ServiceMain
CollectOSObjectData
OpenOSObject
QueryOSObjectData
Static task
static1
Behavioral task
behavioral1
Sample
414ebe645203ecd2cdc54bb7c8fe3b9b.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
414ebe645203ecd2cdc54bb7c8fe3b9b.dll
Resource
win10v2004-20231222-en
Target
414ebe645203ecd2cdc54bb7c8fe3b9b
Size
176KB
MD5
414ebe645203ecd2cdc54bb7c8fe3b9b
SHA1
e143675a815aa0424a5427955082bf166a3fdb18
SHA256
29e411f41a88a0cc2b591bb2446256e51594414cc3f47318967ed9e57feb7f65
SHA512
6fca439501474c41db99a555c4bb3b66de39a24681465a004b0c3bc24a9e6a54fd8404f62de5eaf93a95a95cd0cd79b0de46076a12eca5e447f2441929bca9fd
SSDEEP
3072:fRYougYbOPkegVaq3VXSmZ8qwQ/qx4HEJ2G6x+pOZY59umoEZjBqI7h:fxuvbO9o8qKJcPW9ac
Checks for missing Authenticode signature.
resource |
---|
414ebe645203ecd2cdc54bb7c8fe3b9b |
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
free
malloc
_adjust_fdiv
_initterm
RtlNtStatusToDosError
NtQueryObject
NtClose
NtQueryValueKey
NtOpenKey
RtlInitUnicodeString
NtQuerySystemInformation
RtlIntegerToUnicodeString
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
VirtualProtect
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
HeapAlloc
lstrlenW
HeapCreate
HeapDestroy
HeapFree
DisableThreadLibraryCalls
HeapReAlloc
lstrcpyW
CreateFileMappingA
VirtualAlloc
CreateSemaphoreA
CreateEventA
CloseHandle
QueryPerformanceCounter
DeregisterEventSource
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegisterEventSourceW
ReportEventA
ServiceMain
CollectOSObjectData
OpenOSObject
QueryOSObjectData
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ