaddr
gethostname
WSAStartup
ioctlsocket
WSAGetLastError
select
shutdown
setsockopt
closesocket
socket
htons
accept
connect
bind
listen
getsockname
send
recv
inet_addr
gethostbyname
__WSAFDIsSet
DnsQuery_A
DnsRecordListFree
ord19
ord13
ord135
ord138
ord21
ord11
ord23
ord140
ord129
ord17
ord75
RasEnumConnectionsA
StrToIntA
StrChrA
StrCmpNA
StrStrA
WLEventLogoff
WLEventLogon
WLEventShutdown
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ