DllRegisterServer
DllUnregisterServer
WLEventLock
WLEventLogoff
WLEventLogon
WLEventShutdown
WLEventStartScreenSaver
WLEventStartShell
WLEventStartup
WLEventStopScreenSaver
WLEventUnlock
Static task
static1
Behavioral task
behavioral1
Sample
42bff905e13a896511b907fb29e36459.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
42bff905e13a896511b907fb29e36459.dll
Resource
win10v2004-20231222-en
Target
42bff905e13a896511b907fb29e36459
Size
188KB
MD5
42bff905e13a896511b907fb29e36459
SHA1
76708d9c8d839143a862451c5a87cf8e2d0a94f6
SHA256
908fdc51b6f587e26470803bcaeba773fa6b0c8d754a97789863f913251dc096
SHA512
e4daa0ed25056d68afbffb7dbb3ecca94ce630894195fbfb7554432db6b96571f4c5f857df21f7ef36874878bd80505e7259a449c318d4542834ac0a0cdf134f
SSDEEP
3072:McgQEyWaJna2xZNsRwkHgmy2rpzx49tUOV1EQICqzD8g86aBhD0DhUbCwv8dhBhC:0QEyPaqre/AD2rb2ID8g86aBhDUUup9C
Checks for missing Authenticode signature.
resource |
---|
42bff905e13a896511b907fb29e36459 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_initterm
free
wcscpy
_except_handler3
wcslen
swprintf
malloc
_adjust_fdiv
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlFreeSid
NtQueryInformationToken
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CloseHandle
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
lstrcpyW
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
lstrcatW
CreateDirectoryW
WritePrivateProfileStringW
SetLastError
TerminateProcess
GetLastError
GetComputerNameW
LocalFree
lstrlenW
CryptAcquireContextW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
CopySid
GetLengthSid
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptReleaseContext
GetTokenInformation
AllocateAndInitializeSid
LookupAccountSidA
FreeSid
RegOpenKeyExW
CryptDestroyKey
DuplicateToken
CheckTokenMembership
ImpersonateLoggedOnUser
RevertToSelf
RegQueryValueExW
CryptGenKey
GetUserNameW
RegCloseKey
LoadStringW
wvsprintfW
CertOpenStore
CertStrToNameW
CertCreateSelfSignCertificate
CertOpenSystemStoreW
CertAddCertificateContextToStore
CryptEncodeObject
CertFreeCertificateContext
CertCloseStore
RpcBindingFree
RpcRaiseException
RpcBindingSetAuthInfoExA
RpcStringBindingComposeW
RpcBindingFromStringBindingW
UuidCreate
UuidToStringW
RpcStringFreeW
NdrClientCall2
CoInitialize
CoCreateInstance
CoUninitialize
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
ord140
ord224
ord18
ord13
ord41
ord208
ord73
ord26
ord170
DllRegisterServer
DllUnregisterServer
WLEventLock
WLEventLogoff
WLEventLogon
WLEventShutdown
WLEventStartScreenSaver
WLEventStartShell
WLEventStartup
WLEventStopScreenSaver
WLEventUnlock
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ